Skip to content
Bias

Transparency

TransparencyLive on chain 4663

Backing, contracts, governance and the security review. Read from the chain and the contracts repo.

100%Escrowed
48hTimelock
9 / 9Review findings
Not yetExternal audit

01Proof of backing

Live from the vault: the USDG that would pay every trader at max profit right now.

vault.backing() · liveReading
USDG in the vault
usdg.balanceOf(vault)
Collateral + reserves
totalCollateral + totalReserved
Surplus
balance − owed
Treasury available
min(balance, allowance)
Total open interest vs aggregate cap$0.00 / uncapped

vault.maxTotalOi() is 0 (uncapped)

vault balance == Σ collateral + Σ reserves
reserve = min(market % × size, 900% × collateral)
max profit per position = its reserve

Check it yourself

cast call 0x615E3623002B6D58A1375B3061b610409635F16B \
  "backing()(uint256,uint256,uint256,bool)" \
  --rpc-url https://rpc.mainnet.chain.robinhood.com
PerpVault 0x615E…F16B on Blockscout ↗

02Contracts

Every link goes to Blockscout.

Protocol contracts and wallets
ContractRoleAddressStatus
PerpVaultEscrow, positions, caps, fees. Holds every open position's collateral and reserve.0x615E…F16BDeployed
PositionRouterTwo-step requests, keeper execution, refunds, emergency exits.0x7841…EE0bDeployed
OracleRouterChainlink and TWAP pricing, market hours, staleness, signers.0x6aF2…97dfDeployed
TimelockOwner of vault, router and oracle. 48h delay on every change.at launchat launch
GuardianRestrict-only key: close-only and keeper removal.0x7149…950BDeployed
TreasuryCounterparty wallet. Approves the budget the vault can draw.0xe3eF…4750Deployed
USDGCollateral and settlement token.0x5fc5…d168External
Uniswap v4 PoolManagerPool state read for coin prices and liquidity.0x8366…0951External

Chainlink feeds

verified 2026-09-14
Chainlink price feeds on Robinhood Chain
Feeddescription()Proxy addressHeartbeat / deviationCheck
ETHETH / USD0x78F3…d3A924h / 0.5%On-chain
BTCBTC / USD0xa2c5…025124h / 0.5%On-chain
SPYRHSPY / USD0x3197…9f6A24h / 0.5%On-chain
QQQRobinhood QQQ / USD0x8090…C2ae24h / 0.5%On-chain
NVDARHNVDA / USD0x379E…9F1524h / 0.5%On-chain
AAPLRobinhood AAPL / USD0x6B22…2cD024h / 0.5%On-chain
USDGUSDG / USD0x61B7…9aD224h / 0.5%On-chain

No feed on this chain for GLD, AMC. No L2 sequencer uptime feed exists on Robinhood Chain; the oracle is wired for one when it does.

03Governance

Changes wait 48 hours in public. Pausing takes one transaction.

01

48h timelock

Owns the vault, router and oracle. Every change is public for 48 hours before it runs.

02

Safe multisig

Proposes and executes changes, and can cancel anything unexpected during the delay.

03

Deployer: no role

The deployer key gives up every role at handoff. A test checks it.

The guardian key

Can, instantlyRestrict
  • Switch one market, or every market, to close-only
  • Remove an executor keeper from the PositionRouter
  • Remove a price signer from the OracleRouter
  • Remove a recorder from a TWAP source
CannotTimelock only
  • Lift close-only or re-open a market
  • Add keepers, signers or recorders
  • Change any parameter, oracle, router or treasury
  • Move, withdraw or approve funds
  • Pause closes, collateral top-ups or liquidations

Separately, the treasury wallet can stop all new risk at once with USDG.approve(vault, 0). New positions fail to open; every open position can still close or be liquidated, paid from escrow.

04Security review

An internal review found nine issues. Each was proven with a test and fixed.

Not audited yet. The review below was internal. An external audit comes before caps rise above launch values.

Read §5 in full
Pre-mainnet review findings
IDSeverityIssueFix
F1CriticalCollateral withdrawal ignored unrealized loss: a losing trader could pull collateral and cap the loss at size ÷ max leverageWithdrawals checked against equity (unrealized profit excluded)
F2MediumSelf-hedge bypassed the net-skew cap and impact feeSkew measured without the account's own opposite position
F3Low/MedHedged pair tripped the payout breaker into a 48h outageHedge netting; breaker is now a 1h cooldown
F4MediumGuardian removing all signers froze every exit on TWAP marketsDecreases fall back to the TWAP as stale
F5MediumWith one honest signer offline, one leaked signer could move the price and force liquidationsTwo fresh prices must agree within the spread
F6MediumA pre-armed emergencyDecrease ticket bypassed the two-step delayAcceptable price enforced, 1h window, position must predate the request
F7Low/MedMoving the pool spot paused liquidationsSpot guard no longer affects the mark
F8MediumA leaked recorder key could wipe TWAP history and freeze exits15s minimum record spacing. Superseded 2026-09-20: record() is permissionless, so a recorder key is a gas-theft risk only (8.6a)
F9LowKeepers could execute increases long after expiryExpired increases refund
113
contract tests
5,000
fuzz runs per property
256×128
invariant campaign (runs × depth)
256×256
invariant campaign (runs × depth)
1,000
runs per attack fuzzer
53
keeper tests

Deep campaign: FOUNDRY_PROFILE=deep forge test, run before every deploy. Invariants run with fail_on_revert.

05If a key leaks

Worst case per compromised key
CompromisedWorst case
Custody walletNothing Bias-related; it is outside the system.
Treasury walletIts USDG balance. Keep only the budget there.
Vault / router bugEscrow for open positions + remaining allowance. Set the allowance to the budget, never unlimited.
Executor keyCan execute or refund queued requests at the oracle price; cannot set prices or move funds. Out-of-gas griefing reverts instead of refunding. Guardian removes it.
One signer keyCannot move the price: with 3 signers live the median ignores it, and with only 2 fresh prices they must agree within the spread or the price is treated as stale (opens and liquidations pause, closes keep working). Guardian removes it.
TWAP recorder keyCan record at chosen moments, at most every 15s, so one record weighs at most 1/120 of a 30-minute TWAP; cannot wipe history. Guardian removes it.
Guardian keyCan make markets close-only and remove keepers and signers (a denial of service on opens). Closes keep working even with every signer removed (priced from the TWAP as stale). The Safe rotates it.
Owner = timelockEvery change waits 48h in public; the Safe cancels anything unexpected.
Deployer key after handoffNothing.

06Known limits

Concentrated liquidity (open, mitigated by fixed caps)

depthUsd treats in-range liquidity as if it were full range. Pons graduation pools are full range and read correctly. On concentrated pools it overstates real depth 3-15x: the on-chain scan of 2026-09-15 read the SPY/USDG pool at $409M virtual depth, while the cost to move it ±10% implies about $51M (skew-site/scripts/scan-tokens.mjs, effDepth10Usd). A depth-scaled cap alone would then be far too large and the pump attack of §3 profitable. Launch mitigation: every market has a small fixed per-side OI cap and net-skew cap (PARAMS.md), and the vault enforces min(fixed, depth-derived), so an inflated depth can never lift a cap above the fixed number (test/LaunchCaps.t.sol). The most a pump attack can win per market is then the fixed cap times the reserve % ($2k on a meme market). TWAP-class listings are further limited to native-ETH-quoted pools with no hook or the Pons MemeHook (script/Configure.s.sol, script/DeployTwapSource.s.sol). Before raising caps: make depth conservative on-chain (a bounded tick walk mirroring effDepth10Usd, or a timelocked per-market depth ceiling), or keep caps where the fixed number, not depth, always binds.

Unknown hooks

Pools with a hook other than none or Pons can charge fees or taxes the §3 math does not model. MarketFactory refuses any hook not in its governance allowlist (launch: none and the Pons MemeHook) and every dynamic-fee pool. A market configured by hand through the timelock bypasses that check, so the Safe must verify the pool key of every TWAP source it lists (Configure.s.sol checks it).

Price-source dominance

The v4 pool is the only venue the contracts see. If a token trades mostly elsewhere (a v3 fork, a CEX), a thin v4 pool is a cheap price to move. Listing rule (LAUNCH.md): list a TWAP market only when its v4 pool is the dominant venue by liquidity and 24h volume, checked on DexScreener and GeckoTerminal at listing time.

USDG-quoted pools (resolved 2026-09-16)

UniV4TwapSource now takes the quote's decimals and USD feed: native ETH and WETH (18 decimals, Chainlink ETH/USD) and USDG (6 decimals, exactly $1, the vault's own unit). Both currency orderings are tested (test/QuoteSource.t.sol) and checked on mainnet pools (PONS/USDG with PONS as currency0, FRONG/ETH, test/ForkListing.t.sol). Token-quoted pools (coin/coin) are still refused.

Keeper collusion

2 of 3 signers colluding can post any price inside the 3% divergence band. Run the signers on separate hosts, operators and clouds.

Multi-account hedges

Self-hedge netting works per account. Two colluding accounts can still open offsetting positions to move skew or trip the breaker; that costs spreads and fees on both legs, the per-side OI cap still holds, and a breaker trip is a one-hour pause of opens, never of exits.

Sequencer

Robinhood Chain has one sequencer and no uptime feed. The router's timeouts and the stale-price path are the only protection if it halts.

Stock gaps

Decreases after the close price at the last feed value plus the stale spread. A trader holding through a gap still wins or loses the real gap. The reserve caps what they can win.

The treasury is short what the users like

Memecoin users are mostly long. Skew caps and 5x memecoin funding limit this but do not remove it. An optional off-chain hedge (the treasury holds spot equal to part of the net long skew) must buy slowly, because that same pool is the price source.