DOCS · HOW THE MACHINE WORKSEvery mechanism, in order.
Every risk, verbatim.
A trading tax that buys real tokenized assets into a vault nobody owns, an agent that can only act through an oracle fence, and a redeemable book value per token that can only rise - plus the complete list of risks, quoted verbatim from the design blueprint, including the ones nobody can engineer away.
- BUY / SELL TAX
- 3% / 3%
- TRADE CLAMP
- 5% NAV
- REDEMPTION FEE
- 2%
Tax in. Fence. Vault.
Nothing else can touch the book.
Every $MSTRGY pool trade pays a 3%/3% tax. Flap converts it and pays NATIVE ETH to our StrategyExecutor (the beneficiary is baked in at creation via a nonce-predicted deploy, hard-asserted before launch proceeds). Anyone can crank dispatch() - fork-proven with a stranger wallet - so the flow never waits on our keeper. Behind a dual-Chainlink fence, convert() turns that ETH into book assets, force-forwarded to the vault in the same transaction.
MiningVault has no owner, no pause, no upgrade. Redeem $MSTRGY anytime for a pro-rata in-kind slice of EVERY asset it holds; redeemed $MSTRGY locks in the vault forever (the Flap token has no burn), and the 2% redemption fee stays in the vault. Book value per token (the contract's floorPerToken, per asset) = vault balance ÷ effectiveSupply, and every mechanism path can only raise it - invariant-tested and fork-proven. Market prices can still fall: the invariant prevents extraction, not drawdowns.
No fill more than 3% above the Chainlink price, ever: convert() and every trade() leg are post-checked on-chain against dual feeds (out·priceOut ≥ in·priceIn·(1−3%)). Stale feeds revert (4-day tolerance - feeds run 24/5 and freeze on weekends). Assets without a live feed cannot be traded at all. This single mechanism is what makes the chain's poisoned dust pools (which quote 6-11x oracle) a no-op instead of a hazard.
An off-chain algorithmic agent (band rebalancing at 60/40 risk/ballast ±15pp, a 100-day trend filter that de-risks to 40/60, market-hours only) proposes trades. It is advisory by construction: trade() only accepts legs the fence clears, caps each trade at 5% of NAV, enforces a minimum interval, and force-returns output to the vault. A compromised agent key is bounded exactly like a compromised keeper key. The /agent page runs the same signal code in your browser on live reads.
The day-one book is extractive commodities: USO (oil, risk leg) + SLV (silver, ballast leg) at 60/40 - the commodities themselves, not the companies that mine them. Every pure mining equity on Robinhood Chain fails a hard gate, measured 2026-07-28: CLSK (bitcoin mining) has a feed but ZERO liquidity and quotes +437 bps, which the fence refuses at every size, forever; IREN, APLD, PR and XOM have no Chainlink feed, so the fence structurally cannot price them. USAR (rare earths - an actual mining company) is a STANDING fenced buy, parked until its quotes normalize. The vault earns NO yield: the T-bill sleeve (SGOV) was removed on 2026-07-28 because its venue moves 1% on ~$165 and drained to zero twice; nothing on this chain replaced it. True mining equities join via governance + timelock when Robinhood lists them with a feed and a venue.
The vault's ONLY mutable surface is asset-allowlist growth: escrow-vote in MiningGovernor (deposit $MSTRGY to vote, withdraw after), then a 3-day enact timelock. That timelock is the exit window - see the accepted risk D-1 below. No parameter of the executor or vault is otherwise governable; everything else is immutable constructor state.
A hot EOA holding gas only. It cranks dispatch() + convert(), tolerates the pre-graduation revert (tax accumulates), skips stale-feed windows, and runs the beneficiary watchdog before every action - halting loudly the moment taxProcessor.marketAddress() is not our executor. Everything it can do is bounded on-chain; everything it must not miss, anyone else can crank permissionlessly.
CONTRACTS · PUBLISH-GATED UNTIL LAUNCH
| Contract | Address | Role |
|---|---|---|
| $MSTRGY token | deploys at launch | Flap FlapTaxTokenV3 clone · fixed 1B supply · 3%/3% tax · address ends 0x7777 |
| Flap TaxProcessor | deploys at launch | Flap clone · accrues tax as WETH · permissionless dispatch() pays the beneficiary in native ETH |
| StrategyExecutor | deploys at launch | our beneficiary · convert()/convertViaV4() behind the dual-Chainlink fence · agent trade() path · no owner |
| MiningVault | deploys at launch | the book · no owner, no pause, no upgrade · in-kind pro-rata redemption · redeemed tokens locked forever |
| MiningGovernor | deploys at launch | escrow-vote allowlist growth · 3-day enact timelock (the exit window) |
| asset · USO | 0xa30F…D344 ↗ | United States Oil Fund · canonical Stock Token (third-party, public by design) |
| asset · SLV | 0x411e…D89f ↗ | Silver Trust ETF · canonical Stock Token (third-party, public by design) |
| asset · USAR | 0xd917…86a6 ↗ | USA Rare Earth · canonical Stock Token (third-party, public by design) |
Our addresses stay masked (xxx.xxx) until the launch go-order flips the publish gate - one flip reveals everything at once, and a build-time leak scanner keeps them out of every public artifact until then. Third-party venue pins (official Uniswap v4): PoolManager 0x8366…0951 · Quoter 0x8Dc1…8F94 · Permit2 0x0000…8BA3. Stock Token registry: docs.robinhood.com ↗ · Feeds: Chainlink ↗
Everything that can go wrong,
in the blueprint's own words.
DESIGN-BLUEPRINT.md §9 · quoted verbatim- the blueprint's own instruction is "publish these".
Docs say the beneficiary is immutable; the verified contracts disagree — Portal guardians can call changeMarketWallet/setTokenBeneficiary and the processor owner (= Portal) has setReceivers/setWalletConfig. Mitigation: keeper watchdog every run; anything already swept to the executor/vault is beyond Flap's reach. Residual platform trust — disclose verbatim.
Portal and TaxTokenHelper are Flap-controlled upgradeable proxies. Mitigation: code-hash drift guard pre-launch and in the keeper; the token clone itself is NOT upgradeable and its tax params have no setters.
Tax ends at graduation + taxDuration (~98y as configured) — disclose.
~60% of tax during bonding, ~41% after graduation. At 3%/5% tax, roughly 1.8–2.9% of taxed volume reaches the vault post-graduation — publish the math.
The agent can lose money; the floor invariant prevents extraction, not drawdowns. NAV can fall below entry prices. PnL shown honestly.
5 registry tokens (COIN, CRCL, CRWV, BABA, USAR) quote 6–11x oracle on 1inch; the fence refuses them but this delays the "real mining company" leg indefinitely (blocker, §4.1).
Feeds are 24/5; no trading or conversion on weekends/holidays (4-day staleness tolerance); pools drift vs frozen oracles off-hours.
Redemption locks $MSTRGY forever instead; totalSupply never shrinks on paper — dashboard shows effectiveSupply.
Any liquidity event on this chain is sniped in-block (observed twice on rwabasket). Flap's curve/graduation model absorbs most of this, but the creator buy and any Phase-2 buyback must assume adversarial mempool.
Stock Tokens are region-gated economic exposure, not shares; a vault holding tokenized equities for the benefit of token holders needs a legal read before launch (same gate icytowers imposed). 0x's RWA gating shows venue policies can change under us.
Keeper/agent keys are hot EOAs; compromise is bounded on-chain (maxSlippageBps per minInterval, allowlisted assets, forced vault destination). The operator fee path is immutable (25% of primary-path conversions, contract-capped at 25%) and off the primary convert only.
Blockscout rate-limits, lags 30–60 min, and has had a hard outage — never in the money path; RPC-only for anything critical.
Note (outside the quote): Item 4 was written against the recommended 3%/5% tax. The decided rates are 3%/3% (blueprint §11, DECIDED 2026-07-20), which makes the honest arithmetic ~1.2% of taxed volume reaching the vault during bonding and ~1.77% after graduation.
Note (outside the quote): Venue depth ceiling (re-probed live 2026-07-28 for the USO+SLV book): SLV’s 1% v3 pool moves ~$17,262 per 1% price move at −36.7 bps vs oracle; USO’s 1% v3 pool ~$1,782 per 1% at −39.6 bps. Both clear the ±300 bps fence today. An earlier probe of this project reported only ~$21k of fair venue on the ENTIRE chain; that figure was wrong — it scanned pools among just five currencies and missed both v3 depth and the USDG-paired stock pools. The agent still trades in small steps (maxTradeBps 500), and vault growth beyond low five-figures NAV remains venue-constrained. Thin venues cannot produce bad fills — the fence fails trades closed — they can only delay rebalancing.
Note (outside the quote): Algorithm expectations, stated at the honest ceiling: the shipped defaults (±15pp band, 100-day momentum, 60→40 de-risk) come from a walk-forward study on the live USO+SLV book (docs/RESEARCH-USO-SLV.md), and a deeper adversarial backtest (docs/BACKTEST-DEEP.md, 66 runs) then showed its limits plainly: across 6 years the strategy was never much worse than holding the static 60/40 book (worst window ~−7pp, usually ≤1–3pp or nothing), occasionally much better (one +19pp regime win that overlapped parameter selection), with modest drawdown insurance (~1pp, and none in fast crashes). The expected forward edge over simply holding the book is approximately ZERO; the algorithm is risk plumbing, not an alpha engine. Real fills pay real slippage and the agent can lose money. Nobody should buy $MSTRGY expecting trading profits.
Note (outside the quote): “Risk-off” does not mean cash. The trend filter cuts the risk target from 60% to 40% and rotates toward SLV, but SLV is silver — another commodity, not a cash instrument. There is no cash-like asset the executor can hold on this chain (USDG is 6-decimal and is rejected as a book asset by construction), so de-risking is a BETA REDUCTION between two commodities. Both legs can fall together. Additionally, USO’s Chainlink feed currently has only ~26 daily closes — far shorter than the 100-day momentum lookback — so the trend filter reports “trend unknown” and holds the base weight until the feed matures. That is the designed fail-safe, and it means the filter is inert at launch.
Note (outside the quote): The vault earns no yield. Until 2026-07-28 the book held SGOV, a real T-bill sleeve. It was removed because its venue moves 1% on ~$165 and drained to zero liquidity twice in the week before launch; an independent measurement put its safe sell size at about $10. Nothing replaced it. Floor per token now rises from tax inflow and the 2% redemption fee only.
Note (outside the quote): Issuer powers over the vault’s assets (verified Stock implementation 0xb35490d6…5aE2, read 2026-07-21): every Robinhood Stock Token (USO, SLV, all of them) is a BeaconProxy behind ONE shared beacon — the issuer can upgrade all stock-token logic at once — and the implementation grants role-gated pause() (a paused asset freezes trades AND the all-or-nothing in-kind redemption), adminBurn(from, amount) (the issuer can burn tokens from ANY holder, including the vault), mint, a balance multiplier for corporate actions, and a BLOCKER_ROLE. These are standard regulated-RWA controls (USDG carries the same class of powers), but they mean the vault’s floor is ultimately backed by issuer-managed, confiscable instruments — not bearer assets. Disclosed, not fixable.
One risk we did not engineer away.
Here it is, quoted whole.
A voted-in asset whose transfer reverts (or lies about balances) would make the redemption loop revert for everyone. This is the vault's single mutable surface and is deliberate (blueprint §3.1.4, DECIDED): the defense is procedural — escrow vote (threshold + quorum) → 14-day-bounded execute → AssetProposed event → 3-day enact timelock during which any holder can exit at full floor before the asset goes live. Skipping/try-catching bad assets instead would silently short redeemers, which is worse.
docs/REVIEW-NOTES.md · D-1 · accepted-by-design, quoted verbatim. In plain words: if governance ever votes in an asset whose transfers revert, redemption bricks for everyone. The 3-day timelock between the vote passing and the asset going live is YOUR exit window - any holder can redeem their full book-value slice during it. Watch AssetProposed events; this site will surface them.
The chain is thin.
The fence is what makes that survivable.
docs/V4-POOLS.md · v4 pool recon 2026-07-20, venues re-probed live 2026-07-28 · verdict: route-via-1inch-only (with a bounded, fork-proven v4 dead-man fallback)
Every real-token Uniswap v4 stock pool on the chain is HOOKLESS (no allowlist/KYC gating exists on any pool a swap would route through), and a contract swapping the real pools is fork-proven — the blocker is liquidity placement and fees, not access.
The day-one book trades on Uniswap v3 1% pools against USDG. Live 2026-07-28: SLV ~$17,262 per 1% move at −36.7 bps vs oracle; USO ~$1,782 per 1% at −39.6 bps. 1inch is the only actor that follows liquidity across v3/v4 as it moves, which is why it is the single pinned router.
CORRECTION to the 2026-07-20 recon: it scanned pools among only five currencies (ETH, USDG, SLV, SGOV, USAR) and concluded the whole chain held ~$21k of fair venue. That was an artifact of the scan, not the chain. A full sweep of all 96 registry assets found seven above $500k of pool liquidity alone.
A 90–95%-LP-fee "fee trap" pool family exists, priced at oracle so it looks fair on a chart. The oracle fence is what turns these traps from a hazard into a no-op — they can never clear ≤ oracle+3%. This family fully explains the documented USAR "6–11x oracle" 1inch poisoning.
convertViaV4 (the permissionless dead-man fallback) routes ETH→USDG→target on pinned, fork-proven keys. BOTH book legs have a USDG-paired v4 pool at 20000/400 (live liquidity: USDG/USO 1.319e16, USDG/SLV 1.056e15), so the brake can fill for either — end-to-end fork-proven for USO on 2026-07-28. Neither leg has an ETH-paired v4 pool, but the brake never needs one.
SGOV left the book on 2026-07-28. Its fair venue drained to zero on 2026-07-20, came back thin, and moves 1% on roughly $165 — unusable for exit at any meaningful size.
Three kinds of number.
Nothing else gets rendered.
Every number on this site is one of three things: a live on-chain read (Chainlink prices and round history, the platform drift check, and - at launch - vault, executor and processor state), a value computed from live reads with the methodology stated next to it, or an explicit pre-launch label. There are no simulated transactions, no fabricated history, no placeholder charts pretending to be data. Pre-launch, our contract addresses do not appear anywhere in the site's public build output - a leak scanner enforces that at build time.
The mechanics above describe what the contracts do; /txns is the trade log of record for what they have actually done - every transaction with its reasoning reconstructed from real oracle history, never self-reported - and /ops shows what the $MSTRGY automation sees right now, running the keeper's own decision code in your browser.