Kerne Protocol Whitepaper

1. Abstract

Kerne Protocol is a synthetic dollar protocol on Base. It issues kUSD, a token pegged to one US dollar and minted 1:1 from USDC through an on-chain Peg Stability Module, and skUSD, an ERC-4626 staking wrapper of kUSD designed to earn the protocol's delta-neutral yield.

The yield comes from two independent sources: Ethereum staking rewards earned by liquid-staked ETH collateral, and perpetual-futures funding payments earned by an equal-sized short position that neutralizes directional ETH exposure. Neither source depends on token emissions, new deposits, or speculation on price direction.

Two design commitments distinguish Kerne from custodial yield products:

• Self-custody. kUSD and skUSD live in the holder's own wallet. The protocol never takes custody of a user's stablecoins beyond the on-chain contracts that back them.
• Verifiability. The backing, the yield computation, and the risk thresholds are all published as live, machine-readable endpoints. The headline APY is recomputed every minute from public Lido and Hyperliquid data at kerne.fi/api/apy, and an hourly signed Proof of Reserves is published at kerne.fi/api/por/signed. Anyone can reproduce both.

As of 28 July 2026 the published rate is roughly 3%, on the deployed basis derived in Section 5. The rate is variable: it strengthens when perpetual funding is strong, compresses when funding cools, and can turn negative. Until 24 July 2026 this paragraph said the rate sat in the low teens. That figure was computed on a flat 3.0x multiplier, which overstated the deployed book by roughly four and a half times; the hedge is sized one for one against spot, so the correct multiplier is L/(L+1), which is below one. Section 5 derives the full computation chain and states the correction.

2. The Problem

2.1 Stablecoin yield goes to issuers, not holders

The global stablecoin market exceeds $220 billion. USDC and USDT together account for more than 75% of that supply, and both are backed by US Treasury bills and money-market instruments. The yield from those instruments goes entirely to the issuer. A USDC holder earns nothing while bearing the counterparty, regulatory, and blacklist risk of the issuer. This is not a design flaw; it is the issuers' business model. It is also a solvable problem, and the existence of $220 billion in non-yield-bearing stablecoins is the market opportunity Kerne is built for.

2.2 Liquid staking tokens are underutilized

Ethereum's proof-of-stake transition created liquid staking tokens (LSTs) such as Lido's stETH: liquid assets that earn roughly 3 to 4.5% APR in staking rewards. Total LST value exceeds $60 billion, yet most of that capital earns nothing beyond its baseline staking yield. An LST can serve as productive collateral: the staking yield continues to accrue while the same capital backs a market-neutral position that earns additional return.

2.3 Delta-neutral carry is locked behind institutional doors

Holding a spot asset while shorting an equal notional of its perpetual future earns the funding rate that leveraged long traders pay, without directional price exposure. Quantitative funds have run this carry trade for years. Ethena's USDe demonstrated in 2024 that there is multi-billion-dollar demand for this strategy in a DeFi wrapper. Kerne brings the same class of strategy on-chain on Base, with self-custody of the dollar asset, a transparent yield derivation, and on-chain proof of backing.

3. Protocol Overview

Kerne separates the stable-dollar function from the yield function using three tokens:

The user flow is three steps:

1. Mint. Swap USDC for kUSD 1:1 through the on-chain Peg Stability Module (mint fee tiered by size, 10 bps base falling to 5 bps). The reverse path, kUSD back to USDC, is available through the same module subject to its published capacity.
2. Stake. Deposit kUSD into the skUSD vault. skUSD is a standard ERC-4626 share token: no rebasing, no lock-up on the stable token itself, fully composable with DeFi infrastructure.
3. Earn. The protocol's collateral and hedging engine (Section 4) generates yield, which accrues to skUSD as an improving share price.

A separate collateral vault, KerneVault (ERC-4626), holds the protocol's productive collateral (WETH and liquid staking tokens) and issues vault shares. This is the asset side of the balance sheet that the hedging engine manages; everyday users interact with the PSM and skUSD.

4. Architecture

4.1 Smart contract stack

All contracts are Solidity 0.8.x built on OpenZeppelin v5, deployed on Base (chain 8453), with verified source code on BaseScan.

The always-current contract list, including verification status for every deployed contract, is maintained at kerne.fi/transparency. If this table and that page ever diverge, the transparency page is canonical.

Roles and custody. Administrative authority over the core contracts is held by the 2-of-3 governance Safe; the redeployed skUSD staking vault granted the Safe co-admin and the bot strategist on 2026-07-08, and the deployer Trezor renounced both roles on 2026-08-02, leaving the Safe its sole admin today. The hedging engine operates through a separate, limited strategist key that can rebalance positions but cannot upgrade contracts or withdraw user collateral to arbitrary addresses. kUSD is mintable only against the PSM and vault paths defined in code.

4.2 The Peg Stability Module

The PSM holds USDC reserves and performs 1:1 conversions in both directions: deposit USDC to mint kUSD (fee tiered by size, 10 bps base falling to 5 bps), or redeem kUSD for USDC. This gives kUSD a structural arbitrage floor: if kUSD trades below $1.00 on a DEX, anyone can buy it and redeem through the PSM at $1.00, closing the gap. Mint capacity is capped per stable asset so PSM exposure scales deliberately rather than without bound.

4.3 The hedging engine

The yield side of the protocol is run by an autonomous hedging engine that maintains the delta-neutral position continuously:

• Collateral leg. The vault holds WETH and liquid-staked ETH, which accrues Ethereum staking rewards.
• Hedge leg. The engine maintains short ETH perpetual positions on Hyperliquid, sized to offset the collateral's ETH exposure. Hyperliquid is the production venue because it is an on-chain venue with transparent, queryable positions and no withdrawal gatekeeping, which keeps the entire backing path verifiable. Additional venue diversification is on the roadmap (Section 10) and will be adopted under the concentration limits described in Section 6.
• Delta neutrality. If ETH rises, the collateral gains what the short loses; if ETH falls, the short gains what the collateral loses. Net directional exposure is held at approximately zero, and the position earns only the two yield streams: staking rewards plus funding payments.
• Monitoring. The engine recomputes its funding regime hourly (published live at kerne.fi/funding), monitors position health continuously, and operates under the circuit breakers described in Section 6. An independent Sentinel process can pause the protocol and unwind hedges if solvency thresholds are breached.

4.4 Proof of Reserves

Kerne publishes its backing rather than asking users to trust it:

• Hourly signed Proof of Reserves at kerne.fi/api/por/signed: a signed self-attestation by the protocol's strategist key, reproducible by anyone but not an independent third-party audit, covering on-chain collateral, hedge equity, kUSD liabilities, and the resulting PSM backing ratio.
• Reserve breakdown at kerne.fi/api/por, rendered for humans at kerne.fi/transparency.
• Live risk thresholds at kerne.fi/api/risk-status: the actual constants wired into the production risk engine, with source-file attribution, rendered at kerne.fi/risk.

Because the hedge venue is on-chain, the short leg is independently observable; the protocol's solvency can be checked block by block without trusting any Kerne-operated server.

5. Yield Methodology

5.1 The two yield sources

Source 1: Ethereum staking rewards (roughly 3 to 4.5% APR). Liquid-staked ETH collateral accrues consensus-layer rewards determined by Ethereum protocol economics. This stream is reliable and independent of market sentiment.

Source 2: Perpetual funding rates (variable). Crypto perpetual markets structurally skew long, so funding has historically been positive on average: longs pay shorts. The protocol's short leg collects these payments. This stream varies with market conditions and can go negative for stretches; Section 6 describes how the protocol responds when it does.

5.2 The published formula

The user-facing APY is not a target or a promotion. It is computed every minute from public data and served at kerne.fi/api/apy:

userAPY = [L / (L + 1)] x (Lido 7-day SMA staking APR + Hyperliquid 60-day trailing funding APR)
            x (1 - 15.20% strategy costs)
            x (1 - 10% insurance allocation)
            x (1 - protocol fee)

where L = min(12, 1.5 + annualized funding x 10), the venue leverage the engine
targets at the prevailing funding rate.

In English: take the staking yield plus the trailing funding rate, multiply by the share of capital that is actually earning that carry, deduct strategy operating costs, route 10% of the remainder to the Insurance Fund, and finally deduct the protocol fee (0% during the Genesis phase).

That share is L / (L + 1), and it is always below one. The hedge is sized one for one against the on-chain spot leg, and the margin backing the short earns nothing, so of total capital C the spot leg is C x L / (L + 1) and the remainder sits as margin. Venue leverage reduces the margin that has to be posted; it does not multiply the carry earned on the underlying. Multiplying the carry by L would require levering the spot leg itself through a borrowing facility, which Kerne does not operate. This section published a flat 3x multiplier until 24 July 2026. That figure was retained beside the headline as a modeled target at scale until 28 July 2026, when it was withdrawn entirely. It is not published anywhere today, and kerne.fi/api/apy no longer serves a modeledTarget field. The paragraph below records why it was withdrawn.

The 60-day trailing funding window is chosen by measured forecast error, not by judgement. Walking 400 days of hourly Hyperliquid prints forward, computing at each point the trailing mean a publisher would have printed, and scoring it against the funding actually realised over the following 30 and 90 days, the 180-day window this section specified until 6 August 2026 was the worst of every window tested, on every asset tested, at both horizons, and carried roughly three times the bias of the best, because it straddles the February to April 2026 drawdown. The 60 and 90 day windows tie for lowest error; 60 is used because it is the lower of the two, and lower again than the 30-day window that would print highest. One caveat travels with the figure: every trailing window, this one included, has historically read high against what was subsequently realised, by 0.63 to 2.22 points. It is the least wrong estimator available rather than an unbiased one, and the gap it leaves is measured and published at kerne.fi/honesty-index. Every term in the formula is published, so when funding compresses, users can see why the rate moved before it moves. The full derivation lives at kerne.fi/docs/yield-methodology.

As of 28 July 2026 this computes to roughly 3% on the deployed basis above, against a realized on-chain distribution rate well below it. Both are published side by side at kerne.fi/api/apy and kerne.fi/honesty-index. It is a variable rate, not a guarantee. Under strong funding regimes it rises; under prolonged weak or negative funding it compresses toward the staking component alone and can turn negative.

A third figure used to sit beside those two: a modeled target at scale near 13%, the same formula evaluated at a flat 3.0x. It was withdrawn on 28 July 2026 and is no longer published anywhere. It was reachable only if the spot leg were itself levered to three times notional through a borrowing facility Kerne does not operate, the model charged no borrow cost against it, and no holder could ever have been paid it. A forward number that size, sitting beside a delivered number this size, informed nobody.

5.3 Fee structure

The KerneVault performance fee scales with that vault's own TVL and is taken only on yield generated, never on principal. At maturity the 10% fee remains half the 20% standard charged by funds running comparable strategies. The tiers are enforced in src/KerneVault.sol, and that vault is whitelist-gated with a zero share supply, so no depositor has ever paid them.

Three schedules, three different things, and the scope matters more than the numbers. This table prices the protocol contracts. Terms section 7 states the same figures as binding terms, scoped the same way. The service fees on the institutional page, including an assets-under-management fee and a performance fee on an agreed benchmark, price a separate discretionary mandate to manage a counterparty's own treasury. They are quoted and agreed in writing per engagement, no such engagement has been signed, and they are not charged by any Kerne contract. Holding kUSD or skUSD does not make you subject to them.

6. Risk Management

6.1 Insurance Fund

A fixed 10% of net yield flows continuously to an on-chain Insurance Fund dedicated to depositor protection. It deploys in two scenarios: restoring full backing after a shortfall event (exchange failure, oracle error, extreme market event), and defending the peg if kUSD trades below $0.99 and PSM capacity is exhausted. Deployment requires multisig approval; no single individual can access the fund. There is no timelock on that approval today, so a deployment executes as soon as the second of three signatures lands. Per-event claims are capped at 50% of the fund balance to prevent full depletion.

The fund provides material protection, not a guarantee. At early TVL it is small relative to deposits and grows proportionally with protocol revenue. It is not equivalent to deposit insurance.

6.2 Circuit breakers and the Sentinel

The production risk engine enforces published thresholds, all of which are live-readable with source attribution at kerne.fi/api/risk-status:

• Solvency monitoring. Collateralization is computed continuously. Breaching the wired solvency thresholds triggers a circuit breaker that pauses new minting; clearing it requires recovery above the safe threshold plus a cooldown.
• Negative funding response. If funding turns negative for a sustained period, the engine reduces hedge size in steps rather than paying carry indefinitely, letting the staking stream carry the position until funding normalizes.
• Venue concentration. Hedge exposure is bounded per venue; as additional venues are added, no single venue is permitted to dominate the hedge book.
• Emergency unwind. In a catastrophic scenario the Sentinel closes hedge positions and pauses the vault on-chain. After an orderly unwind, the vault reopens for withdrawals only, paying pro-rata claims at final NAV, with the Insurance Fund covering any shortfall before user redemptions.

The full trigger ladder and runbook are documented at kerne.fi/docs/exit-triggers-and-emergency-runbook.

6.3 No liquidation cascade by construction

kUSD holders cannot be liquidated. kUSD is not a loan against volatile collateral: there is no liquidation price, and a falling ETH price does not force collateral sales, because the hedge gains what the collateral loses. The only leveraged positions in the system are the perpetual shorts, which are conservatively margined and managed by the engine before exchange liquidation thresholds are approached.

6.4 Honest risk accounting

Delta-neutral does not mean risk-free. The material risks are: smart contract vulnerabilities, hedge venue failure, oracle failure, sustained negative funding, stablecoin depeg of PSM reserves, and operational failure of the hedging engine. Kerne's posture is to publish these risks with live numbers rather than minimize them; the risk surface at kerne.fi/risk is the canonical statement, and it is wired to the same constants the production engine runs on.

7. KERNE Token Economics

7.1 Supply and distribution

KERNE has a fixed total supply of 1,000,000,000 tokens, minted at genesis on Base, with no inflation mechanism and no minter. The token is deployed but pre-TGE: it is not publicly circulating, and no token generation event has been scheduled, announced, or dated.

These schedules are commitments about what Kerne intends to do at and after a token generation event. They are not implemented. No vesting contract has been deployed, no allocation has been segregated, and no KERNE has left the governance Safe since the token was minted: the whole life of the token is four events, all of them in its deploy transaction, and exactly one transfer has ever occurred.

esKERNE is the exception worth stating precisely, because it is partly real. The contract is deployed: an escrowed, non-transferable form of KERNE designed to vest linearly over 365 days and to carry governance and staking rights while vesting, with forfeiture of the unvested balance on exit. What does not exist is the funding. No part of the 250,000,000 ecosystem allocation has been transferred into it, so the emission described above has not begun and no schedule is running. Read the esKERNE mechanism as built and idle, not as live distribution.

The intent of the schedules is to prevent insider sell pressure during the growth phase. Whether they achieve that depends on their being implemented before any distribution occurs, which has not happened yet and which nothing on chain currently compels.

7.2 Value accrual

• Buyback and burn (designed, not operating). The intended mechanism is that a share of net protocol revenue buys KERNE on the open market and burns it, making the fixed supply deflationary as revenue grows. None of that is running: no buyback has ever executed, no KERNE has ever been burned, and there is no market on which to buy it. Supply has been flat at 1,000,000,000 since genesis and the transfer history is a single event.
• Staking revenue share (planned, Phase 2). A future vote-escrow layer (veKERNE) is specified to pay lockers a direct share of protocol revenue. It is not deployed or audited and no revenue share is live today. Buyback and burn is the intended day-one value-capture mechanism, which is a statement about sequencing rather than about anything currently live.
• Governance. KERNE governs fee parameters, collateral whitelisting, venue limits, Insurance Fund criteria, and upgrades (Section 9).

Precise revenue-split parameters are set by governance and published in the protocol documentation; they take economic effect as the performance fee phases in with TVL.

8. The Opal Rewards Program

Opal is Kerne's pre-TGE rewards program. Depositors accrue Opal Fragments hourly on active kUSD balances, with multipliers for early participation and a 10% referrer bonus on referred users' accrual. Fragments are off-chain reputation units, visible on a public leaderboard at kerne.fi/opal and in the app at app.kerne.fi/rewards.

At TGE, the 50,000,000 KERNE community allocation (5% of supply) is distributed in two tranches. Fragments divide the 5,000,000 KERNE community tranche, against a denominator that excludes Kerne's own wallets:

community = (user fragments / eligible fragments) x 5,000,000 KERNE

The remaining 45,000,000 KERNE is the scale tranche and fragments do not divide it at all. It is allocated pro-rata by qualifying dollar-hours: for each hour, the part of a wallet's kUSD-equivalent position above $100,000, with no multiplier of any kind. If no position ever qualifies, that tranche is not allocated rather than shared out.

scale = (user dollar-hours / total dollar-hours) x 45,000,000 KERNE

Eligible fragments exclude Kerne's founder wallet and protocol bot, which keep accruing and keep their leaderboard rank but convert nothing. Both rules, and the arithmetic that forced the split, are published at kerne.fi/security/kerne-token-disclosure.

Anti-gaming rules apply: fragments accrue only on active deposited balances, accrual is based on sustained holdings rather than snapshot balances, and flagged or restricted-jurisdiction deposits forfeit accrued fragments. Current rates and multipliers are published in the app rather than fixed in this document.

9. Governance

9.1 Current: multisig with full transparency

Protocol administration is held by a 2-of-3 Gnosis Safe (0x52d3E450bA6c299B1B07298F1E87DD74732D4877) whose signers are independent keyholders on hardware wallets. All critical operations require Safe approval: contract upgrades, fee changes, collateral whitelisting, Insurance Fund deployment, and emergency pause or unpause. Since 2026-08-06 the Safe cannot execute all of them instantly. Admin and manager rights on kUSD and on all three PSM modules are held by a TimelockController at 0x36A14976980B7Dd33136f6613545EB0A2C0a0D72 with a 48 hour delay, so fee changes, collateral whitelisting and unpause on the mint and redeem path are scheduled in public and land two days later. Pause is deliberately not delayed. The staking vault skUSD and both KerneVault contracts are not covered by the timelock; the Safe still administers those directly.

Multisig governance is a deliberate early-stage choice: security incidents and market events demand response times that token voting cannot deliver. The compensating control is radical transparency: every Safe transaction is publicly visible on Base, and protocol state is continuously published through the transparency and risk endpoints.

9.2 Planned: DAO transition

When KERNE reaches meaningful holder distribution after TGE, governance transitions to on-chain token voting with a proposal threshold, a quorum requirement, a timelock on execution, and an emergency veto council as protection against governance attacks during the transition period. Certain properties remain outside governance reach by construction: total KERNE supply is fixed, and users' right to withdraw within the documented timelock cannot be voted away.

10. Status and Roadmap

Live today (June 2026):

• Core contracts deployed and verified on Base mainnet; first public kUSD mint executed May 2026
• PSM mint and redeem path live (USDC to kUSD and back)
• skUSD staking live with yield distribution
• Production hedging engine live on Hyperliquid with hourly funding-regime computation
• Hourly signed Proof of Reserves, live risk-status API, public transparency dashboard
• Opal Fragments program live with public leaderboard
• Public bug bounty (kerne.fi/security) and public security findings tracker

Next:

• A second external security audit, and a review of the remediated vault build before it is deployed (the first audit, by Hexens, published July 31, 2026; see kerne.fi/security/audits for the current posture and internal review history)
• Continued TVL scaling through the phased fee schedule
• Hedge venue diversification beyond Hyperliquid under the Section 6 concentration limits
• KERNE TGE with Opal Fragment conversion, followed by DAO governance transition
• Additional collateral types and ecosystem integrations (DEX liquidity, lending-market listings, yield-tokenization integrations)

Timelines are intentionally not promised in this document. Milestone announcements are made at kerne.fi/roadmap and on the protocol's public channels when they are real.

11. Competitive Landscape

Versus fiat-backed stablecoins (USDC, USDT). Holders earn nothing and bear issuer counterparty risk, including blacklisting. kUSD holders who stake to skUSD earn the protocol's yield, hold their assets in their own wallets, and can verify backing on-chain at any time. The honest trade-off: kUSD carries smart contract and strategy risk that fiat-backed coins do not.

Versus over-collateralized stablecoins (DAI and successors). Over-collateralization is capital-inefficient: more than one dollar of collateral per dollar minted. Delta-neutral backing targets 1:1 capital efficiency, while savings-rate yields on over-collateralized designs have generally sat below delta-neutral carry.

Versus Ethena (USDe/sUSDe). Ethena validated delta-neutral synthetic dollars at scale, and Kerne shares the kUSD/skUSD split with its design. The differences are deliberate: Kerne is Base-native, hedges on an on-chain venue where positions are independently observable rather than attested by custodians, runs its entire stack in-house, and publishes its full yield derivation and signed reserves hourly. A detailed comparison is maintained at kerne.fi/kusd-vs-usde.

Versus delta-neutral protocols with custodial infrastructure (Resolv, Axis, and similar). These designs route hedges through centralized exchanges via custody and off-exchange settlement providers, trading verifiability for venue depth. Kerne's choice is the opposite: a fully on-chain backing path that anyone can audit block by block. See kerne.fi/resolv-vs-kerne.

12. Team

Kerne is built by a small founding team across protocol engineering, operations, and business development. The team has built, reviewed, and hardened every component in-house: the contracts, the hedging engine, the risk engine, and the transparency infrastructure. Consistent with the protocol's verification-first philosophy, claims about the system are published as live endpoints rather than resumes: the proof of the team's work is checkable at kerne.fi/transparency.

No company has been incorporated, and none is being formed. Kerne operates pre-incorporation by decision, reaffirmed on 14 August 2026, so there is no legal entity behind Kerne and no governing law is asserted anywhere on this site. An engagement is a services agreement with the founders personally, and it carries a novation clause that transfers it to a Kerne entity on the same terms if one is ever formed. This is set out in full in our terms and under "Who you are dealing with" on kerne.fi/institutional. If your mandate requires an incorporated counterparty in a named jurisdiction, Kerne does not meet it.

13. Legal Disclaimer

This whitepaper has been prepared by Kerne Protocol for informational purposes only. It does not constitute, and should not be construed as, an offer to sell or a solicitation to buy any securities, tokens, or financial instruments in any jurisdiction. The information herein is based on assumptions and projections that may not prove accurate. Actual results may differ materially from those projected or implied.

Not financial advice. Nothing in this document constitutes investment, financial, trading, legal, or tax advice. Conduct independent research and consult professional advisors before depositing assets.

Forward-looking statements. Statements regarding yield rates, roadmap items, and business plans are forward-looking and subject to change. Kerne undertakes no obligation to update them.

Restricted jurisdictions. kUSD and the Kerne Protocol are not available to persons in the United States, persons subject to OFAC sanctions, persons in mainland China, or any other jurisdiction where access is restricted by applicable law. By accessing kerne.fi or the protocol contracts, you represent that you are not in a restricted jurisdiction.

Risk acknowledgment. Depositing digital assets involves substantial risk, including total loss. Smart contracts may contain undiscovered vulnerabilities. Hexens completed an external audit and published its final report on July 31, 2026, which reduces that risk without eliminating it: an audit is a review at a point in time, not a guarantee, and it does not cover code deployed or changed afterwards. Oracles may fail. Hedging venues may fail. Funding rates may remain negative for extended periods. Regulation may change adversely. Read kerne.fi/risk before depositing.

No warranty. The protocol is provided "as is" without warranty of any kind, express or implied.

Kerne Protocol Whitepaper v3.0, June 2026 · kerne.fi · @KerneProtocol · Last updated 2026-07-16