STOAPROTOCOL OVERVIEW
THE MECHANISM REFERENCE

OHM’s treasury model,
with tokenized equities.

What the treasury holds, how it is valued, how a bond is gated, how emissions are capped, and what happens when someone leaves.

Status
Written and tested. Unaudited. Undeployed.
Tests
118 across five suites, ~100,000 fuzz runs
Chain
Robinhood Chain, ID 4663
Licence
AGPL-3.0-only
/ 001THE ASSETS

What the treasury holds.

Tokenized equities. On Robinhood Chain these are tokenized debt securities issued by Robinhood Assets (Jersey) Limited, giving exposure to the named equities.

They are not shares. They confer no legal or beneficial interest in the underlying companies, the treasury carries issuer credit risk, and the 1:1 backing claim rests on a custodian the issuer does not name.

That is a material difference from holding equity, and it is stated wherever the assets are described rather than buried in a risk appendix.

Verified at bytecode level against a live token on chain 4663, these are standard OpenZeppelin ERC-20s with AccessControl, Pausable and a UUPS proxy. There is no identity registry, no allowlist and no per-address transfer gating — so an unpermissioned contract can hold them. That was the single question on which the design’s viability rested.

Two consequences follow, and neither is comfortable:

  • The implementation sits behind a proxy, so transfer restrictions could be added later. This is the largest protocol risk and it is outside our control.
  • A global pause freezes the treasury’s own transfers, which is why redemption has a degraded path rather than reverting.

Eligibility caps

Ceilings on market value, enforced on deposit — not target weights. These caps are the only thing standing between a whitelist and a single-name treasury.

TierTier capPer nameMax discount
Liquidity pair15%15%10%
Broad index8%
Mega-cap40%10%5%
Other listed20%5%3%
Stablecoin15%15%2%

A cap can be breached with no deposits at all, purely by prices moving. Because dividends arrive as a multiplier rather than cash, there is no cash sleeve drifting upward to cure — the affected facility simply closes until weights recover.

/ 002VALUATION

The multiplier is not applied.

Robinhood’s documentation is explicit: the price feed returns the price of a single token, which is the underlying share price times the corporate-action multiplier. Applying the multiplier again double-counts every dividend and every split.

One token in the index currently sits at a multiplier of exactly 4.0 after a 4:1 split. Applying it would have valued that holding fourfold — inflating backing and authorising minting against value that does not exist.

An earlier draft of the specification got this wrong. The contract now forbids it and a test locks it in, because it is the kind of error that makes every downstream figure quietly false rather than visibly broken.

The multiplier is still read, for three things that are not valuation: share-equivalent display units, dividend attribution (separating earned growth from price movement), and corporate-action detection alongside the oracle’s paused flag.

Oracle guards

Chainlink is the exclusive provider on this chain, and its equity feeds update 24/5, not 24/7. Valuation rejects stale prices, non-positive prices, and any asset whose oracle is paused for a corporate action. Decimals are cached when an asset is whitelisted and never read live, so a token with non-standard or mutable decimals cannot break the accounting path.

/ 003SUPPLY & BACKING

One canonical figure.

Supply is read by the policy, the redeemer, the bond depository and the interface. Any divergence between those consumers would be an arbitrage, so there is exactly one definition.

circulatingSupply = totalSupply − protocolHeld
backingPerToken   = backingReserves / circulatingSupply

Bonded-but-unvested supply is included. The treasury already holds the bonded asset, so the claim exists; vesting governs transferability, not existence. Excluding it would let someone bond large, spike backing per token, then redeem into the artificial peak for more than a fair share.

Protocol-held tokens are excluded. A token the protocol owns is not a claim on the protocol.

Protocol-owned liquidity

If a liquidity position containing the protocol’s own token counted fully as backing, pumping the token would make the treasury look richer and authorise more minting.

The predecessor held 73% of its treasury in its own token. Price declines cut backing, which cut price further. That loop is what killed it — and reflexivity only becomes negligible near 1%.

Liquidity positions are valued at the balanced point (2·√k), which is invariant to the token’s own price because the constant product does not change under trades. The own-token side is then excluded from the figure that may authorise a mint, while full market value is still reported for display.

/ 004BONDING

A sequential Dutch auction.

Price falls with time and steps up with each purchase, so no oracle sits in the pricing path — which matters when the equity feeds only update 24/5.

debtRatio   = currentDebt · 1e9 / circulatingSupply
marketPrice = controlVariable · debtRatio / 1e9
payoutFor   = valueIn · 1e9 / marketPrice

The accretion gate

Every purchase must satisfy, at one consistent valuation snapshot, plus a 0.5% buffer for valuation uncertainty and costs:

V ≥ M × BVALUE IN ≥ TOKENS MINTED × BACKING PER TOKEN

Worked case. Backing $10, market price $10.50, an 8% discount. The issue price is $9.66, a $100,000 bond mints about 10,352 claims, and backing falls from $10.0000 to $9.9681. That bond is refused. At an 8% discount the gate requires a premium of about 1.09× backing.

Three independent limits apply: a per-deposit payout cap sized from the deposit interval, a whole-market capacity, and a debt ceiling that closes the market outright if debt runs past target plus buffer — protection against a quote token in rapid decline, and our quote tokens are equities that gap on open.

Payouts are staked immediately and vest as a wrapper-denominated note, so a bonder earns emissions throughout. There is no bond-versus-stake tradeoff and no per-note reward bookkeeping.

/ 005EMISSIONS

Capped by an invariant.

A continuous function of premium over backing, in an immutable contract with no setters and no owner.

Premium over backingRate per epoch
Below 1.00×0% — printer off
1.00×0.01%
1.30×0.04%
2.00×0.10%
3.00×0.20%
5.00× and above0.35%

Interpolated between those anchors. A stepped curve was gameable at every boundary: at 1.30× the rate jumped four-fold — an 11.6% to 55.1% annual swing from an infinitesimal move in premium, with roughly 1,095 windows a year at each of five boundaries, and two handles to push (price or backing). Interpolation keeps the published table intact while making manipulation pay only in proportion to the distance moved.

The predecessor’s rewards were a fixed fraction of supply while backing came only from bonds, so when bond demand slowed, supply inflated against a static treasury. Here the mint gate binds at 1.01× backing — above parity deliberately, so it bites before dilution rather than after — and a rebase that excess reserves cannot fund simply shrinks.

Backing is never spent to pay a rebase. A treasury seeded at exactly parity therefore emits nothing: no staking rewards and no keeper bounty until backing grows through fees or appreciation. That is a launch decision, not a defect.

Epochs are eight hours, three per day, and the rebase is permissionless with a bounty — no privileged keeper, so a missed cron cannot stall the protocol. The bounty is paid from inside the same cap; adding it on top meant a treasury at zero excess reverted the whole rebase, so advancing the epoch reverted and nobody could advance it at all.

Premium is read as a time-weighted average, because a spot read at 3am on a Sunday against a 24/5 feed is meaningless.

/ 006REDEMPTION

The floor, stated honestly.

Burn tokens, receive a pro-rata slice of the treasury in kind, minus retention. Payout is computed on raw quantities, not valuations, so a stale or paused price feed cannot block an exit. A floor nobody can test is not a floor.

Retention is dynamic: 0.25% at or below parity, rising to 3% above 1.30×. A flat rate leaves a permanent arbitrage-free band; near-zero below parity keeps arbitrage sharp exactly when the floor needs defending, while exits at a premium pay for the privilege. Retained value stays in the treasury and raises backing for everyone who stayed, so exits are accretive.

Redemption pays (1 − retention) of backing, so the no-arbitrage floor sits below backing, not at it. Adding gas, slippage and the cost of liquidating a basket of thin equity tokens, the arbitrage-free band is roughly 4–8% below backing. The token can trade inside it. A premium below 1.00 is a normal operating state, not a fault.

In-kind redemption protects the treasury and widens that band, because it pushes liquidation cost onto the arbitrageur. That tradeoff is real and it is not hidden.

Degraded redemption

If a component’s transfers are paused, the exit skips that asset, over-delivers the remainder pro-rata, and emits an event the interface surfaces prominently. Reverting would make the floor unavailable whenever any single component was frozen; skipping concentrates the treasury into the unredeemable asset, which degrades quality for stayers. Neither outcome is good, so it is recorded loudly rather than handled silently.

There is no pause on redemption. A decision with a stated consequence: a mispriced or compromised oracle cannot be stopped from draining the treasury through redemption. The compensating controls are the oracle guards in the treasury and off-chain monitoring.

/ 007THE CONTRACTS

Nine contracts, three libraries.

ContractResponsibility
STOA.solERC-20, 9 decimals. Mint and burn restricted to the treasury; no owner, no pause, no upgrade path
sSTOA.solRebasing staked token. Gons pattern; index written once at genesis and never again
gSTOA.solNon-rebasing wrapper, 18 decimals. Reads the index live, never from an oracle
Staking.solEpochs, permissionless bounty-paid rebase, warmup held in gons, premium TWAP
Treasury.solCustody, valuation, sole mint authority, canonical supply, tier caps
BondDepository.solDutch auction, three capacity limits, the accretion gate, vesting notes
Redeemer.solPro-rata in-kind burn, dynamic retention, degraded-redemption path
PolicyController.solPremium to emission rate. Immutable: no setters, no owner
FeeRouter.solRoutes external fee inflows into backing. Permissionless, mints nothing

Licensed AGPL-3.0-only, matching Olympus’s own contracts, from which the gons pattern, the excess-reserves mint gate and the Dutch-auction bond mechanism are adapted.

/ 008STILL OPEN

What is not settled.

  • Unaudited, and the code audit is not the expensive risk. The predecessor died of mechanism design, not assertion failures. A separate economic review matters more here, and formal verification proves only what the specification asserts.
  • Liquidity is unproven. A 4,000-block scan for transfer events on a live tokenized equity returned zero. The redemption arbitrage band assumes an arbitrageur can liquidate the basket; if depth is thin, the band is wider and the floor softer.
  • Legal. Permissionless redemption at net asset value is plausibly what converts this into a collective investment scheme — the feature that makes the floor credible is the feature that creates the liability. US, UK, Canadian and Swiss persons are excluded by the issuer’s own terms.
  • Bytecode caveat. The finding that tokenized equities carry no transfer restrictions rests on decompiled bytecode, not verified source. A testnet transfer-to-contract closes it cheaply.
  • Proxy upgradeability. The implementations sit behind proxies, so transfer restrictions could be added later. Outside our control.