1. Introduction
Idle stablecoins are a solved problem in theory and an unsolved one in practice. Depositors want yield without becoming full-time risk managers, and the market punishes the naive strategy: chasing the highest advertised rate concentrates capital into the venue most under stress, which is often paying up precisely because liquidity is fleeing it. When it breaks, the chaser is fully exposed.
Aumo is an agent that manages a shared vault of stablecoins on X Layer and allocates the pooled balance across allowlisted venues to the best risk-adjusted yield, inside limits written into a contract. This paper documents its reasoning architecture and states the safety property that makes an autonomous money-moving agent defensible. Our contributions are: (i) a bounded, explainable risk model with a temporal component learned from the agent's own history; (ii) a scenario-simulation stage that refuses allocations a plausible shock would trap; (iii) a self-reflection loop that recalibrates trust in its signals under a monotonic safety bound; (iv) an adversarial critic as a final gate; and (v) a formal tighten-only guarantee that survives an unreliable or adversarial model.
2. Background: the reasoning taxonomy
Recent surveys organize agentic reasoning into three layers: foundational (planning, tool use, search), self-evolving (memory, reflection, iterative refinement), and collective (multi-agent roles), and distinguish in-context orchestration from post-training (RL/SFT). We use this frame to situate Aumo and to justify a deliberate choice: Aumo is entirely in-context. Its safety is a property of code, not of learned weights.
3. System overview
Each cycle runs five stages, sense, score, simulate, reason, act, and closes with a proof. The planner is deterministic and constructs only moves that already satisfy every on-chain cap, so the contract never rejects a well-formed plan. Formally, let P₀ be the deterministic plan and T any transform applied by a later stage (LLM, stress, critic). Every T in Aumo satisfies
that is, later stages may only raise caution or remove deployments. We call this the tighten-only property. It is what lets an unreliable model participate safely: the worst a bad answer can do is make the vault more conservative or be discarded.
4. The risk model
For each venue v the engine computes five bounded sub-scores in [0,1]: protocol risk (curated base), liquidity risk (venue depth blended with our own exit capacity), peg risk (deviation from par, with a conservative floor for unmonitored real-world-asset venues), utilization risk (lending only), and a correlation-aware concentration risk. They combine as a fixed weighted blend:
Concentration is correlation-aware: exposure to a venue plus everything correlated with it, using a same-kind correlation of 0.75 and a cross-kind correlation of 0.20, so diversifying across uncorrelated kinds genuinely lowers risk while splitting across correlated ones does not. The score maps to a band, low < 0.25 ≤ moderate < 0.50 ≤ elevated < 0.75 ≤ high, and the headline APY is haircut into the quantity the allocator actually ranks on:
5. Temporal awareness
Levels are blind to trajectory. A venue at 70% utilization that has been flat is not the same as one that climbed from 45% in three cycles. Aumo replays its own recorded history and, for each venue, compares the current sample to a rolling window mean, forming an adverse-only momentum score:
where each term is the positive part of the relevant change, normalized by the move that saturates it (a 20-point utilization rise, a 100 bps peg widening, a 30-point drop in the liquidity-to-TVL ratio, a 5% APY spike). Favourable trends contribute nothing, so momentum can only raise risk, and it enters the blend as the additive penalty above with weight 0.15.
6. Scenario simulation
Before committing, Aumo projects the portfolio the plan would create and applies a set of plausible shocks: a 50% collapse in exit liquidity, a 150 bps peg shock to real-world-asset venues, and a lending utilization spike to 95%. A venue is fragile if a shock pushes a held position into the top risk band or makes it exceed all withdrawable liquidity (an un-exitable trap). Fragile venues are denied new deploys, and the fraction of scenarios that breach drives a regime ceiling:
7. Reflection and self-calibration
Aumo grades its own past trend calls. Replaying the history, when momentum flagged a venue, did that venue actually keep deteriorating the next cycle? Let hitRate be the fraction of flags followed by continued deterioration. The agent then scales how much momentum bites:
Because κ ≥ 1 always, reflection is tighten-only by construction: a predictive track record makes the agent more cautious, a poor one leaves it unchanged, and it can never use hindsight to loosen. The reflection is written into the receipt as experience replay.
8. The adversarial critic
After the planner and the model, a distinct critic asks not "is this venue acceptable?" but "how could this specific plan lose money?" It refuses to add to a venue whose momentum exceeds 0.5, refuses a position that would exceed 25% of a venue's exit liquidity, and escalates a doubt that holds the entire cycle if the plan would leave the pool under a 5% idle buffer. It can only remove allocations or hold; de-risking is never blocked. This is the seed of the collective layer: a planner and a skeptic as separate roles.
9. Collective risk steering
Depositors declare an appetite tier on-chain (conservative, moderate, bold). Because a single pooled vault has one allocation, individual per-user risk is impossible; instead the agent share-weights everyone's tier and clamps the result to the owner's hard ceiling:
So depositors can collectively steer the pool safer, or up to but never past, the on-chain hard bound. The preference is a pure signal: it never moves funds or relaxes a cap.
10. Evaluation
We replay a synthetic market of 30 cycles through Aumo's real deterministic engine and, side by side, a naive highest-APY strategy on the identical market. A hot venue looks attractive early (12% APY), then deteriorates over cycles (utilization climbs to 97%, exit liquidity thins, base risk rises) and breaks at cycle 20, haircutting anyone still inside by 35%. The harness is deterministic on purpose: the model only tightens, so proving the core is the honest floor.
| Strategy | Final value | Max drawdown | Exposure at break |
|---|---|---|---|
| Aumo (levels + momentum + stress) | $10,384 | 0.0% | $0 |
| Naive (chase highest APY) | $8,175 | 21.4% | $6,334 |
Aumo captures the early yield, then temporal awareness and rising base risk push the venue past appetite and it exits before the break, ending about 27% ahead with roughly 21 points less drawdown and zero exposure at the break. The naive strategy chases the rate into the wall. The harness is reproducible with a single command.
11. From stablecoins to tokenized real-world assets
The architecture above was built for a capital-preservation mandate: dollar-pegged assets, ranked on risk-adjusted yield, where the agent's job is to avoid the venue that breaks. Tokenized real-world assets that carry price risk are a different mandate, and Aumo treats them as one. Alongside the safe stablecoin pool, Aumo now runs opt-in pools for tokenized US equities (NVIDIA, Apple, Microsoft, Meta), a diversified basket of the four, and tokenized gold. Each is an isolated ERC-4626 pool that takes USDT0 and routes it to the wrapped asset through Uniswap v3, priced by an on-chain equity oracle Aumo operates and discloses. These pools deliberately hold directional exposure the depositor chose. They are not capital preservation, and the reasoning that protects the stablecoin pool from loss does not apply: the depositor owns the price risk on purpose. What carries over is the trust model. Entry and exit are gated on US market hours enforced by the contract, so no one transacts at a stale price; every swap carries an oracle-derived minimum out, so a manipulated pool cannot fill far from fair value; and the agent can move funds only into the pool's allowlisted venue, never to an outside address.
12. An honest backtest: trend-timing, tested and removed
The obvious way to make a single-stock pool feel safer is to let the agent step aside when the stock breaks trend. We built exactly that: an overlay that de-risks a single name to cash when it crosses below its own trend and re-enters when it recovers. We backtested it over five years, including the 2022 bear market, against simply holding the stock. On single names it whipsawed. It sold into transient dips, bought back higher, gave up return, and did not reliably reduce maximum drawdown. The cost of being wrong on the re-entry outweighed the benefit of the occasional avoided decline. We removed it. The single-stock pools buy and hold the exposure the depositor chose, and there is no market-timing rule in them. We report this because a removed feature is evidence. It is the result of testing a plausible idea and finding it did not hold, and stating that is more useful than shipping a timing rule that looks protective and is not.
13. Diversification as the one reliable lever
The one thing that did reduce drawdown in the same backtest was diversification. Over the five-year window, an equal-weight basket of the four names cut maximum drawdown from about 43% on a single name to about 32%. That is not a promise about the future, and not a hedge against a broad market decline, which moves all four together. It is the mechanical benefit of not being concentrated in one name's idiosyncratic move. The basket pool is built around this single finding. One EquityPool holds all four stocks equal-weight through four adapters, and the agent's only job is to keep the weights equal by rebalancing on drift within a band. It does not time the market and does not pick which stock to favour. The reasoning is deliberately minimal, because the backtest said the timing was the part that did not work and the diversification was the part that did (figures approximate, backtest not a guarantee).
14. Security: an internal self-audit and a hardened redeploy
Before opening the equity pools to deposits, a multi-agent internal security pass reviewed them and proved two Medium-severity issues with fork proof-of-concepts. The first was exit-slippage socialization: a departing holder's swap cost was borne by the holders who stayed. The second was a NAV-latency skim: the window between an oracle update and a trade left room to enter or exit against a slightly stale mark. We fixed both with a single mechanism and a tighter oracle staleness window. The mechanism is an anti-dilution levy retained by the pool, 25 basis points on entry and 50 on exit, so a joiner or leaver bears the value their own action moves rather than passing it to the holders who remain. The levy is retained in the pool, capped in the contract so the owner can never turn it into a fee, and never touches custody. We then redeployed the hardened pools to X Layer mainnet before accepting deposits. This is the same discipline the stablecoin pool is held to: prove the failure, fix it in code, and re-verify before scaling.
15. Design rationale: in-context, on purpose
Aumo could be post-trained on historical allocations. We deliberately do not. For an agent that moves real money, deterministic, auditable guardrails beat opaque learned weights: the tighten-only property (Section 3) is a theorem about the code, not a hope about a policy, and every constraint is re-checked by the contract after the model answers. Because the guarantee lives in the code and not in any one model, the reasoning layer, the specialist panel, and the Ask Aumo endpoint are provider-pluggable: they run on Groq (OpenAI-compatible) or Anthropic, chosen by configuration, under the identical tighten-only bound, so swapping the model can only change how a plan is tightened, never whether it can be loosened. A regulator, a depositor, or an auditor can read exactly why any move was made. That legibility is the product, not an afterthought.
16. Limitations
- Pooled allocation. A single vault has one allocation, so risk steering is collective and share-weighted, not per-depositor. Dissenting depositors can exit but cannot hold a different allocation within the same pool.
- Synthetic evaluation. The backtest uses a constructed market to isolate the deteriorate-then-break failure mode. It demonstrates the mechanism; it is not a claim about realized returns on any live venue.
- Single agent. The critic is one adversarial role. Richer collective reasoning (a peg watcher, a liquidity analyst, a macro-regime agent) is future work.
- Self-hosted price oracle. The equity and gold pools price from an oracle Aumo operates: an off-chain feeder posts prices through a single trusted key, disclosed to depositors. This is a weaker guarantee than a decentralized network feed and is a deliberate, migratable first version. The consumer contracts read through an oracle-agnostic interface, so moving to a verified network feed later is a single owner call with no depositor action.
- Issuer risk on tokenized assets. USDG, the wrapped xStocks, and PAXGy are issued by third parties (Paxos and the xStock issuers) that retain freeze and pause powers. Aumo already accepts this class of risk in the stablecoin pool; the real-world-asset pools do not remove it.
- Audit status. The contracts are hardened and internally reviewed, and the equity pools passed a multi-agent internal security pass with two Medium issues proven and fixed, but none has completed a formal third-party audit. Conservative caps apply.
17. Conclusion
An autonomous treasury agent does not have to choose between yield and trust. By ranking on risk-adjusted yield, reading trajectory rather than level, simulating shocks before it commits, grading its own predictions under a monotonic safety bound, and gating everything behind an adversarial critic and an on-chain contract, Aumo puts stablecoins to work while keeping every move provable. The reasoning is sophisticated; the safety is simple, because it lives in code. The same posture now governs the opt-in real-world-asset pools: the depositor owns the price risk on purpose, and the code owns everything else.
Framework after the survey Agentic Reasoning for Large Language Models (2026). Implementation references: the risk engine, momentum, stress, reflection, and critic modules in the Aumo agent, the ERC-4626 pool contract, and the EquityPool, EquityAdapter, and self-hosted equity oracle behind the real-world-asset pools. Companion to the Aumo whitepaper and docs. Written by Duke (@dukedotsol).