What the treasury holds, how it is valued, how a bond is gated, how emissions are capped, and what happens when someone leaves.
Tokenized equities. On Robinhood Chain these are tokenized debt securities issued by Robinhood Assets (Jersey) Limited, giving exposure to the named equities.
They are not shares. They confer no legal or beneficial interest in the underlying companies, the treasury carries issuer credit risk, and the 1:1 backing claim rests on a custodian the issuer does not name.
That is a material difference from holding equity, and it is stated wherever the assets are described rather than buried in a risk appendix.
Verified at bytecode level against a live token on chain 4663, these are standard OpenZeppelin ERC-20s with AccessControl, Pausable and a UUPS proxy. There is no identity registry, no allowlist and no per-address transfer gating — so an unpermissioned contract can hold them. That was the single question on which the design’s viability rested.
Two consequences follow, and neither is comfortable:
Ceilings on market value, enforced on deposit — not target weights. These caps are the only thing standing between a whitelist and a single-name treasury.
| Tier | Tier cap | Per name | Max discount |
|---|---|---|---|
| Liquidity pair | 15% | 15% | 10% |
| Broad index | — | — | 8% |
| Mega-cap | 40% | 10% | 5% |
| Other listed | 20% | 5% | 3% |
| Stablecoin | 15% | 15% | 2% |
A cap can be breached with no deposits at all, purely by prices moving. Because dividends arrive as a multiplier rather than cash, there is no cash sleeve drifting upward to cure — the affected facility simply closes until weights recover.
Robinhood’s documentation is explicit: the price feed returns the price of a single token, which is the underlying share price times the corporate-action multiplier. Applying the multiplier again double-counts every dividend and every split.
One token in the index currently sits at a multiplier of exactly 4.0 after a 4:1 split. Applying it would have valued that holding fourfold — inflating backing and authorising minting against value that does not exist.
An earlier draft of the specification got this wrong. The contract now forbids it and a test locks it in, because it is the kind of error that makes every downstream figure quietly false rather than visibly broken.
The multiplier is still read, for three things that are not valuation: share-equivalent display units, dividend attribution (separating earned growth from price movement), and corporate-action detection alongside the oracle’s paused flag.
Chainlink is the exclusive provider on this chain, and its equity feeds update 24/5, not 24/7. Valuation rejects stale prices, non-positive prices, and any asset whose oracle is paused for a corporate action. Decimals are cached when an asset is whitelisted and never read live, so a token with non-standard or mutable decimals cannot break the accounting path.
Supply is read by the policy, the redeemer, the bond depository and the interface. Any divergence between those consumers would be an arbitrage, so there is exactly one definition.
circulatingSupply = totalSupply − protocolHeld backingPerToken = backingReserves / circulatingSupply
Bonded-but-unvested supply is included. The treasury already holds the bonded asset, so the claim exists; vesting governs transferability, not existence. Excluding it would let someone bond large, spike backing per token, then redeem into the artificial peak for more than a fair share.
Protocol-held tokens are excluded. A token the protocol owns is not a claim on the protocol.
If a liquidity position containing the protocol’s own token counted fully as backing, pumping the token would make the treasury look richer and authorise more minting.
The predecessor held 73% of its treasury in its own token. Price declines cut backing, which cut price further. That loop is what killed it — and reflexivity only becomes negligible near 1%.
Liquidity positions are valued at the balanced point (2·√k), which is invariant to the token’s own price because the constant product does not change under trades. The own-token side is then excluded from the figure that may authorise a mint, while full market value is still reported for display.
Price falls with time and steps up with each purchase, so no oracle sits in the pricing path — which matters when the equity feeds only update 24/5.
debtRatio = currentDebt · 1e9 / circulatingSupply marketPrice = controlVariable · debtRatio / 1e9 payoutFor = valueIn · 1e9 / marketPrice
Every purchase must satisfy, at one consistent valuation snapshot, plus a 0.5% buffer for valuation uncertainty and costs:
Worked case. Backing $10, market price $10.50, an 8% discount. The issue price is $9.66, a $100,000 bond mints about 10,352 claims, and backing falls from $10.0000 to $9.9681. That bond is refused. At an 8% discount the gate requires a premium of about 1.09× backing.
Three independent limits apply: a per-deposit payout cap sized from the deposit interval, a whole-market capacity, and a debt ceiling that closes the market outright if debt runs past target plus buffer — protection against a quote token in rapid decline, and our quote tokens are equities that gap on open.
Payouts are staked immediately and vest as a wrapper-denominated note, so a bonder earns emissions throughout. There is no bond-versus-stake tradeoff and no per-note reward bookkeeping.
A continuous function of premium over backing, in an immutable contract with no setters and no owner.
| Premium over backing | Rate per epoch |
|---|---|
| Below 1.00× | 0% — printer off |
| 1.00× | 0.01% |
| 1.30× | 0.04% |
| 2.00× | 0.10% |
| 3.00× | 0.20% |
| 5.00× and above | 0.35% |
Interpolated between those anchors. A stepped curve was gameable at every boundary: at 1.30× the rate jumped four-fold — an 11.6% to 55.1% annual swing from an infinitesimal move in premium, with roughly 1,095 windows a year at each of five boundaries, and two handles to push (price or backing). Interpolation keeps the published table intact while making manipulation pay only in proportion to the distance moved.
The predecessor’s rewards were a fixed fraction of supply while backing came only from bonds, so when bond demand slowed, supply inflated against a static treasury. Here the mint gate binds at 1.01× backing — above parity deliberately, so it bites before dilution rather than after — and a rebase that excess reserves cannot fund simply shrinks.
Backing is never spent to pay a rebase. A treasury seeded at exactly parity therefore emits nothing: no staking rewards and no keeper bounty until backing grows through fees or appreciation. That is a launch decision, not a defect.
Epochs are eight hours, three per day, and the rebase is permissionless with a bounty — no privileged keeper, so a missed cron cannot stall the protocol. The bounty is paid from inside the same cap; adding it on top meant a treasury at zero excess reverted the whole rebase, so advancing the epoch reverted and nobody could advance it at all.
Premium is read as a time-weighted average, because a spot read at 3am on a Sunday against a 24/5 feed is meaningless.
Burn tokens, receive a pro-rata slice of the treasury in kind, minus retention. Payout is computed on raw quantities, not valuations, so a stale or paused price feed cannot block an exit. A floor nobody can test is not a floor.
Retention is dynamic: 0.25% at or below parity, rising to 3% above 1.30×. A flat rate leaves a permanent arbitrage-free band; near-zero below parity keeps arbitrage sharp exactly when the floor needs defending, while exits at a premium pay for the privilege. Retained value stays in the treasury and raises backing for everyone who stayed, so exits are accretive.
Redemption pays (1 − retention) of backing, so the no-arbitrage floor sits below backing, not at it. Adding gas, slippage and the cost of liquidating a basket of thin equity tokens, the arbitrage-free band is roughly 4–8% below backing. The token can trade inside it. A premium below 1.00 is a normal operating state, not a fault.
In-kind redemption protects the treasury and widens that band, because it pushes liquidation cost onto the arbitrageur. That tradeoff is real and it is not hidden.
If a component’s transfers are paused, the exit skips that asset, over-delivers the remainder pro-rata, and emits an event the interface surfaces prominently. Reverting would make the floor unavailable whenever any single component was frozen; skipping concentrates the treasury into the unredeemable asset, which degrades quality for stayers. Neither outcome is good, so it is recorded loudly rather than handled silently.
There is no pause on redemption. A decision with a stated consequence: a mispriced or compromised oracle cannot be stopped from draining the treasury through redemption. The compensating controls are the oracle guards in the treasury and off-chain monitoring.
| Contract | Responsibility |
|---|---|
STOA.sol | ERC-20, 9 decimals. Mint and burn restricted to the treasury; no owner, no pause, no upgrade path |
sSTOA.sol | Rebasing staked token. Gons pattern; index written once at genesis and never again |
gSTOA.sol | Non-rebasing wrapper, 18 decimals. Reads the index live, never from an oracle |
Staking.sol | Epochs, permissionless bounty-paid rebase, warmup held in gons, premium TWAP |
Treasury.sol | Custody, valuation, sole mint authority, canonical supply, tier caps |
BondDepository.sol | Dutch auction, three capacity limits, the accretion gate, vesting notes |
Redeemer.sol | Pro-rata in-kind burn, dynamic retention, degraded-redemption path |
PolicyController.sol | Premium to emission rate. Immutable: no setters, no owner |
FeeRouter.sol | Routes external fee inflows into backing. Permissionless, mints nothing |
Licensed AGPL-3.0-only, matching Olympus’s own contracts, from which the gons pattern, the excess-reserves mint gate and the Dutch-auction bond mechanism are adapted.