Ethereum Mainnet
EXERGVE
$EXE
Every coin struck at the price you paid.
On a struck coin, the exergue is the panel beneath the design where the date is placed. Here it holds the price — permanently, and where a contract can read it.
01 / The invention
No other token knows what its holders paid.
An ERC-20 balance is a single number with no memory. Buy at 28 gwei and buy again at 790, and the chain sees one undifferentiated pile. Your cost basis lives in a spreadsheet, an exchange export, or an indexer's best guess.
Exergue is ERC-6909, and the token id is the price band you bought at. Coins struck at 28 gwei and coins struck at 790 gwei are not the same asset. They never mix, never average, and never will. A balance is inseparable from what was paid for it.
That single choice produces the thing nothing else has: a smart contract can read what you paid and act on it inside a transaction. Nansen can tell you someone's basis. It cannot make a contract settle on it.
No free supply
A coin cannot exist unless someone paid the prevailing curve price for it, deployer included. There is no mint path that isn't strike(), and no float to corner ahead of you. Supply is minted on demand, though not unlimited — it approaches 1.073 billion asymptotically.
Native tax lots
Buys never blend into an invisible average. You choose which lot to sell — specific-lot identification, on chain, for free. Crypto accounting is hard precisely because basis lives off chain.
Permanent provenance
A band records the price at which a coin was born and is never restamped on transfer. Mintage per band only ever increases, so melting makes survivors scarcer.
02 / Trade
This page is the exchange.
There is no liquidity pool, so there is no router, no aggregator, no Telegram bot and no screener that can trade this. That isn't an oversight — price-tiered token ids physically cannot be pooled, and that is the same property that lets a contract read your cost basis. The venue and the invention are the same decision.
03 / Strike a coin
See exactly what you'd be stamped with.
Runs the real curve math in your browser — the same integer arithmetic, the same rounding direction, the same band bit-packing the contract uses. Three buyers have already gone before you.
Your band is set by what you actually paid — fee and slippage included, not the quoted spot. Buy bigger and you walk the curve yourself, so you get stamped higher. That number is permanent.
Rendered from the same code the contract runs on chain. No IPFS, no server — the coin is drawn from state.
04 / Genesis
Three virtual ETH. That's the whole head start anyone gets.
The curve opens with 3 ETH of virtual reserve — a pump.fun-class start, on purpose. Price is a pure function of flow: spot = genesis × ((3 + R) / 3)² where R is real ETH in the reserve. No unlock schedule, no team allocation ahead of you, no float to dump. The ladder is arithmetic, not hope:
| ETH into the curve | Spot vs genesis | |
|---|---|---|
| 3 ETH | the first serious hour | 4x |
| 27 ETH | a good first day | 100x |
| 96 ETH | traction | 1,089x |
| 297 ETH | the tape everyone screenshots | 10,000x |
The flip side, stated plainly: steep works both ways. A big buy walks the curve up and pays its own slippage — and gets stamped for it, permanently, on the coin. On this curve, aping hard is a public act.
SPOT PRICE · LOG SCALE · SIMULATED TAPE — the curve is deterministic, so the full price history reconstructs from Struck/Melted logs alone. No DEX, no indexer, no candle feed. Price is a pure function of reserve: ((3 + R) / 3)² from genesis.
—— RESERVE (ETH that exists) - - NOTIONAL MCAP (fiction) · final tick: 9.5 ETH real vs 34.8 ETH notional. Every other site shows you only the dotted line.
05 / The mechanic
The first AMM that quotes you a different price than everyone else.
Every market maker in existence — Uniswap, Curve, Balancer, every prop AMM on Solana — quotes one price to everyone at a given block. Price is a function of pool state. Who you are is irrelevant, because no venue could know anything about you.
This one can. If you're holding coins struck above the current price, averaging down is genuinely cheaper, in proportion to how far under you are. Not a rewards program, not points — a rebate on the actual trade, funded by half of every exit fee.
Discount only. Never a penalty.
That asymmetry is load-bearing, not squeamishness. You cannot fake being underwater — it requires having actually lost money on coins you still hold. But you can trivially dodge a penalty with a fresh wallet, which makes punishing winners pure theatre. Only the unforgeable half is worth building.
Every cap is evaluated; the smallest one wins.
| Cap | What it stops |
|---|---|
| Lifetime: ETH you paid into that band | Cycling one loss repeatedly to drain the pool |
| Your real unrealised loss | A dust position farming relief on a whale-sized buy |
| 20% of the payment | Disproportionate extraction |
| The pool balance | Relief ever reaching the curve's backing |
Eligibility is judged on the pre-trade price, so your own buy can't be what rescues you. To draw X out of the pool you must first have paid X of your own money into that band and eaten fees on it — which makes farming structurally unprofitable rather than merely expensive.
An adversarial audit broke an earlier version of this. The first three caps are each per-call truths, so nothing bounded relief in aggregate — a refuting agent wrote a proof-of-concept that cycled one underwater lot 60 times and extracted +103 ETH of other users' fees against a position whose real loss was under 2 ETH. Our own anti-farming test missed it because it made exactly one claim. The lifetime cap is the fix, and it is now pinned by a stateful invariant rather than the unit test that failed to catch it.
06 / Solvency
k never decreases. That's the whole proof.
Pricing is a virtual constant product curve in exact integer math — no fixed-point exponentials, no oracle. Rounding goes on the retained side, not the output side: flooring the output hands the buyer a sub-wei crumb more than exact and lets k decay on every single trade. That was a real bug here, found by a fuzz test before it ever saw a deploy.
k monotonically non-decreasing is what guarantees a full unwind is always payable, so the contract can never owe more than it holds. It's asserted across 16,384 randomised call sequences.
| Invariant | Status |
|---|---|
| k never falls below genesis | held |
| Held ETH equals reserve + relief pool | held |
| Supply conserved across bands and holders | held |
| Mintage never below circulating | held |
| Payouts never exceed deposits | held |
| Relief drawn never exceeds ETH contributed | held |
07 / Honestly
What this is not.
- It is zero-sum. The reserve is the only money. No yield, no revenue, no external cash flow. Every pound of profit taken out is a pound someone else put in — same as every bonding curve ever built. Anyone telling you otherwise is selling something.
- Market cap is still a fiction.
supply × spotis exactly as meaningless here as anywhere. On a real test run the notional cap was 15x the ETH that actually existed. The difference is that the honest figures — reserve, and aggregate cost basis — are on chain next to it, and anyone can read both. - No DEX, no aggregator, no chart. Price-tiered ids can't go in a Uniswap pool. There is no router path and no wallet that shows a sane balance. The curve is the only venue. This is the real cost of the design, and it is not small.
- Not audited. Invariants are fuzz-tested, not formally verified. 43 tests pass. That is evidence, not proof, and it is not a substitute for an audit.
- Bots can buy, and that's deliberate. No tx.origin gate, no allowlist. But an atomic round trip is impossible: melting reverts inside the strike block and the guard propagates through transfers, so a bot must carry real risk across a block boundary.
Experimental, unaudited software that holds ETH. Nothing here is financial advice, an offer, or a promise of return. Assume you can lose everything you put in.