How the pool works, in full.

One pool of USDG. An agent's line can be backed by up to 20 distinct sponsors at once, each at its own premium, plus any number of seats (see § 03) on top. If a loan defaults, the loss is burned only from the pool-shares of the sponsors who actually backed that loan — never a lender's, and never a sponsor who backed a different agent or joined this one after the default.

backing(r)   = sharesValue(r)                     // r's own pool shares, in USDG
free(r)      = backing(r) - delegatedOut(r) - feeLocked(r)
available(a) = delegatedIn(a) - principalOut(a)    // what's left on agent a's line

vouch(r -> a, amount):   require amount <= free(r)  // + the owner's EIP-712 consent, see below
                         delegatedOut(r) += amount ;  delegatedIn(a) += amount

borrow(a, amount, term): require minLoan <= amount <= available(a)
                         principalOut(a) += amount
                         // amount splits pro-rata across a's CURRENT sponsors, by stake.amount;
                         // each sponsor's own fee share is frozen into loan.shares[] right here
                         feeLocked(sponsor) += its share of the fee

repay(a, principal+fee): fee -> lenders 60% + each sponsor 25% (its own cut) + reserve 15%

Four transitions. The last one is a default, where the backing sponsors pay.

require now > loan.defaultableAt          // dueAt + GRACE_PERIOD(3d), fixed at borrow

for each SponsorShare in loan.shares:
  burn ceil[(principal+fee) * totalShares / totalAssets] of that sponsor's own shares
  // if its live stake somehow falls short (should be unreachable — vouch()/
  // borrow() only ever check freeCapacity at that moment), the shortfall
  // becomes explicit totalBadDebt instead of diluting anyone else

for every sponsor of this agent (used by this loan or not):
  release its full remaining committed capacity — the agent can never
  borrow again, so nothing should stay locked against it

agent.defaulted = true ;  agent.delegatedIn = 0
share price: never falls for an uninvolved lender or sponsor

A seat backs an agent with 10 or more repaid loans using a fixed-ratio lock of a separate token (intended to be $AUEVO), on top of the same real-USDG capacity an ordinary vouch requires — never instead of it. The reasoning for that ordering (why burning an unrelated token alone can never protect a lender) is laid out in full on the Seats page. Short version: 50% of the seat's token lock burns on default of the loan it backed; the rest returns, same as an ordinary sponsor's pool-share burn running alongside it.

Reviewed by hand and exercised by 118 integration-test assertions against a local chain (contracts/test/run-credit.mjs) — not an automated invariant fuzzer, and not a paid, independent, professional audit. Treat these as intended properties the tests check, not a guarantee.

The first table is read live from the deployed pool — a real decision made at deploy time, not a code detail. The second is fixed in the contract source itself and identical for any deployment of this version.

Every write a lender, sponsor, seat-holder or agent can call, plus the views this app's own pages read from.