LUSDToken: ERC-20 + Permit + Minting Allowlist

Key takeaway: LUSD is a standard ERC-20 with EIP-2612 permit and one critical addition — a three-address allowlist that gates mint, burn, sendToPool, and returnFromPool. Only BorrowerOperations can mint (when a Trove is opened), only BorrowerOperations or TroveManager can burn (on repayment or liquidation), and only the StabilityPool can pull LUSD into itself from a depositor. These three addresses are set once in the constructor and never change. There is no admin, no pauser, no minter role. The token's monetary policy is the protocol's monetary policy — anything that mints LUSD must be a contract whose code you can audit.

What You Are Building

The LUSD token is the stablecoin. Every protocol action that creates LUSD (opening a Trove, accruing a borrowing fee) calls mint. Every action that destroys LUSD (repaying debt, liquidation absorbing debt) calls burn. The total supply of LUSD is always exactly equal to the total LUSD debt of all open Troves plus the gas-compensation LUSD held in the GasPool.

The token sits at the trust boundary. If anyone outside the allowlist could mint LUSD, the peg would break instantly. If anyone outside the allowlist could burn another user's LUSD, the protocol's accounting would desync. The token's job is to be boring, audited, and impossible to corrupt.