USDX Public Surface

Proof of Reserves
Methodology

This document explains the reserve quantities and proof metadata currently exposed by USDX: what they mean, what they do not mean, and which parts of the disclosure stack are still maturing.

Primary invariant: reserves ≥ supply

Current source: Reserve oracle + local match

Updated: 2026-04-26

01 Objective

The proof-of-reserves surface is designed to show whether the publicly attested reserves are sufficient to cover USDX global supply and whether the latest reserve snapshot is still considered fresh on-chain.

Core Reconciliation Rule

attested_total_reserves ≥ global_supply

This rule is the minimum public correctness condition for reserve disclosure. When it does not hold, the public status surface must degrade immediately.

02 Definitions

Field	Meaning
total_reserves	Total reserves attested by the reserve oracle snapshot.
liquid_reserves	The liquid subset of reserves available for short-term redemption readiness.
snapshot_timestamp	Timestamp of the reserve snapshot being referenced on-chain.
max_reserve_age	Maximum allowed age for the reserve snapshot before it becomes stale.
report_hash	Latest attestation report hash published on-chain.

ℹ️

The public API can publish asset-class amounts for T-Bills, cash, money market funds, and issuer capital buffer when a matching published local reserve snapshot includes that disclosure. When it does not, the same structure remains visible with unpublished amounts.

03 Hash Model

The on-chain reserve oracle exposes a latestReportHash. The public /proof endpoint uses that value as its anchor and only adds human-readable publication metadata when a local reserve snapshot matches both the same hash and snapshot timestamp.

proof.report_hash            ← on-chain reserve oracle
proof.snapshot_timestamp     ← on-chain reserve oracle
proof.attestor               ← local snapshot, only on exact match
proof.published_at           ← local snapshot, only on exact match
proof.publication_status     ← local snapshot, only on exact match

This matching rule prevents the public surface from attaching a stale or unrelated off-chain record to the current live on-chain report hash.

04 Freshness

Freshness is not a frontend guess. It is returned directly from the reserve oracle and is also used by the public status endpoint when deriving whether minting should remain enabled.

fresh = true means the current reserve snapshot is within the configured maximum age.
fresh = false means the current snapshot is stale on-chain.
When reserves are stale, the public status surface should move to a degraded state.

05 Disclosure Limits

Attestation URLs and public archives are supported, but remain null whenever the matching local reserve snapshot has not published them.
Cadence labels such as daily or weekly are supported, but depend on matching local reserve snapshot metadata.
Annual audit details and long-form public audit narratives still need explicit publication outside the current endpoint payloads.

Read Data Provenance Read Compliance Policy Open the Live Hub