Designing a pool standard for tokenized bonds

Bondi brings public credit onchain the way it actually works: Bond Tokens as full bond primitives that pay coupons, get called, amortize and mature, so that anyone, anywhere, can hold a bond, trade it, and build on it through the abstraction layer we wrap around it, the Reinvestment Vault's share; and so that when issuers come onchain, with Bondi, the infrastructure is already there.

How a bond trades today, and why it should not

A publicly traded corporate bond is listed, but it does not trade like a stock. Corporate bonds trade in decentralized, dealer-based, over-the-counter markets: there is no central order book, and even an order placed through a retail broker is routed to dealers and filled, if it is filled, by request for quote. The quote is a clean price, a percentage of face value, the amount the issuer promises to repay at maturity, so a quote of 98 means $98 for every $100 the bond will pay back. It excludes the interest the bond has earned since its last coupon. That interest is real money you also pay: computed separately, by a day-count convention that differs from bond to bond, and added at settlement, a business day or two later, on its own line of the confirmation. To know what you actually paid, you reconstruct it. 🤯 And most USD bonds issued outside the US registered market carry a minimum denomination of $200,000, so below that lot the bond cannot be traded at all. This is the $17 trillion USD-denominated corporate bond market, close to $70 billion traded a day, and it runs on infrastructure from another century.

We started from the obvious question: what would a market for a bond look like if it were built today, respecting what a bond is? It would show one price, the price you pay, with accrued interest inside it. It would quote continuously, to anyone. It would let a free market find the bond's value between the dates on which the bond itself tells you what it is worth. And it would carry every event in the bond's life, every coupon, every early return of principal, every maturity, without asking the holder to do anything.

That is what Bondi builds, and for whom: everyone the old market left outside the lot. A Bond Token (BT) is an onchain claim on publicly traded corporate bonds held one to one under regulated custody, one token per $100 of face value; a basket BT bundles several bonds into a single token. It pays what the bond pays, gets called when the bond is called, and matures when the bond matures, because that is what natively issued onchain bonds will be. Above it sits an abstraction layer, the Vault Bond Token (vBT), that turns the bond into a clean building block any protocol in DeFi can price, hold, lend against or compose.

Two Bond Tokens have already run their full lives from issuance to maturity with every coupon and principal payment delivered onchain. For now, a Bond Token's value is not discovered in a pool. It is the bond's own market value, the dealer quote plus accrued interest, marked from cbonds data and delivered onchain by an external oracle provider at least once a day; the vault share is priced from that same feed and the vault's own state, and lending markets price collateral from there. The pool's job is different: it is where the primitive trades onchain, where a free market buys and sells the bond around that value, continuously, for everyone the lot minimum shuts out. It is sized with the partners who provide its liquidity according to each Bond Token's supply, so that the abstraction layers above it work and so that anyone below the institutional lot can enter and exit at will; the institutional lot itself has its own door, a real bond sale through the Redemption Vault at the bonds' own value, which is also what puts a floor under the pool. Whenever the pool drifts from the bond's value, the drift is a profit for whoever trades it back, so no one has to hold the pool to the price; the market does it for its own reasons. This post is about how it does that, why it holds, what it earns, and where it goes: a pool standard for tokenized fixed income.

The seed of the idea

Our 2024 whitepaper, written before any pool existed, described the secondary market for Bond Tokens as an automated market maker with two changes to the standard design. Circuit breakers 5% above and below a live oracle price, so the pool would only accept trades back toward fair value once it reached an edge. And accrued interest built into the price, so that a seller between coupon dates is paid the interest earned while holding and a buyer pays it, the way a bond desk does it, but visible in the one number you trade at. We called it steadyAMM: a market that stays close to what the bond is worth, without a dealer.

When the first Bond Tokens went live we did not build a custom exchange. Uniswap v3 already let liquidity sit only inside a chosen price range, which is the corridor from the paper. And the oracle the pool references carries the bond's dirty price, the dealer quote plus accrued interest, sourced from cbonds and delivered onchain by an external oracle provider, so the accrual the paper wanted inside the price is inside it by construction. So the corridor from the paper became where the liquidity is placed, and the job the circuit breakers were meant to do, pulling the pool back toward fair value at the edges, is done by arbitrageurs who are paid to do it. Nothing custom had to be written. Everything below is that 2024 design, built with Uniswap v3 and sized to each Bond Token's own cashflow calendar.

Three principles

• Non-custodial. The liquidity in every pool belongs to the partners who provide it and never leaves their hands. It sits in a Gnosis Safe with a signer set of the partner's choosing. Bondi operates the position through Zodiac Roles, the permission standard karpatkey uses to manage multi-billion-dollar DAO treasuries, scoped to exactly the pool operations and constrained so that every action can only ever return funds to that same Safe. The Safe is the liquidity provider onchain, so it earns the pool's trading fees and the bonds' own coupons directly. There is no step where Bondi holds anything.

• Minimally operated, and deterministic. A Bond Token's cashflow calendar, every coupon and every return of principal from every bond behind it, is public. So are the few operations the pool needs. Almost all of them happen on that calendar, announced in advance; between them the operator does nothing unless the price moves out of the ordinary. Bondi is not a dealer and never stands on the other side of a trade.

• Carried by the market. A pool's price moves only when someone trades. It does not follow the oracle. People do, because every gap between the pool and the bond's intrinsic value is a trade someone is paid to make. The liquidity providers are not dealers: they never set a price. The bond's value comes from its own market through the oracle; the providers stand in a corridor around it, and an open market, arbitrageurs, the vault's scheduled buys, holders with inventory, trades the bond there and pays them for standing.

What trades, and where

Each Bond Token has one canonical pool: a Uniswap v3 concentrated-liquidity pool against USDC, 0.3% fee tier, with liquidity placed in a 5% band either side of the oracle's dirty price.

The pool trades the Bond Token itself, the primitive, not the vault share. The Reinvestment Vault turns every coupon into more Bond Tokens and hands the rest of DeFi a clean, continuously priced share, the vBT, which is what lending markets take as collateral. The share needs no market of its own: it is minted and redeemed against the Bond Token directly, so buying from the pool and wrapping, or unwrapping and selling, are two steps that can batch into one action, and that is exactly how the Bondi app enters and exits a vault position with stablecoin. Everything mechanical in the system, the vault's reinvestment buy, the coupon snapshot, the call, acts on the primitive, so the primitive is what trades.

Sizing follows from that job. The seed is set with the partners who provide it against the Bond Token's supply and the three flows the pool must absorb: everyday entries and exits below the institutional lot; the Reinvestment Vault's buys, which follow the token's cashflow calendar, every coupon and every smaller return of principal (such as amortizations and partial calls) from every bond behind it, so that the largest reinvested event that calendar can produce clears the vault's 2.5% execution guard in a single swap; and the entries and exits of the abstraction layer above, the vault share as collateral and the leverage built on it, which reach the primitive through this pool. Nothing larger belongs in the pool. The institutional lot goes through the Redemption Vault, and the arbitrage born there, buy below the bonds' value onchain and redeem at it, is what puts the floor under the pool's price.

Liquidity is spread evenly across the band, rather than concentrated at the oracle with thin tails, and all of it is deployed. The even spread gives the smoothest slippage curve, no dead zones and the cleanest price discovery, and it lets the price travel a little further on a given trade, which pays whoever pulls it back a little more. Full deployment is chosen because liquidity sitting off-pool earns nothing, because the depth already suffices for every flow above, and because a pool that drains on one side creates the trade that refills it.

What a bond does through its lifecycle, and what the pool does about it

A bond is not a static instrument. It earns interest every day, pays it out on a calendar, can return principal early through an issuer call or an amortization, and one day matures. In a basket Bond Token, a single constituent can mature or be called while the others live on. Every one of these changes the price of the token or the amount of it outstanding, and every one has a date the market can see in advance. The pool is built to treat each of them as a trade someone is paid to make, and Bondi's part is small and scheduled.

• Every day, interest accrues. The bond's dirty price rises a few hundredths of a percent a day; the pool stays where the last swap left it. Buying the pool below the accruing price is buying real interest at a discount, and the longer nobody does, the better the discount. Take a bond that pays quarterly, 85 days into the period, in a pool that has lagged: a buyer today receives 90 days of coupon in five days and can sell straight after. Once the gap is wider than the fee, the trade is there for whoever wants it.

• On a coupon date, the price steps down, and the market trades the step. On the day a bond pays its coupon in the traditional market, the dirty price steps down by exactly the coupon. Onchain, the cash settles at the custodian, is converted and registered a few business days later, and that registration fixes the snapshot of who is paid. In between, the token is ex-coupon in price and cum-coupon in entitlement: it is still owed the full coupon, so its fair value is the oracle plus the coupon, not the oracle. A pool sitting at that value simply holds there and does not follow the oracle down; a pool that has drifted below it, for whatever reason, is a buy, because whoever takes it before the snapshot collects a full period's interest within days. The pool's step comes at the snapshot instead. From that moment the coupon is fixed to whoever held, the token is owed nothing more, and its fair value drops to the oracle. The pool does not drop by itself: anyone with inventory now holds a coupon claim plus a token trading a full coupon above what it is worth, so selling into the pool until it reaches the oracle is free money, and that selling is what brings the pool down to fair value.

That is where the reinvestment cycle begins. The vault receives the coupon in cash after the snapshot and buys Bond Tokens through this pool on a date everyone can see. A pool sitting at or below the oracle ahead of that buy is a position: buy before the vault's purchase, hold through the lift, sell after, or stay and ride the next cycle; the sell after the lift is the same inventory holders bringing the pool back to fair value again. Across our tokens that is several dozen dated buys a year, each worth a few percent to whoever takes it, computable in advance from the public calendar. Nothing forces anyone to take any of these trades. What the design guarantees is that the profit is there, before and after every coupon, for whoever wants it, and that the vault's guard means it never pays a bad price. With the Coupon Token, a holder who has not completed identity verification (KYC) receives the coupon as a transferable claim, so every one of these trades is open to anyone and can be automated end to end.

• On a call, an amortization or a constituent maturity, supply shrinks. Small events reinvest through the pool like a coupon. Larger ones distribute cash and burn the matching supply, and a call freezes transfers for the seconds it takes to settle every holder. So liquidity is withdrawn just before the event is registered and redeployed afterward, centered on the post-event oracle, one notch smaller in size. The logic is the same as the coupon: the oracle will sit at the post-event level, the date is public, and whoever prices it first, selling into a pool above that level or buying one below it, earns the difference. Whether or not anyone does, the sequence is the same, and every partner is alerted ahead of it.

• On a large repricing, the position is moved before the price. When the bonds behind a token reprice by more than ordinary drift, the oracle provider flags the move to Bondi before the new price goes onchain, liquidity is withdrawn, the price is delivered, and the position is redeployed centered on it. Because liquidity sits only inside the band, the most any surprise can cost is bounded by the band and one side of the seed, and a repricing this size is a rare thing for a publicly traded corporate bond, rarer still for a basket of them.

• Slowly, a band can drift. Most tokens are re-centered for free by their own scheduled events. A token with no such calendar drifts toward a band edge over months, and Bondi re-centers it when the oracle approaches the edge. This is the one unscheduled operation the design leaves with the operator.

• At maturity, the bond pulls to par into a known date. Once principal is registered onchain the position can be withdrawn, or kept open a while longer so holders who have not completed identity verification can still exit through the pool, to buyers who redeem at par.

Two things the market handles without any event

If one side drains, the drain is the trade. Inside the band, too low: the token has intrinsic value, anyone with identity verification can redeem it for the bonds' own value, and arbitrageurs buy. Too high: partners with inventory and anyone else holding sell into it. Either way the imbalance creates the profit that closes it. A one-sided pool is temporary, never terminal.

Anyone may add liquidity, anywhere. Quoted too cheap outside our band, it gets bought. Quoted too rich, holders sell into it. No prohibition is needed, and none exists.

Coupons, the primitive, and why there is one pool

A bond does not change how many bonds you hold when it pays interest. Neither does a Bond Token. Its balance never changes; coupons reach holders by snapshot, in stablecoin for holders who have completed identity verification and as a transferable Coupon Token for everyone else, and the price carries accrual the way a bond's dirty price does. That is what makes it a primitive, and it is why it can sit in a standard pool at all, where a token that rebased would push its losses onto liquidity providers with no way back.

The tokens inside the pool at a snapshot belong to the pool contract, and a contract has no one to pay: anything sent to it, stablecoin or Coupon Tokens, would sit there unclaimed forever. So Bondi's backend reads every liquidity position in the canonical pool at the snapshot block, works out how many Bond Tokens each provider held, and includes each provider in the same distribution as every other holder, combining their direct holdings and their pool positions, paid in stablecoin or, without KYC, in Coupon Tokens. Nobody withdraws liquidity for a coupon, and no coupon is lost inside the pool.

That is also why a second pool has no reason to exist. Uniswap is permissionless and anyone can open another pool for the same token; nothing breaks if they do, and nothing forbids it. But the coupons on the tokens inside the canonical pool are paid to its providers and to no one else, and the vault's reinvestment buys, the largest scheduled flow in the system, land there and nowhere else. Liquidity placed anywhere else gives up the interest and misses the buyer. The market keeps rival pools absent or thin.

What the pool earns

Fee income is layered from three identifiable flows rather than assumed from one turnover number. Organic trading, measured on our most recently matured pool at about 31% of the seed a year, on retail flow alone. The reinvestment cycle: the vault's buy on every coupon and every reinvested event, plus the corrective sell that follows it back to fair value, derived from each token's cashflow calendar, and dominant because the vault it serves is many times the seed's size. And alignment arbitrage, the standing two-way flow that holds the pool to the oracle between events, which includes the step around every coupon snapshot and the sell after every reinvestment lift described above; it is modeled conservatively as a fraction of the cycle flow, and the flows above are why that fraction is conservative. Across the tokens we have modeled, at the 0.3% tier:

Read the pool position as a position in its own right. Half of it is the Bond Token, earning the bonds' own coupons; half of it is stablecoin; and the whole of it is paid for making the market. The stablecoin half can only leave the position through the band, which means at prices no more than 5% below the last fair value, and the operations above move the position before a large repricing reaches the pool. So the worst case in a default sits somewhere between half the position untouched and a position fully in Bond Tokens bought at an average of 2.5% below the last mark: never worse than a bondholder who paid 2.5% under the last fair value, and in the ordinary case with half its capital never exposed at all. On the investment-grade end the seed already earns about two thirds of the bonds' own yield with only half its capital exposed to credit, which per dollar at risk is more than holding the bonds outright. Some of the parties running the arbitrage above will also hold pool positions and some will not; a sophisticated participant chooses per its own mandate, and the seat can earn both. At the beginning, the seed is expected to come from the parties who mint Bond Tokens and loop the vault share, because their own collateral and leverage need the market to exist from the first day. As the ecosystem matures, a pool position on a Bond Token stands on its own.

The matured figures price the ecosystem Bondi is building toward. Today's basket Bond Tokens are an intermediary step. The destination is every bond onchain as its own single-name Bond Token, minted by whoever brings the capital, with Bondi as the onchain bond broker that services and distributes them, and baskets composed on top by anyone: an ETF Vault takes single-name Bond Tokens as inputs and issues one token over a basket of the manager's choosing, rebalancing or not, with coupon distribution built in and the ability to decompose it back into its constituents. A basket that does not rebalance adds nothing to pool volume beyond its own entries and exits. A basket that holds target weights has to trade its constituents as their prices disperse, selling what outperformed and buying what lagged, and both legs of every such trade cross the constituents' pools, where the seed is the standing liquidity. The matured table assumes that second kind: baskets rebalanced daily, with the trading they generate derived from how much the underlying bonds' prices actually move against each other, and without assuming any growth in the amount outstanding:

At that stage, on the investment-grade end the market-making income is the larger part of the return and the position earns more than the bonds it half-holds; on the high-yield end the coupons still lead. The half-default protection is the same across the range.

The evidence

We ran a production pool on our most recently matured Bond Token: a single-name Bond Token against USDC on Uniswap v3 on Base, from late November 2025 to the bond's maturity in June 2026, when the liquidity was withdrawn on the known date. It was managed by hand. Liquidity sat in tight ranges around the bond's oracle price, about half a percent to four percent wide, and was moved roughly once a month to stay centered as the price drifted, never because the market forced it: the largest weekly move of the oracle over the whole period was about 2%. Across its life every trade printed within 2% of the oracle, well inside the 5% corridor we now design around, with a median deviation of under 20 basis points below the reference on daily averages, on roughly 31% annual organic turnover from retail flow alone. That was before any of today's machinery existed: no vault buying through it, no arbitrage partners, no scheduled flows. What it proved is the part that matters: a concentrated pool on the raw Bond Token holds the bond's price with light-touch operation and ordinary flow. The 5% band, the even spread, the full deployment and the calendar-driven operations above are the design built on that proof. It is a completed pool, not a live one, and every day of it is onchain for anyone to check.¹

The gold standard for automated market making in fixed income, built on Uniswap v4 hooks

Everything above works, and the economics carry it. What remains with Bondi is a short list of operations: withdrawing and redeploying around supply-reducing events, and moving the position on a large repricing or on slow drift. And three things the pool cannot yet do for itself: enforce the band on a trade, decide who provides liquidity, and account for its own coupons, which today takes the backend step that reconstructs every position and includes its provider in the distribution. All of those are rules Bondi keeps. The standard is the version where the venue keeps them.

Uniswap v4 lets a pool carry a hook, logic that runs before and after every swap and every liquidity change. Written as a hook, the design above becomes a property of the pool:

• Liquidity from a chosen set of providers, trading open to everyone. The two halves of the market are separated cleanly.

• The band, enforced. Nothing fills outside a set distance from the bond's price. The corridor from the 2024 paper, kept by the venue.

• Re-centering on events, never continuously. The pool moves its range when the oracle reports a move past a threshold, when it nears a band edge, and around every supply-reducing event, burning its share and crediting the cash in the same flow. Between events the gap stays, because the gap is the arbitrage.

• Coupons and principal credited inside the pool. Per provider, through the same path our vaults already use to receive their proceeds. The backend step disappears, and the canonical pool's claim on the interest becomes onchain and immutable.

• No operator. Bondi keeps building the tools; the pool keeps the rules.

Two directions we will decide later rather than now: a fee that scales with a trade's distance from the bond's price, so that dislocating the pool pays its providers more and aligning it costs less; and a small fee layer for the architecture itself, which matters once tokenized fixed income trades in the billions.

A bond issued natively onchain will need exactly this market: one price with the interest inside it, continuous for everyday size, with a real bond sale behind it for the rest, holding to the bond's value by profit rather than by permission, carrying every event in the bond's life. We are building it for the bonds that still live in the traditional market, with partners, and we intend to take it to Uniswap as the pool standard for fixed income.

1 - btLIFE / USDC pool on Base, Uniswap v3