WHITE PAPER · JULY 2026 · PRE-LAUNCH · NOTHING DEPLOYED, NO $MSTRGY TOKEN EXISTS YETThe mining treasury.
The whole mechanism, written down.
The treasury-company playbook on Robinhood Chain: a trading tax accumulates tokenized mining-sector assets into an ownerless vault, an oracle-fenced algorithm manages the treasury, and holders redeem in-kind at a book value per token that only rises. Every claim maps to a contract read; every risk is disclosed verbatim.
The treasury-company playbook in a token: a trading tax that accumulates real tokenized assets into a vault nobody owns,
at a book value per token that can only rise.
$MSTRGY is a fixed-supply tax token launched on Flap. Every pool trade pays a disclosed tax; the platform converts it and pays native ETH to an immutable executor contract. Behind a dual-Chainlink fence, that ETH becomes a book of tokenized mining-sector assets held in an ownerless vault - the treasury. An algorithmic agent manages it through the same fence. Holders own everything: redeem anytime for a pro-rata in-kind slice of every asset, with redeemed tokens locked forever - so book value per token only rises. No claims to process, no staking, no emissions: the yield is a fatter book behind every token, or it is nothing.
Three proven mechanisms,
wired into one money loop.
$MSTRGY connects three proven mechanisms on Robinhood Chain (chain id 4663): a Flap tax token (the tax processor pays a beneficiary contract fixed at creation; the executor then takes a disclosed, immutable 25% operator share off the top of each primary conversion - the only operator touch in the money path, contract-capped at 25%), an oracle-fenced executor (no fill beyond Chainlink +3%, assets force-forwarded to the vault in the same transaction), and a no-owner redemption vault (in-kind, pro-rata, redeemed supply locked forever, book-value-per-token monotone by construction). An off-chain agent adds trend/band rebalancing but is advisory by design - the contracts bound everything it can do. Every claim in this paper is a contract read; the proof page re-checks the live ones every minute.
The book is what the fence allows,
not what the theme would prefer.
Robinhood Chaincarries tokenized equities ("Stock Tokens") priced by dedicated Chainlink feeds updating 24/5. The day-one book is the commodities themselves - oil (USO) and silver (SLV) at 60/40 - not the companies that extract them. That is a deliberate consequence of measurement, not preference: every pure mining equity on this chain fails a hard gate. CleanSpark (CLSK) has a Chainlink feed but zero pool liquidity and quotes +437 bps, which the ±300 bps fence refuses at every size, permanently. IREN, Applied Digital, Permian Resources and Exxon have no Chainlink feed at all, so the oracle fence structurally cannot price them. USA Rare Earth (USAR) - an actual mining company - remains a standing, oracle-fenced buy, parked because its only pools quote 6-11x its oracle price and the fence refuses to overpay. We did not widen the fence to fit the theme. True mining equities join through governance the day Robinhood lists them with a feed and a venue.
Tax in. Fence in the middle.
Vault at the end.
Flap's TaxProcessor accrues the 3%/3% pool-trade tax as WETH and pays it out as native ETH to the beneficiary via permissionless dispatch() - fork-proven with a stranger wallet. The beneficiary is our StrategyExecutor, nonce-predicted so it could be baked into the token at creation and hard-asserted before launch proceeded. Flap keeps ~60% while bonding, ~41% after graduation - published on the tax page, not buried.
convert() swaps ETH into the accumulation target only if the fill survives an on-chain post-check against dual Chainlink feeds (≤ oracle +3%); output is force-forwarded to MiningVault in the same transaction. If the keeper goes silent, a permissionless convertViaV4() fallback opens after a fixed delay (an SLV-only lifeboat under current venue reality - disclosed in §6). The agent's trade() path pulls from the vault, swaps under the same fence plus a 5%-of-NAV circuit breaker, and force-returns output.
There are no dividends, no staking, no claims. Trading profits and tax inflow enlarge the book; redeem(amount) pays a pro-rata in-kind slice of every asset and locks the redeemed $MSTRGY forever (the token has no burn - locking is the chain-verifiable equivalent). The 2% redemption fee stays in the vault. Book value per token (the contract's floorPerToken) is monotone by construction; NAV is not - the agent can lose money, and the dashboard shows PnL honestly.
What the treasury holds
on the first day.
| Asset | Role | Target | Status |
|---|---|---|---|
| USO | Risk leg · day one | 60% | feed live · tradeable |
| SLV | Ballast leg · day one | 40% | feed live · tradeable |
| USAR | Standing fenced buy | 0 (gated) | fence-blocked (pools 6-11x oracle) |
Weights are targets, not holdings; the trend filter can cut the risk leg to 40% in drawdowns, and the ±15pp band keeps the agent from churning. The agent page runs the live signal in your browser from the same Chainlink reads the agent uses.
Four contracts,
and exactly what each one may do.
| Contract | Address | Role |
|---|---|---|
| $MSTRGY (token) | deploys at launch | Flap FlapTaxTokenV3 clone · fixed supply, no burn, taxed pool trades |
| StrategyExecutor | deploys at launch | tax beneficiary · fenced convert()/trade() · immutable parameters |
| MiningVault | deploys at launch | the treasury · ownerless · in-kind redemption at rising book value |
| MiningGovernor | deploys at launch | asset-allowlist votes · 3-day timelock |
Venues, pinned from the verified registry: 1inch v6.1 primary (router pinned at deploy), Uniswap v4 PoolManager 0x8366…0951 for the fallback path. Feeds: standard Chainlink AggregatorProxies, 8 decimals, 24/5. Addresses publish at the launch go-order; a build-time leak scanner keeps them out of every public artifact until then.
What cannot happen,
and what remains.
CANNOT HAPPEN, STRUCTURALLY · ENFORCED BY CODE, NOT PROMISE
| Cannot happen | Why it structurally cannot |
|---|---|
| Minting | no mint exists; supply is fixed at 1,000,000,000 in the Flap token standard |
| Vault extraction | no owner, no withdraw, no pause, no upgrade on MiningVault; only pro-rata redemption moves assets out |
| Overpaying a pool | every convert()/trade() leg is post-checked on-chain against dual Chainlink feeds: fills beyond oracle +3% revert |
| Assets resting anywhere touchable | convert() and trade() force-forward/return assets to the vault in the same transaction |
| Unbounded agent damage | a compromised agent key is capped at 5% of NAV per trade, fence leakage per interval, allowlisted assets only |
| Falling book value per token (per asset) | conversions, trade returns, redemption fees and locked supply can only raise the contract’s floorPerToken read - invariant-tested, fork-proven |
| Silent parameter changes | executor and vault parameters are immutable constructor state; the one governed surface (new assets) runs through a public vote + timelock |
REMAINS, AND IS DISCLOSED · DESIGN-BLUEPRINT.md §9 · quoted verbatim
The complete §9 register, unedited. The docs page carries the same text - it is quoted verbatim in both places on purpose.
Docs say the beneficiary is immutable; the verified contracts disagree — Portal guardians can call changeMarketWallet/setTokenBeneficiary and the processor owner (= Portal) has setReceivers/setWalletConfig. Mitigation: keeper watchdog every run; anything already swept to the executor/vault is beyond Flap's reach. Residual platform trust — disclose verbatim.
Portal and TaxTokenHelper are Flap-controlled upgradeable proxies. Mitigation: code-hash drift guard pre-launch and in the keeper; the token clone itself is NOT upgradeable and its tax params have no setters.
Tax ends at graduation + taxDuration (~98y as configured) — disclose.
~60% of tax during bonding, ~41% after graduation. At 3%/5% tax, roughly 1.8–2.9% of taxed volume reaches the vault post-graduation — publish the math.
The agent can lose money; the floor invariant prevents extraction, not drawdowns. NAV can fall below entry prices. PnL shown honestly.
5 registry tokens (COIN, CRCL, CRWV, BABA, USAR) quote 6–11x oracle on 1inch; the fence refuses them but this delays the "real mining company" leg indefinitely (blocker, §4.1).
Feeds are 24/5; no trading or conversion on weekends/holidays (4-day staleness tolerance); pools drift vs frozen oracles off-hours.
Redemption locks $MSTRGY forever instead; totalSupply never shrinks on paper — dashboard shows effectiveSupply.
Any liquidity event on this chain is sniped in-block (observed twice on rwabasket). Flap's curve/graduation model absorbs most of this, but the creator buy and any Phase-2 buyback must assume adversarial mempool.
Stock Tokens are region-gated economic exposure, not shares; a vault holding tokenized equities for the benefit of token holders needs a legal read before launch (same gate icytowers imposed). 0x's RWA gating shows venue policies can change under us.
Keeper/agent keys are hot EOAs; compromise is bounded on-chain (maxSlippageBps per minInterval, allowlisted assets, forced vault destination). The operator fee path is immutable (25% of primary-path conversions, contract-capped at 25%) and off the primary convert only.
Blockscout rate-limits, lags 30–60 min, and has had a hard outage — never in the money path; RPC-only for anything critical.
Note (outside the quote): Item 4 was written against the recommended 3%/5% tax. The decided rates are 3%/3% (blueprint §11, DECIDED 2026-07-20), which makes the honest arithmetic ~1.2% of taxed volume reaching the vault during bonding and ~1.77% after graduation.
Note (outside the quote): Venue depth ceiling (re-probed live 2026-07-28 for the USO+SLV book): SLV’s 1% v3 pool moves ~$17,262 per 1% price move at −36.7 bps vs oracle; USO’s 1% v3 pool ~$1,782 per 1% at −39.6 bps. Both clear the ±300 bps fence today. An earlier probe of this project reported only ~$21k of fair venue on the ENTIRE chain; that figure was wrong — it scanned pools among just five currencies and missed both v3 depth and the USDG-paired stock pools. The agent still trades in small steps (maxTradeBps 500), and vault growth beyond low five-figures NAV remains venue-constrained. Thin venues cannot produce bad fills — the fence fails trades closed — they can only delay rebalancing.
Note (outside the quote): Algorithm expectations, stated at the honest ceiling: the shipped defaults (±15pp band, 100-day momentum, 60→40 de-risk) come from a walk-forward study on the live USO+SLV book (docs/RESEARCH-USO-SLV.md), and a deeper adversarial backtest (docs/BACKTEST-DEEP.md, 66 runs) then showed its limits plainly: across 6 years the strategy was never much worse than holding the static 60/40 book (worst window ~−7pp, usually ≤1–3pp or nothing), occasionally much better (one +19pp regime win that overlapped parameter selection), with modest drawdown insurance (~1pp, and none in fast crashes). The expected forward edge over simply holding the book is approximately ZERO; the algorithm is risk plumbing, not an alpha engine. Real fills pay real slippage and the agent can lose money. Nobody should buy $MSTRGY expecting trading profits.
Note (outside the quote): “Risk-off” does not mean cash. The trend filter cuts the risk target from 60% to 40% and rotates toward SLV, but SLV is silver — another commodity, not a cash instrument. There is no cash-like asset the executor can hold on this chain (USDG is 6-decimal and is rejected as a book asset by construction), so de-risking is a BETA REDUCTION between two commodities. Both legs can fall together. Additionally, USO’s Chainlink feed currently has only ~26 daily closes — far shorter than the 100-day momentum lookback — so the trend filter reports “trend unknown” and holds the base weight until the feed matures. That is the designed fail-safe, and it means the filter is inert at launch.
Note (outside the quote): The vault earns no yield. Until 2026-07-28 the book held SGOV, a real T-bill sleeve. It was removed because its venue moves 1% on ~$165 and drained to zero liquidity twice in the week before launch; an independent measurement put its safe sell size at about $10. Nothing replaced it. Floor per token now rises from tax inflow and the 2% redemption fee only.
Note (outside the quote): Issuer powers over the vault’s assets (verified Stock implementation 0xb35490d6…5aE2, read 2026-07-21): every Robinhood Stock Token (USO, SLV, all of them) is a BeaconProxy behind ONE shared beacon — the issuer can upgrade all stock-token logic at once — and the implementation grants role-gated pause() (a paused asset freezes trades AND the all-or-nothing in-kind redemption), adminBurn(from, amount) (the issuer can burn tokens from ANY holder, including the vault), mint, a balance multiplier for corporate actions, and a BLOCKER_ROLE. These are standard regulated-RWA controls (USDG carries the same class of powers), but they mean the vault’s floor is ultimately backed by issuer-managed, confiscable instruments — not bearer assets. Disclosed, not fixable.
ACCEPTED BY DESIGN · THE RISK WE CHOSE, IN FULL
A voted-in asset whose transfer reverts (or lies about balances) would make the redemption loop revert for everyone. This is the vault's single mutable surface and is deliberate (blueprint §3.1.4, DECIDED): the defense is procedural — escrow vote (threshold + quorum) → 14-day-bounded execute → AssetProposed event → 3-day enact timelock during which any holder can exit at full floor before the asset goes live. Skipping/try-catching bad assets instead would silently short redeemers, which is worse.
docs/REVIEW-NOTES.md · D-1 · accepted-by-design, quoted verbatim
VENUE REALITY · WHERE THESE TOKENS ACTUALLY TRADE
docs/V4-POOLS.md · v4 pool recon 2026-07-20, venues re-probed live 2026-07-28 · verdict: route-via-1inch-only (with a bounded, fork-proven v4 dead-man fallback)
The day-one book trades on Uniswap v3 1% pools against USDG. Live 2026-07-28: SLV ~$17,262 per 1% move at −36.7 bps vs oracle; USO ~$1,782 per 1% at −39.6 bps. 1inch is the only actor that follows liquidity across v3/v4 as it moves, which is why it is the single pinned router. A 90–95%-LP-fee "fee trap" pool family exists, priced at oracle so it looks fair on a chart. The oracle fence is what turns these traps from a hazard into a no-op — they can never clear ≤ oracle+3%. This family fully explains the documented USAR "6–11x oracle" 1inch poisoning. Full detail on the docs page.
Every number that is decided,
and every one still open.
| Parameter | Value |
|---|---|
| Supply | 1,000,000,000 · fixed (Flap standard) |
| Tax | 3% buy / 3% sell · DECIDED · rates immutable after creation |
| Tax duration | ~98 years (near the probed platform cap) · expiry disclosed |
| mktBps | 10000 · the whole tax routes to the beneficiary path (no Flap dividend machinery) |
| Day-one book | USO 60 / SLV 40 · USAR standing fenced buy |
| Oracle fence | ≤ oracle +3% (maxSlippageBps 300) |
| Circuit breaker | maxTradeBps 500 (5% of NAV per trade) |
| Redemption fee | 2% · stays in the vault (raises book value for remainers) |
| Allowlist growth | holder escrow-vote + 3-day timelock (the D-1 exit window) |
| Launch gates | legal read · code-hash assert · book venue re-probe · explicit go-order (nothing deploys without it) |
Open items, stated openly: the operator address/multisig (the fee itself is decided: 25% of primary-path conversions, contract-capped), creator initial buy, the Phase-2 buyback decision, and the legal read - a hard gate before any mainnet deploy.
Nothing here asks for trust.
Every line above is checkable.
Nothing in this paper asks for trust. Every claim is a contract read or a named passing test, and the numbers this site renders are live reads or honest em-dashes - never an illustration of what a number might look like.
This paper describes what the contracts do. /txns is the trade log of record for what they have actually done - every transaction with its reasoning reconstructed from real oracle history, never self-reported - and /ops shows what the $MSTRGY automation sees right now, running the keeper's own decision code in your browser.