PROOF · THE CLAIMS LEDGEREvery claim this protocol makes, mapped to the exact on-chain read or named passing test that checks it. Rows go green only when the verification is live on Robinhood Chain. Until launch, each row states precisely what evidence exists today - passing fork, invariant and rehearsal suites - and nothing more.
not yet published (xxx.xxx)
The only real $MSTRGY addresses will be published here at launch, nowhere else first. This chain is full of verified-but-fake copycat tokens AND routers: any "$MSTRGY" circulating before this slot fills is not this protocol. Verify byte-for-byte before touching anything.
dispatch() - permissionless; Flap takes its cut, the remainder arrives as native ETH at the beneficiary
Passing today: fork step 6, "stranger-called dispatch() pays the executor real NATIVE ETH" - a wallet with no role in the system pushed the payout through on forked mainnet state.
convert() - 1inch primary / convertViaV4 fallback, both behind the dual-Chainlink fence (fill ≥ oracle-implied value − 3%)
Passing today: fork step 7, "keeper convert() buys REAL SLV within the dual-Chainlink fence; floor rises", against the real feeds on forked mainnet state; hostile-calldata and >fence fills revert in the unit suite.
force-forwarded in the SAME transaction - assets never rest anywhere touchable; trade() outputs force-returned the same way
Passing today: fork steps 7 and 10 - converted assets land in the vault and a holder redeems them in-kind, floor unchanged or higher.
| Contract | Pinned hash (lib/registry.js) | Live keccak256(code) | Verdict |
|---|---|---|---|
| reading on-chain bytecode… | |||
Flap's Portal and helpers are upgradeable proxies THEY control (disclosed risk §9.2). This check recomputes keccak256 over the actual deployed bytecode via eth_getCode - no explorer, no trust - and compares it to the pins recorded when the platform was probed and fork-proven. The launch script refuses to run on drift; the keeper re-checks in operation. These are third-party platform addresses, public by design - our own addresses stay withheld until launch.
keccak256(eth_getCode(Portal proxy)) and keccak256(eth_getCode(TaxTokenV3 impl)) must equal the pins in lib/registry.js - the same hard assert the launch script and keeper run
Reading the chain…
taxProcessor.marketAddress() == StrategyExecutor, read every minute here and before every keeper crank (exit 2 on mismatch) · nonce-predicted deploy hard-asserts it at launch
Passing today: fork steps 2-3 - the executor address is nonce-predicted, deployed with hard asserts, and the real Portal wired it as beneficiary on forked mainnet state. Disclosed honestly: Portal guardians CAN redirect it later (docs §9.1); this row is the public tripwire.
dispatch() on the TaxProcessor is permissionless · convertViaV4() opens permissionlessly after keeper silence (dead-man fallback)
Passing today: fork step 6 (a stranger wallet cranked the payout - 0.179 real ETH on forked mainnet state) and fork step 8, in which a stranger drove convertViaV4 through the REAL pinned v4 pools and delivered 0.153 real USO to the vault. Both book legs have a USDG-paired v4 pool, so the dead-man brake can fill for either; USAR is the exception, since its only v4 pools are fee traps the fence always rejects.
on-chain post-check: out·priceOut ≥ ethIn·priceEth·(1−maxSlippageBps) against dual Chainlink feeds · stale feeds revert · non-allowlisted assets revert · fee-trap pools can never clear it
Passing today: fork step 7 clears the REAL Chainlink guard; the unit suite proves the reverts (hostile keeper calldata, >3% fills, stale feeds, non-allowlisted assets, oversize trades). npx hardhat test · 328 passing (contracts + keeper + agent unit suites).
floorPerToken(asset) = vault balance ÷ effectiveSupply · every path (convert, trade returns, redemption fee, locked supply) can only raise it · market prices can still fall - that is disclosed market risk, not extraction
Passing today: floor-per-token monotonicity: "invariant: floor-per-token monotone under randomized donate/redeem" (test/core.unit.test.js) + "floor invariant sweep" (test/mining-core.unit.test.js); fork step 10 holds it through a real redeem. The chart on /vault will show exactly what the chain says either way.
redeem(amount): pro-rata slice of EVERY vault asset, in-kind · the Flap token has no burn - redeemed tokens lock in the vault; effectiveSupply is the honest denominator
Passing today: fork step 10, "holder redeems in-kind; remaining floor never falls; redeemed tokens locked forever" - real token transfers out of the vault on forked mainnet state.
trade() only from the authorized agent key · every leg oracle-fenced · ≤ 5% of NAV per trade · minInterval between trades · output force-returned to the vault - a compromised key is bounded to fence leakage
Passing today: the StrategyExecutor trade() unit suites (auth, fence, circuit breaker, forced vault return) plus npm run rehearse · 16/16 · keeper + agent + watchdog dress rehearsal on fork.
MiningVault and StrategyExecutor have no owner functions, no setters beyond the disclosed governance path (asset allowlist, 3-day timelock), no proxies · the constructor is the entire configuration surface
Checkable in verified source the moment addresses publish; until the chain can confirm it, the claim rests on the repository source and the passing suites, so this chip stays amber by policy. The one mutable surface (governance-added assets) is disclosed as accepted risk D-1 on /docs.
Chip legend - LIVE VERIFIED: an on-chain read on this page right now. AT LAUNCH: the read or proof-tx only exists once addresses publish; no number is shown before then. TESTED ON FORK: a named, passing suite against forked Robinhood Chain mainnet state (test/flap-pipeline.fork.test.js · 11/11 against forked Robinhood Chain mainnet state (npx cross-env FORK=1 hardhat test test/flap-pipeline.fork.test.js); npm run rehearse · 16/16 · keeper + agent + watchdog dress rehearsal on fork) - real evidence, not yet the live chain. Suite names refer to files in this repository. Full risk register: /docs.
Stock Tokens provide economic exposure only - they are not legal ownership of the underlying assets and are subject to jurisdictional restrictions. Nothing is deployed yet, no $MSTRGY token exists, and nothing here is investment advice. The trading agent can lose money: the vault prevents extraction, not market drawdowns.
