We present TenderWallet, a CBDC system that offers a balance of inclusive privacy-preserving access and complete regulatory compliance. Our proposed system provides a CBDC functionality that is responsive to user behaviour, and in case of non-compliance by the user while availing the CBDC service, compensates the indirect monetary loss induced to the nation state, through collateralization. The TenderWallet system is also hybrid, such that it dynamically works as one variant of two well established offline CBDC models, thereby reducing the computational overhead of the service. We detail the behaviour of the TenderWallet system, analyze its deployment characteristics, and argue that it is superior to other potential hybrid CBDC designs. We conclude by showing that TenderWallet is near optimal, while considering compensation to the state and low-compute privacy and transparency of users as the main requirements of a CBDC system.

Several nations across the world are contemplating optimal design choices for Central Bank Digital Currencies (CBDCs). We present LimboCoin, an analytical framework for an arbitrary token based CBDC protocol. LimboCoin, under practical state-of-the-art assumptions on secure system design and protocol incentivization, considers an adversarial behaviour to achieve denial-of-service on the CBDC’s associated system and token economy. LimboCoin outlines the quality of the CBDC system and economy resultant from the interaction of honest and adversarial users in the CBDC’s jurisdiction. Through LimboCoin, we show that in the worst case, the number of compromised CBDC wallets in operation can exceed the number of legitimate wallets in operation, within the CBDC’s jurisdiction. We also show that in the worst case, the value associated with victim token transactions that are denied service exceeds 90 percent of the value associated with token transactions that are in legitimate service.