Transparency
TransparencyLive on chain 4663Backing, contracts, governance and the security review. Read from the chain and the contracts repo.
01Proof of backing
Live from the vault: the USDG that would pay every trader at max profit right now.
vault.maxTotalOi() is 0 (uncapped)
Check it yourself
cast call 0x615E3623002B6D58A1375B3061b610409635F16B \ "backing()(uint256,uint256,uint256,bool)" \ --rpc-url https://rpc.mainnet.chain.robinhood.comPerpVault 0x615E…F16B on Blockscout ↗
02Contracts
Every link goes to Blockscout.
| Contract | Role | Address | Status |
|---|---|---|---|
| PerpVault | Escrow, positions, caps, fees. Holds every open position's collateral and reserve. | 0x615E3623002B6D58A1375B3061b610409635F16B0x615E…F16B ↗ | Deployed |
| PositionRouter | Two-step requests, keeper execution, refunds, emergency exits. | 0x784124025015Bc184583d8fe3D65FF3A02F5EE0b0x7841…EE0b ↗ | Deployed |
| OracleRouter | Chainlink and TWAP pricing, market hours, staleness, signers. | 0x6aF24D8a0a0c59f5f9dCf9E371bd7BbF02d897df0x6aF2…97df ↗ | Deployed |
| Timelock | Owner of vault, router and oracle. 48h delay on every change. | at launch | at launch |
| Guardian | Restrict-only key: close-only and keeper removal. | 0x71494E0bFFB66E34d71c7A68Beb397dfEE41950B0x7149…950B ↗ | Deployed |
| Treasury | Counterparty wallet. Approves the budget the vault can draw. | 0xe3eF4C6D3eeC866A2fb097f7dfaB673A4B9847500xe3eF…4750 ↗ | Deployed |
| USDG | Collateral and settlement token. | 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d1680x5fc5…d168 ↗ | External |
| Uniswap v4 PoolManager | Pool state read for coin prices and liquidity. | 0x8366a39CC670B4001A1121B8F6A443A643e409510x8366…0951 ↗ | External |
Chainlink feeds
verified 2026-09-14| Feed | description() | Proxy address | Heartbeat / deviation | Check |
|---|---|---|---|---|
| ETH | ETH / USD | 0x78F3556b67E17Df817D51Ef5a990cDaF09E8d3A90x78F3…d3A9 ↗ | 24h / 0.5% | On-chain |
| BTC | BTC / USD | 0xa2c5184bF03d373Dc9dE4876eb4Bce595B4602510xa2c5…0251 ↗ | 24h / 0.5% | On-chain |
| SPY | RHSPY / USD | 0x319724394D3A0e3669269846abE664Cd621f9f6A0x3197…9f6A ↗ | 24h / 0.5% | On-chain |
| QQQ | Robinhood QQQ / USD | 0x80901d846d5D7B030F26B480776EE3b29374C2ae0x8090…C2ae ↗ | 24h / 0.5% | On-chain |
| NVDA | RHNVDA / USD | 0x379EC4f7C378F34a1B47E4F3cbeBCbAC3E8E9F150x379E…9F15 ↗ | 24h / 0.5% | On-chain |
| AAPL | Robinhood AAPL / USD | 0x6B22A786bAa607d76728168703a39Ea9C99f2cD00x6B22…2cD0 ↗ | 24h / 0.5% | On-chain |
| USDG | USDG / USD | 0x61B7e5650328764B076A108EFF5fa7282a1B9aD20x61B7…9aD2 ↗ | 24h / 0.5% | On-chain |
No feed on this chain for GLD, AMC. No L2 sequencer uptime feed exists on Robinhood Chain; the oracle is wired for one when it does.
03Governance
Changes wait 48 hours in public. Pausing takes one transaction.
48h timelock
Owns the vault, router and oracle. Every change is public for 48 hours before it runs.
Safe multisig
Proposes and executes changes, and can cancel anything unexpected during the delay.
Deployer: no role
The deployer key gives up every role at handoff. A test checks it.
The guardian key
- Switch one market, or every market, to close-only
- Remove an executor keeper from the PositionRouter
- Remove a price signer from the OracleRouter
- Remove a recorder from a TWAP source
- Lift close-only or re-open a market
- Add keepers, signers or recorders
- Change any parameter, oracle, router or treasury
- Move, withdraw or approve funds
- Pause closes, collateral top-ups or liquidations
Separately, the treasury wallet can stop all new risk at once with USDG.approve(vault, 0). New positions fail to open; every open position can still close or be liquidated, paid from escrow.
04Security review
An internal review found nine issues. Each was proven with a test and fixed.
Not audited yet. The review below was internal. An external audit comes before caps rise above launch values.
Read §5 in full| ID | Severity | Issue | Fix |
|---|---|---|---|
| F1 | Critical | Collateral withdrawal ignored unrealized loss: a losing trader could pull collateral and cap the loss at size ÷ max leverage | Withdrawals checked against equity (unrealized profit excluded) |
| F2 | Medium | Self-hedge bypassed the net-skew cap and impact fee | Skew measured without the account's own opposite position |
| F3 | Low/Med | Hedged pair tripped the payout breaker into a 48h outage | Hedge netting; breaker is now a 1h cooldown |
| F4 | Medium | Guardian removing all signers froze every exit on TWAP markets | Decreases fall back to the TWAP as stale |
| F5 | Medium | With one honest signer offline, one leaked signer could move the price and force liquidations | Two fresh prices must agree within the spread |
| F6 | Medium | A pre-armed emergencyDecrease ticket bypassed the two-step delay | Acceptable price enforced, 1h window, position must predate the request |
| F7 | Low/Med | Moving the pool spot paused liquidations | Spot guard no longer affects the mark |
| F8 | Medium | A leaked recorder key could wipe TWAP history and freeze exits | 15s minimum record spacing. Superseded 2026-09-20: record() is permissionless, so a recorder key is a gas-theft risk only (8.6a) |
| F9 | Low | Keepers could execute increases long after expiry | Expired increases refund |
Deep campaign: FOUNDRY_PROFILE=deep forge test, run before every deploy. Invariants run with fail_on_revert.
05If a key leaks
| Compromised | Worst case |
|---|---|
| Custody wallet | Nothing Bias-related; it is outside the system. |
| Treasury wallet | Its USDG balance. Keep only the budget there. |
| Vault / router bug | Escrow for open positions + remaining allowance. Set the allowance to the budget, never unlimited. |
| Executor key | Can execute or refund queued requests at the oracle price; cannot set prices or move funds. Out-of-gas griefing reverts instead of refunding. Guardian removes it. |
| One signer key | Cannot move the price: with 3 signers live the median ignores it, and with only 2 fresh prices they must agree within the spread or the price is treated as stale (opens and liquidations pause, closes keep working). Guardian removes it. |
| TWAP recorder key | Can record at chosen moments, at most every 15s, so one record weighs at most 1/120 of a 30-minute TWAP; cannot wipe history. Guardian removes it. |
| Guardian key | Can make markets close-only and remove keepers and signers (a denial of service on opens). Closes keep working even with every signer removed (priced from the TWAP as stale). The Safe rotates it. |
| Owner = timelock | Every change waits 48h in public; the Safe cancels anything unexpected. |
| Deployer key after handoff | Nothing. |
06Known limits
Concentrated liquidity (open, mitigated by fixed caps)
depthUsd treats in-range liquidity as if it were full range. Pons graduation pools are full range and read correctly. On concentrated pools it overstates real depth 3-15x: the on-chain scan of 2026-09-15 read the SPY/USDG pool at $409M virtual depth, while the cost to move it ±10% implies about $51M (skew-site/scripts/scan-tokens.mjs, effDepth10Usd). A depth-scaled cap alone would then be far too large and the pump attack of §3 profitable. Launch mitigation: every market has a small fixed per-side OI cap and net-skew cap (PARAMS.md), and the vault enforces min(fixed, depth-derived), so an inflated depth can never lift a cap above the fixed number (test/LaunchCaps.t.sol). The most a pump attack can win per market is then the fixed cap times the reserve % ($2k on a meme market). TWAP-class listings are further limited to native-ETH-quoted pools with no hook or the Pons MemeHook (script/Configure.s.sol, script/DeployTwapSource.s.sol). Before raising caps: make depth conservative on-chain (a bounded tick walk mirroring effDepth10Usd, or a timelocked per-market depth ceiling), or keep caps where the fixed number, not depth, always binds.
Unknown hooks
Pools with a hook other than none or Pons can charge fees or taxes the §3 math does not model. MarketFactory refuses any hook not in its governance allowlist (launch: none and the Pons MemeHook) and every dynamic-fee pool. A market configured by hand through the timelock bypasses that check, so the Safe must verify the pool key of every TWAP source it lists (Configure.s.sol checks it).
Price-source dominance
The v4 pool is the only venue the contracts see. If a token trades mostly elsewhere (a v3 fork, a CEX), a thin v4 pool is a cheap price to move. Listing rule (LAUNCH.md): list a TWAP market only when its v4 pool is the dominant venue by liquidity and 24h volume, checked on DexScreener and GeckoTerminal at listing time.
USDG-quoted pools (resolved 2026-09-16)
UniV4TwapSource now takes the quote's decimals and USD feed: native ETH and WETH (18 decimals, Chainlink ETH/USD) and USDG (6 decimals, exactly $1, the vault's own unit). Both currency orderings are tested (test/QuoteSource.t.sol) and checked on mainnet pools (PONS/USDG with PONS as currency0, FRONG/ETH, test/ForkListing.t.sol). Token-quoted pools (coin/coin) are still refused.
Keeper collusion
2 of 3 signers colluding can post any price inside the 3% divergence band. Run the signers on separate hosts, operators and clouds.
Multi-account hedges
Self-hedge netting works per account. Two colluding accounts can still open offsetting positions to move skew or trip the breaker; that costs spreads and fees on both legs, the per-side OI cap still holds, and a breaker trip is a one-hour pause of opens, never of exits.
Sequencer
Robinhood Chain has one sequencer and no uptime feed. The router's timeouts and the stale-price path are the only protection if it halts.
Stock gaps
Decreases after the close price at the last feed value plus the stale spread. A trader holding through a gap still wins or loses the real gap. The reserve caps what they can win.
The treasury is short what the users like
Memecoin users are mostly long. Skew caps and 5x memecoin funding limit this but do not remove it. An optional off-chain hedge (the treasury holds spot equal to part of the net long skew) must buy slowly, because that same pool is the price source.