The one moving part
Stede dollars are built on Token-2022, Solana's token standard with a transfer hook extension. A hook is a program the network is forced to call in the middle of every transfer of that token, before the balance actually changes.
One program runs on every transfer, and it can say no.
When you send a Stede dollar, Token-2022 pauses mid-transfer and calls the Stede hook. The hook looks up which rules you've turned on, then calls each rule program in turn and asks: should this go through? If every rule says yes, the transfer completes. If a single one returns an error, the entire transaction reverts. Nothing half-moves.
First you wrap
Plain USDC has no hook, so it can't carry rules. To give a dollar rules, you wrap it: deposit USDC into the Stede vault and get back a Stede dollar one-to-one. The vault is a program-owned account, no one holds the keys, and you can unwrap back to USDC at any time. The rules don't live on your wallet. They live on the Stede mint, attached to the dollar, which is why they travel with the money instead of depending on which app you opened.
How each rule actually decides
Six rule programs ship today. Each is a small, standalone on-chain program that the hook calls. Here's the exact thing each one checks.
1 Daily cap
Keeps a running total of what you've sent in the last 24 hours. If this send would push that rolling total past your limit, it returns no. The window slides, so yesterday's spending ages out on its own.
2 Block list
Holds a list of wallets you've blocked, up to 32. It reads the recipient of this transfer and, if they're on the list, refuses. Everyone else passes untouched.
3 Cool-off
Watches for sends at or above a threshold you set. The first large send goes through and starts a timer. Any further large send is refused until the cool-off window elapses. Small sends are never affected.
4 Slow send
The first time you pay a brand-new recipient, it records them and starts a short hold, ten minutes by default. Until that hold ages out, the first transfer is refused. After that they're a known contact and sends are instant.
5 Night mode
Compares the current hour against a window you set, say 11pm to 7am. If the send falls inside those hours, it's refused. Outside the window, nothing changes.
6 Friend gate
For sends at or above a threshold, it checks whether your trusted friend's wallet also signed the transaction. No co-signature on a large send means no. (Today it blocks the large send; routing the co-sign request is on the roadmap.)
Three rules the rules themselves obey.
The same three properties hold for every rule, every transfer. They're not settings — they're how the system is built.
Fail-open
A rule you haven't turned on doesn't exist on-chain, so the hook skips it and it passes by default. Only the rules you've opted into can ever stop you. Nothing Stede ships can lock you out of your own money.
Atomic
A refusal reverts the whole transaction. There's no partial send, no stuck state, no half-debited balance to chase. Either the money moved under your rules or it never left.
Non-custodial
Your dollars sit in a vault no person controls, and the rules sit on the mint, not on a server. Unwrap to USDC one-to-one whenever you want. Stede can't move, freeze, or claw back your funds.