Docs
Everything the contracts do, in the order they do it. No allowlist, no discretion, no function that moves the principal.
- Edition
- S1 · 2026 — preview
- Network
- Robinhood Chain
- Contracts
- Unaudited
Contents
Mechanics
- 01
Entry
Day 0A non-refundable fee of $10–25 USDG buys one seat. The split is fixed in the contract: 50% to the insurance buffer, 30% to the platform, 20% into the season prize pot.
- Fee
- $10–25
- Split
- 50 / 30 / 20
- 02
Arena
Days 1–5Everyone starts on the same $5,000 paper stack. Fills are simulated against the live pool curve, so a thin book costs you exactly what it would cost in production.
- Stack
- $5,000
- Window
- 5 days
- 03
Selection
Day 5Every account is force-liquidated before it is ranked — a season cannot be won on a position nobody can exit. The top ~12% of qualified entrants are allocated.
- Funded band
- Top 12%
- Min trades
- 5
- 04
Sub-vault
Days 6–35An isolated contract is cloned and funded with $200–$1,000 of LP capital. You trade it. You cannot withdraw from it. Breach the drawdown and the keeper flags, then revokes.
- Allocation
- $200–1,000
- Term
- 30 days
- 05
Settlement
Day 35Positions close, realised profit is split 80 / 15 / 5 between trader, liquidity providers and the platform, and your share is escrowed for claim. Losses never touch you.
- Your share
- 80%
- Downside
- None
In plain words
- Why a funded trader cannot take the money
- Trading rights are not a wallet. The capital sits in a sub-vault contract that exposes exactly three things to the address that earned it: buy, sell, and — once the term is over and every position is closed — claim, which pays out that address’s share of the profit and nothing else. There is no transfer, no approve, no arbitrary call, no upgrade path, and no function that sends the principal anywhere a caller can name. The principal has one exit: settle(), which returns it to the vault it came from.
- That is what the session-key model means here
- The scope of the permission is the contract’s function set, not a policy a server agrees to honour. So it does not matter which wallet holds the key — Robinhood Wallet, MetaMask, or the embedded key created at login — every one of them can reach the same three functions and no others, and the pools they may route through are fixed in the registry rather than passed in with the order. Losing the key loses the rights, not the capital.
- Why the profit cannot be inflated
- The result is cash, not a mark. A term settles only after every position is closed — settle() reverts while one is still open — and the figure it splits is the USDG actually in the sub-vault measured against the allocation it started with. Nothing is valued by a price feed at settlement. Positions are marked to pool prices during the term, but only to detect a drawdown breach, never for profit accounting. Ending the month holding a token at a price you pushed pays nothing: to be paid on it you have to sell it, into the same pool, at whatever it really clears.
- Who absorbs a loss, in order
- First the trader’s rights, which is the only thing they ever had at stake: a term that ends below its allocation pays them nothing at all — no share of a loss, because they never held a claim on the principal. Then the insurance buffer: when a sub-vault returns less than it was given, the vault covers the gap out of the buffer, up to the whole of it. Only what the buffer cannot cover is a loss to LP capital. The buffer is funded by half of every entry fee and has no withdrawal path of any kind — capital that enters it can only ever leave by covering a loss.
- What a Stock Token is, and is not
- An instrument that tracks the price of a share. It is not the share. Holding one carries no ownership of the company, no vote, no dividend, and no claim on anything an issuer holds — it is a token on Robinhood Chain, priced against a Chainlink feed for the underlying, trading in a Uniswap v4 pool like any other token. Everything the arena prices and every position a funded sub-vault can open is that instrument.
Everything on this site describes how a set of contracts behaves. None of it is investment, legal or tax advice, a recommendation, or an offer. The contracts are unaudited. Entry fees are non-refundable, trading carries risk of total loss, and nothing here — including any figure read live from the protocol — implies anything about future results.
Parameters
Evaluation
- Paper stack $5,000
- Season 5 days
- Min 5 trades
- Trailing drawdown from peak
- Fills on the live pool curve
- Stale quotes rejected
Main pool
- Stock Tokens
- Chainlink price feeds
- Position cap 30%
- Max drawdown 10%
- 8 open positions
- Reserve floor $250k
Degen pool
- Fresh pools.trade listings
- Position cap 15%
- Max drawdown 7%
- 5 open positions
- Reserve floor $25k
- Volume floor $10k / day
Funded phase
- Allocation $200–1,000
- Term 30 days
- Per-trade cap 20%
- Exposure cap 60%
- Drawdown 20%
- Grace period before revoke
- Forced close floored at cost, easing 12h
Economics
- Profit split 80 / 15 / 5
- Entry split 50 / 30 / 20
- LP epochs 30 days
- Insurance buffer absorbs first loss
- Prize pot by harmonic weight
- Merkle claims
Security
- Principal non-withdrawable
- Routes fixed in the registry
- Risk params behind a 2-day timelock
- Permissionless keeper rewards
- Config frozen at sub-vault init
- 93 tests · 6 invariants
Every figure resolves to the protocol’s own configuration. Risk parameters sit behind a two-day timelock and cannot change inside a live season.
Security
- Principal is non-withdrawable
- A sub-vault exposes no path that sends its principal to an address the caller chooses. It can swap along fixed routes and it can settle back to the vault. Profit reaches the trader through an escrowed claim, never through the sub-vault.
- Routes are fixed in the registry
- The set of pools a sub-vault may touch is written at the registry, not passed in with the order. An arbitrary-call surface on a contract holding LP capital is the whole exploit, and there is not one here.
- Risk params sit behind a two-day timelock
- Caps, drawdowns and floors cannot be changed inside a live season. Anyone watching the chain sees a change queued two days before it can take effect.
- Config is frozen at sub-vault init
- A clone reads its limits once, at initialisation, and keeps them for its whole thirty-day term. A later governance change cannot retroactively tighten the terms a funded trader is already operating under.
- Keeper rewards are permissionless
- Revoking a breached account pays whoever does it, once. Enforcement that depends on one team staying online is not enforcement — and a reward paid only on the step that cannot be undone is one nobody can farm.
- Ninety-three tests, six invariants
- The invariants are the interesting half: they assert the properties above hold across randomised sequences of calls, not just across the paths somebody remembered to write a test for.
Roadmap
| Phase | Scope | State | Target |
|---|---|---|---|
| Contracts | Vault, sub-vault, registry, risk timelock | Built | Q3 2026 |
| Engine | Paper fills, risk, ranking, merkle prizes | Built | Q3 2026 |
| Audit | External review + public invariant suite | Planned | Q4 2026 |
| Season 0 | Arena only, no capital at risk | Planned | Q4 2026 |
| Season 1 | Funded phase, capped vault | Planned | Q1 2027 |
Nothing on this page describes a live market. Season 01 is planned, the contracts are unaudited, and both facts are stated in the footer of every page.