Reserves and listing

Everything INVEST is backed by is a reserve: an asset the Treasury holds, prices through a vetted feed, and counts — after a discount — towards backing. This page explains how an asset becomes a reserve, how it is valued once it is one, and why the process is split.

Why listing is the mint permission

Registering a price feed for a token and enabling that token as a reserve is the whole minting permission. A token with a lying feed can be deposited to mint INVEST against nothing, and it enters the treasury total that gates both bond mints and staking emissions.

So the power to list is deliberately split:

• Valuation — what price source an asset gets, how heavily it is discounted, and what band its price must fall inside — is held only by governance.
• Activation — actually switching a vetted asset on — is held by an operator, who can only install what governance already approved.

The operator supplies nothing about valuation. A compromised operator key can at worst switch on a token that governance already priced conservatively, or switch off a non-genesis one. Neither is silent: every activation is announced with a public delay before it takes effect, and it can be cancelled during that window by the operator, by governance, or by the guardian.

There are three lanes through that split, and every one of them ends in the same place — an approved record, then an announced, cancellable activation:

Lane	Who approves	Who acts	What the actor chooses
Governance vets	—	governance, per asset	everything: price source, discount, band, staleness bound
The operator activates	governance, per asset	the operator, then anyone after the delay	nothing about valuation
Self-service listing	governance, once, as a policy	the operator, per asset, with no vote	one number — the opening mark — and a label

The first two are described immediately below. The third exists so that onboarding a real-world asset that has no oracle feed does not need its own vote, and it is described in Listing without a vote. It is switched off unless governance has explicitly armed it.

Governance vets

A vetting decision records the exact configuration the Treasury may ever hold for that asset: which price feed, how stale an answer may be, how deeply the asset is discounted, whether it must be probed for a paused oracle, and the absolute price band outside which its answers are refused.

Governance is the only author of that record. It is checked against floors the protocol enforces regardless of what governance intends: a discount can never be smaller than the floor for that kind of price source, a price band is mandatory for the less-trusted sources, and a manually posted feed must already be anchored before it can be vetted at all.

There is also a denylist. Impersonator tokens are live on Robinhood Chain — contracts that copy a real ticker's name and symbol byte for byte. A denied address can never be vetted or installed, even by mistake. See the impersonator warning in the chain reference: never resolve a token by its name or symbol, only by address. For Robinhood's own stock tokens there is a stronger check than a maintained list, and the protocol uses it — see the proof that replaces the vote.

The operator activates

Activation is a two-step, announced action. The operator queues it; after the delay, anyone can execute it. Execution re-checks every gate live and installs the vetted configuration verbatim — it cannot alter a single field on the way through.

The result is a standing invariant: for every enabled reserve, the configuration the Treasury is actually using equals the configuration governance vetted, field by field. If those ever diverge, something is wrong.

Removal works the same way, with one exception: the genesis reserve — USDG, the asset the protocol launched against — is permanent and cannot be removed by anyone.

How a reserve is valued

The Treasury's unit of account is USD. Every reserve's contribution to backing is:

value = balance held  ×  feed price  ×  (1 − haircut)

with three guards applied to the feed answer before it is believed at all.

The haircut

A haircut is a per-asset, downward-only discount applied before an asset counts as backing. It is the protocol's margin of safety: a 20% haircut means a $100 position backs $80 of INVEST.

Haircuts scale with how volatile and how well-priced an asset is. At genesis, by class:

Class	Haircut
USDG (the genesis reserve)	0%
Other stablecoins	2%
WETH and BTC wrappers	10%
Liquid staking tokens	15%
Tokenized equities and ETFs	20%
Other crypto assets	25%

Assets priced by a less-trusted source carry a deeper haircut floor on top of their class value — the further a price is from a first-party oracle, the harder the discount.

Why volatility is not disqualifying

The haircut is what lets the treasury hold assets it expects to move. A reserve does not have to be stable to be listed — it has to be valued as though it might fall. The discount is taken up front and permanently, and it is a percentage rather than a fixed allowance, so it scales with the position in both directions.

That is what makes a volatile reserve safe to want rather than something to tolerate. A position that appreciates hands the treasury the whole of the gain — still discounted, with no supply issued against the part that has not been marked. A position that falls was never counted at full value in the first place. The protocol is deliberately long assets with room to move, and structurally conservative about what it will mint against them.

The price band

A haircut only protects against a price being too low. It cannot cover an upward overshoot — a manipulated pool, a fat-fingered manual post, a mark inflated by a reentrancy trick. That is what the price band is for: a hard floor and ceiling, in the feed's own units, outside which an answer is refused rather than trusted.

An out-of-band answer produces a conservative skip — the asset counts as zero — instead of phantom reserves. Bands are mandatory for every price source that is not a first-party oracle feed.

The staleness guard

Every feed carries a heartbeat: the maximum age an answer may have. A feed that has not published inside its heartbeat is treated as unusable.

The consequences are deliberately asymmetric:

• Actions that create an obligation — depositing an asset to mint INVEST, withdrawing, moving reserves — refuse outright on an unhealthy feed.
• Actions that only re-mark the treasury skip the unhealthy asset entirely, so the treasury total understates rather than overstates.

The protocol always prefers to be wrong in the direction of holding less credit for what it owns.

Where prices come from

Assets are priced by the most trustworthy source available, in this order:

1. A first-party oracle feed — a Chainlink X / USD feed published for the asset. This is the default and the only source used for the assets registered at genesis.

2. A last-price wrapper — the same oracle feed, wrapped so a long publication gap is tolerated for a bounded period instead of making the asset unpriceable.

3. An on-chain TWAP — a time-weighted average over a canonical pool, for assets with real liquidity but no oracle feed. Guarded by a liquidity floor, a spot-versus-average divergence check and an asymmetric limit on how fast the mark may climb.

4. A manually posted feed — for assets with neither an oracle nor a usable pool. The mark can be moved only by a small increment at a time and by a bounded amount per day, always inside the absolute band, and it goes stale — and therefore unpriceable — if it stops being updated. The asset is never mis-priced, only unpriced. This is the rung self-service listing uses, and the reason it carries the deepest discount floor on the ladder.

5. A composed rate — an exchange-rate feed multiplied by the underlying's USD feed, for wrapped staking assets. Both legs are guarded, and the round is only as fresh as the staler of the two.

6. A fair-value LP mark — for liquidity-pool tokens, a formula that cannot be inflated by pushing the pool, with the INVEST side always marked at the $1.00 backing target rather than at market.

7. A V4 position mark — for the Treasury's own Uniswap V4 positions, held through a position vault. The position's principal is valued at the price the two legs' oracle feeds imply, never at the pool's own price; uncollected fees and anything resting in the vault are not counted at all; and the round is only as fresh as the staler leg. Nothing an attacker can move with capital — a swap, a donation, a neighbouring position — changes the mark, and it never reads the Treasury.

   It also inherits its two legs' own price bands. A leg's sane-price band is fixed into the position feed when the feed is deployed, so an answer the Treasury would refuse for the leg itself cannot be used to price a position built out of that leg either — the position is skipped instead. The same holds for the market-hours pause flag: if either leg is mid corporate action, the position is unpriceable, not priced at a guess. And a read that lands while the vault is mid-transaction is refused outright rather than answered from half-updated state.

A weaker source carries a deeper minimum haircut, so the protocol pays for using one — the manually posted feed deepest at 40%, pool-derived averages next. The V4 position mark carries the same floor as the LP mark and, on top of it, can never be discounted less than either of its legs.

Because those leg settings are fixed into the feed, changing one of them is a redeployment, not a parameter tweak. Re-pointing a leg's oracle feed, or deepening its discount, stops the vault from adding liquidity on the very next attempt; re-tuning a leg's band or its pause flag leaves the position feed enforcing the old one until an answer crosses it, at which point the position is skipped in the treasury mark. Either way the fix is the same: deploy a new position feed carrying the new leg settings and re-approve it. And either way the vault keeps every exit open while it refuses new deposits — which is the safe way round.

Equity feeds go dark outside market hours

Tokenized equities are the largest class in the reserve registry, and their price feeds stop publishing when the underlying market is closed. A weekend gap is longer than any sane heartbeat.

Two things follow, and both are intentional:

• Over a closed market, an equity reserve simply reads stale and is skipped in the treasury mark. Backing understates for the weekend and recovers when the feed resumes. Nothing breaks, and nothing is valued on a guess.
• The last-price wrapper (rung 2) exists precisely for this, and an equity moved onto it stays priced across the gap — at the cost of a deeper haircut, because a gap-down over a closed weekend is absorbed by the discount rather than detected by the feed.

Tokenized equities and ETFs also implement corporate actions on-chain, and expose a flag saying their own oracle is paused while one is being processed. The Treasury probes that flag before pricing them; a paused oracle is treated as "cannot price", never as "price at the last value".

Listing without a vote

warning

The lane is deployed and closed

PostedSelfServiceLane and its reader are live on mainnet and seated with the lister, but no policy is armed, so the lane admits nothing and no asset has ever been listed through it. Arming it is a governance action, and there is no electorate yet. Everything in this section describes what the lane does once armed. See Deployment status.

Most of Robinhood Chain's tokenized stocks have no oracle feed. Under the two lanes above, listing one of them cost two separate governance votes before the operator could even queue the activation — one to authorise who may post the price, one to approve the configuration — and both carry the full timelock delay. Repeated per ticker, that is the bottleneck: the protocol wants to be ready to collect new real-world assets, and a vote per ticker is not ready.

The third lane moves the vote from per asset to per policy. Governance approves a class of assets once. After that, the operator can list any asset that provably belongs to that class, with no further vote.

The proof that replaces the vote

The question a per-ticker vote was really answering is "is this actually the genuine token, or an impersonator wearing its ticker?" — and on Robinhood Chain that question has an on-chain answer.

Every genuine Robinhood stock token is deployed from the same template, so all of them share one byte-identical 283-byte contract body, and the address of the canonical template is baked inside those bytes. A single comparison of that body's hash therefore tells you whether a token is one of them. Every known impersonator — the fake GME, the fake WBTC, the fake cbBTC, the fake weETH, the fake RCAT — has a different body and fails the comparison outright.

That makes the hash a perfect filter for rejecting fakes. It is deliberately not treated as proof of authenticity, and the reason matters: because the template address is baked into the bytes rather than stored, anyone can redeploy the identical body at an address of their own. The copy would pass the hash comparison, run the real token's logic against its own storage, and let its deployer take the minting role and issue as much of it as they like. That is exactly the "mint against nothing" failure this whole page exists to prevent, and no check inside the token can close it, because the copy's deployer controls everything inside the copy.

So eligibility is a conjunction, and both halves are required:

1. the token's contract body hash matches the one governance approved, and
2. Robinhood's own token factory — the contract that issued every genuine stock token, and whose issuance list is the definition of canonical on this chain — names that exact address for the asset identifier the operator supplied.

A copy can satisfy the first. Nothing a copy can do satisfies the second, because an attacker cannot make Robinhood's factory register their address. The asset identifier is therefore a required input to the listing, not a convenience, and the test suite proves the point directly: a byte-identical copy is rejected even when it borrows a real asset's identifier.

What governance approves, and what the operator supplies

Governance's single approval fixes, for every asset the policy will ever cover:

• the contract body hash that makes a token eligible, and the issuance registry that must confirm it;
• the discount — never below the floor for manually posted prices, which is the deepest floor on the ladder;
• the width of the price band, as a percentage either side of the opening mark;
• the staleness bound, the corporate-action pause check, and the number of decimals an eligible token must have;
• how far a posted price may move per post and per day, and the minimum gap between posts;
• who is allowed to post prices;
• how many assets may be listed this way at once.

The operator supplies exactly two things: the opening mark and a text label. Nothing else the operator types reaches the valuation.

Everything else still applies

A self-listed asset is an ordinary approved reserve in every respect. The same validation runs on it as on a governance-vetted one — the denylist, the discount floor, the staleness window, the mandatory price band, and the requirement that the price feed already carry a real opening price. On top of that, this lane is deliberately narrower than governance's own:

• it can only ever create a record, never overwrite, re-point or edit an existing one;
• it refuses the genesis reserve outright;
• it requires both sides of the price band to be armed, where governance may leave the floor open;
• it is capped at a fixed number of live self-listed assets, enforced by the lister itself, above whatever tighter cap the policy sets;
• and it ends in the same announced, cancellable activation as every other listing — the operator, governance or the guardian can cancel it before it takes effect.

The price feed is deployed by the protocol, from fixed code, with governance's timelock as its only administrator and governance's chosen posters already authorised. The operator holds no power over it at any point.

What this actually gives the operator, stated plainly

It is a real increase in what one key can do, and it is worth being precise about it. With the policy armed, the operator can — with no vote — cause a genuine, factory-issued real-world asset to become counted backing, at an opening mark of the operator's choosing. The price band is centred on that mark, so the band cannot catch a mark that was wrong to begin with.

What bounds it:

• The conjunction above. The worst case is a real asset marked too high. It is not possible to list a fabricated token at any price.
• The discount. Manually posted prices carry the deepest floor on the ladder, so a large fraction of any over-mark never counts as backing at all.
• An absolute ceiling on the opening mark, and a cap on how many assets may be listed this way.
• The announced delay, during which the operator, governance or the guardian can cancel.
• The posting limits. Once listed, the mark cannot be walked upward: each post is bounded, each day is bounded, and both are inside the fixed band.

What it explicitly does not give the operator: the discount, the band width, the staleness bound, the pause check, the posting limits, the set of authorised posters, the feed's code, the ability to touch anything already listed, or the ability to list by any other kind of price source. Those remain governance's, per asset, exactly as before.

The lane ships closed. Until governance arms a policy, none of this exists and listing behaves exactly as the first two lanes describe. Closing it again is a single governance action, it takes effect immediately, and it unlists nothing.

The genesis registry

The protocol launches with 43 registered reserves, all priced by first-party oracle feeds with a 24-hour heartbeat and a sane-price band around the live answer:

Class	Count
USDG — the frozen genesis reserve	1
WETH	1
Tokenized equities	29
Tokenized ETFs	6
BTC wrappers	2
Other stablecoins	2
A liquid staking token	1
Another crypto asset	1

Five more rows are registered alongside them. Four are RCAT, WYFI, HIMS and DJT, the stocks the sell walls are paid in. The fifth is AMC, which no wall touches: it is the one name the treasury buys, and it has to be a registered reserve before the keeper's AMC/USDG purchase route can be pinned at all.

None of the five has an independent price feed on this chain, so each is registered against a manually posted price carrying the deepest discounts in the protocol — 40% for HIMS, DJT and AMC, 50% for RCAT and WYFI — and the tightest posting budget. Registering them at launch is what makes a wall's earnings countable from the first block; without them, stock the protocol was genuinely paid would sit in the treasury valued at zero.

All five open holding nothing. A posted row is a place to count stock, not stock itself, and none of these contributes a cent of backing until a wall is bought through or the keeper spends.

These five rows are live now. Stage 1 deployed a PostedPriceFeed for each of RCAT, WYFI, HIMS, DJT and AMC, registered and enabled all five as reserve rows, and started the 24-hour heartbeat that keeps each mark fresh. The feed addresses are in Contracts. Every one of the five rows holds a balance of zero, and will until a wall is bought through or the keeper spends — neither of which can happen before stage 2.

Every address and feed in that registry, plus the assets that are canonical but have no feed yet, is listed in Robinhood Chain facts.

The registry is bounded in size, so that re-marking the treasury is always a bounded operation, and each asset is valued in isolation — one hostile token or broken feed cannot starve the rest of the audit.

Protocol-owned liquidity

Stage 2

The anchor's vault is deployed and its pool is pinned, but it has not been seeded: it holds no INVEST, no USDG and no share, and is worth nothing to the Treasury. The four sell walls, the position vault and the LP-bond path are not deployed at all. What follows is the design.

The INVEST/USDG anchor pool the protocol owns is itself registered as a reserve. The Treasury's full-range Uniswap V4 position in that pool is wrapped as a non-transferable share only the Treasury can hold, and it is that share the registry values and the redemption module bars. The mark is conservative — off the stablecoin leg, with the INVEST leg valued at the $1.00 backing target rather than at market — so it tracks a drain below peg and cannot be inflated by bidding INVEST up. Being excluded from redemption means the protocol's own liquidity cannot be redeemed out from under it.

That is one share, one reserve row and one redemption exclusion. The protocol's other four positions — the one-sided sell walls quoted in RCAT, WYFI, HIMS and DJT — are registered with the Treasury as nothing at all: no share, no price feed, no reserve seat, no exclusion. Their inventory is 24,000 INVEST that appears in no treasury figure. What a wall earns becomes backing, through the stock fee and through the call that banks a filled wall; what a wall holds does not. A redemption basket that names a wall is refused because it is not a reserve, which is a different answer from the anchor share's, and the correct one.

The protocol never counts its own INVEST as backing.

Pairing INVEST against a reserve asset

The same machinery extends past USDG, and it is how the protocol comes to own liquidity in the assets it accumulates rather than only the assets themselves. For any token that is already vetted, enabled and fed, an INVEST/<asset> Uniswap V2 pair can be created and its LP token registered as a reserve in its own right:

Step	Who may call it	What it does
createPair(asset)	anyone	Creates the INVEST/<asset> pair if the factory does not have one. Permissionless and idempotent.
listPair(asset)	the operator	Deploys a fair-LP feed for that pair and registers the LP token as a reserve.

listPair refuses unless the paired asset is already a vetted, enabled reserve with a live feed, and refuses to pair an LP with an LP. The LP inherits the paired asset's feed — its heartbeat, its round data, its pause probe — so an LP can never be better-priced or fresher than the thing inside it.

Three protections are stamped on at listing:

• A haircut floor. The LP takes the greater of the paired asset's own haircut and the fair-LP floor of 20%, so an LP is never discounted less than either its class or its contents.
• A ceiling. maxPrice is set to 4× the fair value measured at listing — the circuit breaker that turns any residual inflation of the mark into a conservative skip instead of phantom reserves.
• A hookless requirement. The paired token must have no transfer callback. A token that could re-enter mid-burn would read stale-high reserves against an already-reduced supply, and inflate the per-LP price.

How an LP is valued

Per whole LP token:

value = min( paired leg , √( INVEST leg at $1.00 × paired leg ) )  ÷  LP supply

Two consequences, both deliberate:

• The INVEST leg is never marked at market. It is the protocol's own liability — unwinding the position returns INVEST, not reserves — so it is valued at the $1.00 backing target and capped by a constant-product term that swaps cannot raise.
• When INVEST trades below target, the mark collapses onto the paired leg — which is the only value the Treasury actually recovers if it unwinds.

The feed also never reads the Treasury. An LP that is itself a reserve, priced off a number that the reserve audit writes, would be a loop anyone could pump for free mint budget; the fixed $1.00 target is what breaks it.

How the protocol comes to own it

Two ways, and the accumulator is neither of them — it only ever swaps.

LP bonds — INVEST paired against a reserve, bought with future supply. Once an INVEST/<asset> LP token is a registered reserve it can quote a bond market like any other reserve: liquidity providers hand over LP tokens and receive vesting INVEST at a discount, and that liquidity becomes the protocol's permanently. The trade is explicit. The protocol pays in future supply, at a discount it sets, for a position that pairs its own token against an asset it has chosen to be long — and it marks that position at the paired leg only, so the liquidity has to be worth owning on the reserve side alone. No reserves are spent.

The V4 position vault — the Treasury's own reserves, in a pool it chooses. For a pair of assets the Treasury already holds as reserves, governance can install a position vault: a contract that owns a bounded, concentrated Uniswap V4 position in one pinned pool with no hooks, funded from the Treasury's own balances. It is the treasury's liquidity desk for pools other than the protocol's own market — that position is seeded once and grown only by decree, through the one contract the pool vault accepts liquidity from — and it is boxed in on every side:

• Bounded by policy. Governance sets, per vault, how much value one deposit may move, how much a rolling day may move, how far the pool may sit from the oracle before a deposit is refused, and how much a deposit may lose to entering at the pool's price rather than the oracle's. An operator acts inside those bounds and cannot widen them.
• An atomic round trip. A deposit pulls the two legs out of the Treasury through the same rate-limited rotation seat the accumulator uses, adds them to the position, and returns every unit that did not go into the pool to the Treasury in the same transaction. Nothing rests in the vault between transactions; a stray balance can be swept to the Treasury by anyone.
• A share that is valued, never paid out. The vault mints the Treasury a non-transferable share for what the position is worth, and that share is a reserve like any other — vetted, discounted, banded. Its mark is the position's principal at the price the two legs' oracle feeds imply, never at spot: swaps, donations and neighbouring liquidity cannot move it, and it is a lower bound on what unwinding would actually return. Uncollected fees are not marked; a keeper collects them to the Treasury, where they count as plain reserves.
• A deposit can only ever mark backing down. A position is never allowed to be counted at a softer discount than the assets inside it, and the vault re-proves that on every single deposit — not once, at approval time. If governance later deepens a leg's discount, or moves a leg onto a different oracle feed than the one the position feed reads, the next deposit is refused rather than allowed to book value that is not there. Approval alone was not enough: it proved the configuration good at one instant, and the whole point of the check is what happens after that instant.
• An exit that needs no oracle. Unwinding the whole position back into the Treasury, and the guardian's park, read no price feed at all — they work with every leg feed dead and the pool arbitrarily skewed. Fee collection is the same. So when a deposit is refused, nothing is trapped: the vault stops taking new reserves in and keeps every way of getting them out.
• A guardian freeze that a rotation cannot quietly undo. The guardian can pause the vault and freeze whoever holds the operator seat. Nominating a replacement does not lift that freeze — only the incoming operator actually taking the seat does. A recovery decree can therefore never hand the frozen operator a window to act before their successor arrives.

Both paths end in the same place: liquidity the protocol owns, marked conservatively, counted as backing only after a discount. The difference is what is spent — future supply in the first, a bounded slice of existing reserves in the second.

What the vault deliberately does not do is cap how much of the treasury may sit in positions at once. The per-deposit and per-day limits, and the treasury's own daily limit on how much of any one asset may be moved, are the bounds; there is no separate ceiling on the vaulted fraction of backing. That is a governance judgement, made per vault when the policy is set, rather than a constant in the code.