Reserves and listing

Everything INVEST is backed by is a reserve: an asset the Treasury holds, prices through a vetted feed, and counts — after a discount — towards backing. This page explains how an asset becomes a reserve, how it is valued once it is one, and why the process is split in two.

Why listing is the mint permission

Registering a price feed for a token and enabling that token as a reserve is the whole minting permission. A token with a lying feed can be deposited to mint INVEST against nothing, and it enters the treasury total that gates both bond mints and staking emissions.

So the power to list is deliberately split:

• Valuation — what price source an asset gets, how heavily it is discounted, and what band its price must fall inside — is held only by governance.
• Activation — actually switching a vetted asset on — is held by an operator, who can only install what governance already approved.

The operator supplies nothing about valuation. A compromised operator key can at worst switch on a token that governance already priced conservatively, or switch off a non-genesis one. Neither is silent: every activation is announced with a public delay before it takes effect, and it can be cancelled during that window by the operator, by governance, or by the guardian.

Tier 1 — governance vets

A vetting decision records the exact configuration the Treasury may ever hold for that asset: which price feed, how stale an answer may be, how deeply the asset is discounted, whether it must be probed for a paused oracle, and the absolute price band outside which its answers are refused.

Governance is the only author of that record. It is checked against floors the protocol enforces regardless of what governance intends: a discount can never be smaller than the floor for that kind of price source, a price band is mandatory for the less-trusted sources, and a manually posted feed must already be anchored before it can be vetted at all.

There is also a denylist. Impersonator tokens are live on Robinhood Chain — contracts that copy a real ticker's name and symbol byte for byte. A denied address can never be vetted or installed, even by mistake. See the impersonator warning in the chain reference: never resolve a token by its name or symbol, only by address.

Tier 2 — the operator activates

Activation is a two-step, announced action. The operator queues it; after the delay, anyone can execute it. Execution re-checks every gate live and installs the vetted configuration verbatim — it cannot alter a single field on the way through.

The result is a standing invariant: for every enabled reserve, the configuration the Treasury is actually using equals the configuration governance vetted, field by field. If those ever diverge, something is wrong.

Removal works the same way, with one exception: the genesis reserve — USDG, the asset the protocol launched against — is permanent and cannot be removed by anyone.

How a reserve is valued

The Treasury's unit of account is USD. Every reserve's contribution to backing is:

value = balance held  ×  feed price  ×  (1 − haircut)

with three guards applied to the feed answer before it is believed at all.

The haircut

A haircut is a per-asset, downward-only discount applied before an asset counts as backing. It is the protocol's margin of safety: a 20% haircut means a $100 position backs $80 of INVEST.

Haircuts scale with how volatile and how well-priced an asset is. At genesis, by class:

Class	Haircut
USDG (the genesis reserve)	0%
Other stablecoins	2%
WETH and BTC wrappers	10%
Liquid staking tokens	15%
Tokenized equities and ETFs	20%
Other crypto assets	25%

Assets priced by a less-trusted source carry a deeper haircut floor on top of their class value — the further a price is from a first-party oracle, the harder the discount.

The price band

A haircut only protects against a price being too low. It cannot cover an upward overshoot — a manipulated pool, a fat-fingered manual post, a mark inflated by a reentrancy trick. That is what the price band is for: a hard floor and ceiling, in the feed's own units, outside which an answer is refused rather than trusted.

An out-of-band answer produces a conservative skip — the asset counts as zero — instead of phantom reserves. Bands are mandatory for every price source that is not a first-party oracle feed.

The staleness guard

Every feed carries a heartbeat: the maximum age an answer may have. A feed that has not published inside its heartbeat is treated as unusable.

The consequences are deliberately asymmetric:

• Actions that create an obligation — depositing an asset to mint INVEST, withdrawing, moving reserves — refuse outright on an unhealthy feed.
• Actions that only re-mark the treasury skip the unhealthy asset entirely, so the treasury total understates rather than overstates.

The protocol always prefers to be wrong in the direction of holding less credit for what it owns.

Where prices come from

Assets are priced by the most trustworthy source available, in this order:

1. A first-party oracle feed — a Chainlink X / USD feed published for the asset. This is the default and the only source used for the assets registered at genesis.
2. A last-price wrapper — the same oracle feed, wrapped so a long publication gap is tolerated for a bounded period instead of making the asset unpriceable.
3. An on-chain TWAP — a time-weighted average over a canonical pool, for assets with real liquidity but no oracle feed. Guarded by a liquidity floor, a spot-versus-average divergence check and an asymmetric limit on how fast the mark may climb.
4. A manually posted feed — for assets with neither an oracle nor a usable pool. The mark can be moved only by a small increment at a time and by a bounded amount per day, always inside the absolute band, and it goes stale — and therefore unpriceable — if it stops being updated. The asset is never mis-priced, only unpriced.
5. A composed rate — an exchange-rate feed multiplied by the underlying's USD feed, for wrapped staking assets. Both legs are guarded, and the round is only as fresh as the staler of the two.
6. A fair-value LP mark — for liquidity-pool tokens, a formula that cannot be inflated by pushing the pool, with the INVEST side always marked at the $1.00 backing target rather than at market.

Each rung down carries a deeper minimum haircut, so the protocol pays for using a weaker source.

Equity feeds go dark outside market hours

Tokenized equities are the largest class in the reserve registry, and their price feeds stop publishing when the underlying market is closed. A weekend gap is longer than any sane heartbeat.

Two things follow, and both are intentional:

• Over a closed market, an equity reserve simply reads stale and is skipped in the treasury mark. Backing understates for the weekend and recovers when the feed resumes. Nothing breaks, and nothing is valued on a guess.
• The last-price wrapper (rung 2) exists precisely for this, and an equity moved onto it stays priced across the gap — at the cost of a deeper haircut, because a gap-down over a closed weekend is absorbed by the discount rather than detected by the feed.

Tokenized equities and ETFs also implement corporate actions on-chain, and expose a flag saying their own oracle is paused while one is being processed. The Treasury probes that flag before pricing them; a paused oracle is treated as "cannot price", never as "price at the last value".

The genesis registry

The protocol launches with 43 registered reserves, all priced by first-party oracle feeds with a 24-hour heartbeat and a sane-price band around the live answer:

Class	Count
USDG — the frozen genesis reserve	1
WETH	1
Tokenized equities	29
Tokenized ETFs	6
BTC wrappers	2
Other stablecoins	2
A liquid staking token	1
Another crypto asset	1

Every address and feed in that registry, plus the assets that are canonical but have no feed yet, is listed in Robinhood Chain facts.

The registry is bounded in size, so that re-marking the treasury is always a bounded operation, and each asset is valued in isolation — one hostile token or broken feed cannot starve the rest of the audit.

Protocol-owned liquidity is a reserve too

The INVEST/USDG pool the protocol owns is itself registered as a reserve. It is marked conservatively — off the stablecoin leg, with the INVEST leg valued at the $1.00 backing target rather than at market — and it is excluded from redemption, so the protocol's own liquidity cannot be redeemed out from under it.

The protocol never counts its own INVEST as backing.