Glossary

Every definition here describes on-chain behaviour. Where a term has a precise meaning in the contracts, the contract is named.

Defined, not necessarily deployed

These definitions describe the protocol as designed. Many of the contracts named below are stage 2 and are not on chain yet — the sell walls, the fee collector, the accumulation desk, the oracles and the position vaults among them — and the figures given for launch are the launch sizing, not today's balances. Today INVEST supply is zero and the Treasury holds nothing. See Deployment status for what actually exists.

Tokens and units

INVEST — the native token. 9 decimals, ERC-20 name "Investors Center". Minted only by the Treasury against excess reserves. A plain ERC-20: no transfer hook, no exemptions, every transfer moves exactly what was sent.

SHARES — staked INVEST. 9 decimals, rebasing (sOHM mechanics): the balance grows each epoch.

gINVEST — Governance INVEST. 18 decimals, non-rebasing (gOHM mechanics), ERC20Votes on a timestamp clock. The only voting token; bond payouts vest as gINVEST notes.

USDG — Global Dollar, issued by Paxos, native to Robinhood Chain. 6 decimals. The anchor POL pool's quote asset and the frozen genesis reserve.

RCAT / WYFI / HIMS / DJT — the quote assets of the four one-sided POL sell walls; all genuine 18-decimal Robinhood stock tokens. None has a Chainlink feed on chain 4663, so all four are priced by a PostedPriceFeed whose poster is a hot operator key, not the Timelock: a 24-hour heartbeat cannot be met by a governance round-trip that takes 78 hours. What bounds that key is arithmetic rather than permission — a capped move per post, a capped move per rolling day, and a hard band around the opening mark, outside which the feed fails closed. See Posted feed and Opening gap.

AMC — the fifth posted row, registered at launch alongside the four wall quotes and priced the same way. It is not a wall quote: nothing sells INVEST into it. It is the one name the treasury is listed to buy, through an accumulator AMC/USDG route — which is why it must be an enabled reserve before that route can exist at all. The route is not pinned at genesis: the deploy pins none, so the accumulator launches on its constructor basket (USDG only) and the AMC lane waits on one post-launch setRoute decree. Discount 40%.

9-decimal USD — the Treasury's unit of account: 1e9 == $1.00.

bps — basis points, out of 10_000. Note that the Uniswap V4 LP fee unit is different: 1e6 == 100%, so bps = fee / 100.

Backing and the Treasury

Backing target — 1 INVEST = $1 of Treasury value.

totalReserves — the marked, haircut-adjusted USD value of everything the Treasury holds.

excessReserves() — totalReserves − baseSupply(), saturating at zero. One INVEST is mintable per $1 of excess. It is the gate on both bond mints and staking emissions.

Haircut (haircutBps) — a per-asset, downward-only discount applied before an asset counts as backing. Maximum 5,000 bps. Class values at genesis: stables 200 (USDG itself 0), WETH 1,000, BTC wrappers 1,000, LST 1,500, RWA 2,000, alt 2,500.

Price band — a per-asset hard floor and ceiling on what a feed may report, in the feed's own units. An answer outside it is refused, so the asset counts as zero rather than as phantom reserves. Mandatory for every price source that is not a first-party oracle feed, because a haircut is a downward-only discount and cannot cover an upward overshoot.

Heartbeat — the maximum age a feed answer may have, in [1 h, 48 h]. Genesis reserves use 24 h.

Pause probe — for tokenized equities and ETFs, the Treasury asks the token whether its own oracle is paused before pricing it. A paused oracle, a reverting probe or malformed data all mean "cannot price" — never "price at the last value".

Reserve audit — the permissionless re-mark of the whole treasury. A stale or reverting feed makes that asset count as zero rather than as something optimistic.

Registry ceiling — 64 enabled reserves, so re-marking the whole treasury is always a bounded operation.

Treasury statuses — the permission ordinals, frozen: RESERVEDEPOSITOR 0, RESERVESPENDER 1, RESERVETOKEN 2, RESERVEMANAGER 3, REWARDMANAGER 4, STOKEN 5, REDEEMER 6 (frozen), RESERVEROTATOR 7.

Manage limit — the rate limit on a role that can move reserves out of the Treasury: cumulative managed value is capped at a quarter of that asset's own value over any rolling week.

Rotation limit — the separate rate limit that bounds reserve rotation, used instead of the manage limit because a rotation is value-neutral inside its own transaction. It caps a fraction of a token's raw holdings per rolling day, so an inflated feed on an unrelated reserve can never authorise rotating a real one away.

Mark loss — the marked value a rotation costs the Treasury: what it gave up, less what it got back, both after haircuts. Rotating a lightly discounted asset into a heavily discounted one books a loss even at a perfect fill, and a daily ceiling bounds how much of that the protocol will absorb.

Staking

Epoch — the emission interval. Genesis 8 hours on mainnet; governor-tunable within [10 min, 24 h], applied at the next roll with the Distributor's rates rescaled.

Rebase — the per-epoch distribution. It mints the smaller of the configured emission and the available excess reserves, and it never fails when excess is zero.

Warm-up position — a stake made while warmupPeriod > 0. It matures warmupPeriod epochs later (expiryEpoch = epoch.number + warmupPeriod), rebases while it warms, and can be forfeited at any time for the INVEST deposit back. Up to 64 per account; the warm-up may not exceed 30 epochs.

Warm-up exempt — an account whose stake(…, claim = true) bypasses the warm-up. The bond depository is exempt at genesis; setWarmupLength refuses a non-zero warm-up if no exempt staker exists.

ppm — parts per million of supply, per epoch, for the Distributor's reward rate. Genesis 2,000; PolicyGuard cap 5,000; governor cap 20,000.

Bonds

Bond market — sells INVEST for a registered reserve quote token at a price that decays toward the PolicyGuard floor. A discount to the market rate is an outcome, not a property: at genesis the floor binds at roughly 3.2x the launch price, so the one market stage 2 creates is inert from the day it opens. No bond market exists today — BondDepository has none. Payouts vest as gINVEST notes.

CLIFF — the audited default vest mode: all-or-nothing at maturity.

LINEAR — a fixed gINVEST payout streamed per second over [created, matured], with idempotent partial redeems.

Absolute price floor — the hard USD minimum a bond may sell INVEST at, regardless of backing. $0.90 at mainnet genesis. Set once at deployment and lowering-only thereafter — nothing can raise it.

Price floor — the greater of 1.1× treasury backing and the absolute price floor, stamped into a bond market when it opens and fixed for that market's whole life.

Price band — an optional clamp of every market's price to a range around an INVEST/USD reference feed (BondDepository.setPriceBand). Not armed at genesis.

PolicyGuard — the operator fast-path that holds the authority policy role. It enforces the capacity caps (baseSupply/10 per market, baseSupply/4 in aggregate) and recomputes the floor when a market opens.

The pool fee and the flywheel

Pool fee — the protocol's revenue: the 5.00% static LP fee of each Treasury-owned Uniswap V4 POL pool (50,000 pips, in the V4 fee unit). V4 charges a pool's fee on the input currency of a swap, so a buy accrues that pool's quote and a sell accrues INVEST, and the fee is paid in both directions. It is immutable because it is part of a pool's identity, not a setting: a pool with a different fee is a different pool. It is also venue-local — anyone may open a cheaper INVEST pool or add liquidity to one of these, and no lever exists that could bring another venue into the fee.

The POL — protocol-owned liquidity in the narrow sense of the genesis markets: five Uniswap V4 positions in five pinned, hookless pools, holding the whole 60,000-INVEST supply. At stage 1 only the anchor's vault is deployed, and it holds nothing; the four walls do not exist. They are two different things and must not be added together:

• the anchor (PolVault, one instance) — a two-sided full-range INVEST/USDG position, 60% of supply (36,000 INVEST) against the whole $10,000 seed, wrapped as a non-transferable 18-decimal share the Treasury holds 100% of, marked by its PolPositionFeed as min(vQuote, sqrt(vINVEST@$1 · vQuote)) and excluded from redemption. It opens at about $0.2778 per INVEST;
• the four sell walls (PolLadder, four instances) — one-sided INVEST positions quoted in RCAT, WYFI, HIMS and DJT, 10% of supply each, taking no quote leg and therefore costing nothing to seed, offered from a wall at about $0.8333 (a $50,000 market cap, 3× the open) upward. A wall has no share, no feed, no reserve seat and no redemption slot: it is registered as nothing.

The protocol never counts its own INVEST as backing, so the 24,000 INVEST of wall inventory is in no treasury figure. Each position is seeded once and none is ever bought into on the open market — fee proceeds are never reinvested into any of them. The anchor can still be grown, by decree, out of reserves the Treasury already holds (see PolMigrator); a wall cannot, and only re-sets itself higher when it is realised. Liquidity the protocol comes to own elsewhere arrives by LP bond or through a V4 position vault.

Superseded 2026-09-07: three full-range positions — INVEST/USDG at 50% of a ~$30,000 seed, INVEST/AMC at 30% and INVEST/WYFI at 20% — each with its own share, each seeded at $1.00 of INVEST, all three excluded from redemption. Under the current shape AMC is no longer a POL leg; it remains a registered reserve, bought by the keeper rather than held as liquidity.

Anchor — the INVEST/USDG venue, and the one everything defers to. It is the only pool INVEST fee legs are ever sold into, the only median the bond price band and the app's INVEST price read, and the only pool whose quote can be the collector's default. A stock-quoted pool can never be the anchor: pricing anything off a pool whose quote the protocol itself publishes would let a typed number decide how cheaply bonds mint INVEST.

Venue registry — the TaxCollector's list of POL legs. Governance adds, retires and re-oracles them and names the anchor; ids are permanent (retiring a venue deactivates it in place and never renumbers the others). Capped at 8.

In-kind routing — the RCAT, WYFI, HIMS and DJT fee legs are never sold. They go to the Treasury by plain transfer plus a re-audit — never a deposit, which would mint INVEST against pure backing — less the decaying team share, which is taken in kind as well. They are already the assets the accumulator would otherwise buy, delivered at zero slippage.

realise() — the permissionless call that banks a filled sell wall. collect() takes fees only; a wall's proceeds are position principal and reach the Treasury only here. It burns the position, re-mints it one-sided above a new, higher wall, and transfers the stock to the Treasury in that order, so nothing can move the pool in between. At least 30 minutes apart, and keyed off the anchor's median composed with the stock's own registered feed — never the wall's own pool price, which a dust swap on an emptied pool can push anywhere for free. Re-walling is not bookkeeping: a partly-sold wall is a two-sided market someone could sell INVEST back into to buy back the stock the protocol just earned. Nothing on-chain guarantees it is called.

PolVault — the contract that owns the anchor position. One instance. It pins that pool's key, initialises it at its own supplied opening price on deployment (never $1:$1 — total supply is an explicit input and the opening price falls out of it as seed / anchor INVEST), seeds it once, and exposes a permissionless collect() that sends both fee legs straight to the collector. removeAll() — the Timelock's break-glass — is the only way the position comes back. One whole share is one whole quote token, not $1.00 — but the only quote is USDG, so the share does mark at exactly $1.00.

PolLadder — the contract that owns ONE sell wall. Four instances. It pins its pool's key at tick spacing 2,048 (the anchor's 32,767 would round a wall to several times its target or down to the launch price), opens it at the anchor's INVEST price expressed through that stock's posted mark, and refuses any opening price not strictly on the INVEST-only side of the wall. seed(amount) takes one argument — there is no quote leg and no balance to pre-fund. It has no share, no addLiquidity, no depositor and no mark. collect() takes its fee; realise() banks its principal.

PolMigrator — the one address the anchor PolVault accepts liquidity from. One instance, and only by Boardroom decree. Two lanes, both spending reserves the Treasury already holds: migrateV2 burns a Treasury-held Uniswap V2 INVEST/USDG LP and adds its two legs to the V4 position; deepen pairs Treasury USDG with INVEST minted at the pool's live price. deepen is bounded four ways — the rotator bucket on the quote pull, the Treasury's excess-reserves gate on the mint, a price floor the proposal names (the lowest INVEST price it will mint at, quoted in the pool's own token, not in dollars — so the opening figure is ~0.277778e18, and a proposal copying the retired 1e18 parity number sets a floor 3.6× above the pool and reverts), and a hard cap on the INVEST minted. Leftover quote returns to the Treasury as backing; leftover INVEST is burned. It holds nothing between transactions. No sell wall has a migrator, or can have one: there is no share to mint pro-rata and no quote leg to pair. Note also that deepen mints nothing while excess reserves are zero, which is the state at launch.

Depositor — an address PolVault.setDepositor has approved to call addLiquidity. Genesis approves exactly one, the PolMigrator. Shares minted by an add are pro-rata by liquidity, so the per-share mark does not move when the position grows. A PolLadder has no addLiquidity and no depositor at all.

Share transfer rule — a PolVault share can only move toward the Treasury: mint, burn, or a transfer whose destination is the Treasury. Nothing can move one away from it, so the Treasury can never pay it out and no secondary market can exist. It is also why the anchor share occupies the one used slot of the RedemptionModule's three: a share left out passes the reserve check, computes a payout, and then fails obscurely inside the transfer rather than being refused by name. A sell wall needs no slot — it is never a reserve, so a redemption basket naming one is refused for a different and correct reason, and slots 1 and 2 stay empty. And it is why there is no bond quoted in a share: a share is marked off its non-INVEST leg alone, so a two-sided contributor would be credited for roughly half of what they handed over.

TaxCollector — the pool-fee collector, and the venue registry of the pools it collects from (the identifier is kept from the NetNet port; it collects no tax). One permissionless call cranks all five positions, skipping a dead one rather than failing — and a dormant sell wall cranks cleanly for zero fees, which is the normal result at launch rather than a skip. The sell-side legs arrive as INVEST from every pool and are converted — into the anchor only, a wall being refused by name because it holds no cash; the buy-side legs arrive as USDG (straight to the split) or as RCAT / WYFI / HIMS / DJT (straight to the Treasury, in kind, less the team's in-kind share). Converting is permissionless, and a caller can only tighten the price bounds, never loosen them. collect() takes fees only — a filled wall's principal moves through realise().

Clip limit — a single conversion may sell at most 50 bps of the selling pool's INVEST leg, so one conversion moves that pool by roughly 50 bps at most.

Median floor — a conversion must fill within 100 bps of the PairOracle median, computed after the pool's own live swap fee has been netted out of the expected fill. Spot is never used, and the oracle is fail-closed: no valid window, no conversion.

Sampled median — the price construction PairOracle uses. A hookless Uniswap V4 pool keeps no cumulative price, so there is no time-weighted average to read; instead sixteen observations of the pool price are recorded at most every 30 minutes and the answer is the median of those aged [30 min, 4 h]. One poisoned sample cannot move a median, and moving a majority of them means a round trip per sample, each paying the pool's 5% fee twice into the Treasury's own liquidity — so a skew-then-convert attack costs roughly ten times what the capped conversion can take. The realistic failure mode is liveness, not extraction.

PairOracle — the 16-slot observation ring over ONE POL pool that produces the sampled median. 30-minute checkpoint spacing, a valid read window of [30 min, 4 h], and permissionless to sample. There is one per pool — five in all. Its answer is that pool's own quote per INVEST, not dollars — at the $0.2778 open a wall venue would read roughly 0.0308 RCAT or 0.0109 WYFI per INVEST — so comparing two venues means translating both through their quotes' price feeds first. A wall's oracle is dormant, not broken, while its pool is out of range: there is nothing to sample and its median has no answer. That is the state of all four at launch, by construction.

Anchor-deviation gate — the fail-closed check that a conversion through any non-anchor venue must sit within a governed band of the anchor's price, both translated to dollars first. It exists so an isolated pool that drifted cannot be sold into forever on the strength of its own drifted median. Honest caveat: as the system stands today every INVEST/USDG pool is the same pool, so no real second stablecoin venue can deviate — the gate is insurance for a future venue shape rather than a check that binds now.

Opening gap — the amount by which the protocol is under-backed at launch by construction. Counted backing at t0 is the anchor share alone: $10,000 of USDG at a 1,000-bps haircut, i.e. $9,000 against a 60,000-INVEST supply — $0.1500 each, a $51,000 / 85.00% gap. Excess reserves are exactly zero, so every rebase pays zero, the genesis bond market is created but inert at 3.24× the launch price, and PolMigrator.deepen mints nothing, until realised stock closes the gap. The identity, exactly: 60,000 = 9,000 reserves + 26,000 anchor parity gap + 1,000 share haircut + 24,000 wall inventory. Closing it through the fee lane alone would take about $5,100,000 of volume at the launch team split or $1,020,000 vested; the larger channel is realise(), which delivers about $20,000 of stock across the four legs over the first 4× above the wall. As of stage 1 none of this has happened: supply is 0 and counted backing is $0, because the seed has not been paid in — see Deployment status.

Superseded 2026-09-07: "three POL shares carry haircuts of 1,000 / 4,000 / 5,000 bps, so $30,000 of seeded liquidity counts as $21,900 against 30,000 INVEST — $0.7300 each, a 27.0% gap … the mitigations are the Timelock poster, a share sanity band tightened from 4× to ~1.5×, and each share carrying at least its own quote's haircut." The poster was never the Timelock in the code, the one share's band is back to 4×, and no protocol-owned position is marked off a posted price at all.

Team share — the team's slice of the 500 bps pool fee, taken in kind as well as in USDG. It starts at 400 bps and decays linearly to zero over the 30 days from the anchor pool's seed; the treasury's slice rises correspondingly to the full 500 bps. Stated plainly: at t0 that is 80% of the fee flow going to the team while backing is 85% short. Its expected in-kind cost at the launch sizing is nevertheless zero, because the walls open 3× above the launch price and the vest reaches zero before they can fill.

LP listing (createPair / listPair) — registering an INVEST/<asset> V2 LP token as a reserve in its own right, valued by a UniV2FairLpFeed. createPair is permissionless; listPair is the operator's, and requires the paired asset to be an already-vetted, enabled, fed reserve that is not itself an LP. The LP inherits that asset's feed, takes max(its haircut, 20%), and is capped at 4× its fair value at listing.

LP bond — a bond market whose quote token is a listed LP token: the protocol sells discounted, vesting INVEST for liquidity rather than for tokens. One of two ways the protocol acquires liquidity, and the one that spends no reserves; the other is the V4 position vault. An INVEST/USDG LP bonded in this way can afterwards be moved into the protocol's own V4 position by a PolMigrator.migrateV2 decree.

V4 position vault (V4PositionVault) — the Treasury's liquidity desk for pools other than its own market (the protocol-owned INVEST/USDG position is grown by PolMigrator instead). It owns up to four concentrated positions in one pinned, hookless Uniswap V4 pool, funded from the Treasury's own reserves as a RESERVEROTATOR under a governor policy (per-deposit and rolling-daily caps, a spot-versus-oracle gate, a loss gate). Every deposit returns whatever did not enter the pool to the Treasury in the same transaction; the Treasury holds the result as a non-transferable share that is valued in backing, never paid out — every transfer that is not a mint or a burn reverts, so the only way value leaves is back to the Treasury through the vault's own unwind, park or fee collection, none of which need an oracle. Every deposit also re-proves that the share is still discounted at least as deeply as either of its legs and still priced off the oracle feeds governance approved; if that has drifted, the deposit is refused while every exit stays open. A guardian freeze on the operator seat is lifted only when the incoming operator takes the seat — nominating a successor does not thaw the incumbent.

V4PositionFeed — the feed that marks one vault share: the positions' principal at the price the two legs' oracle feeds imply, never at the pool's own price; uncollected fees and vault balances are not counted; the round is the staler leg's. It carries each leg's own sane-price band and market-hours pause flag, so an answer the Treasury would refuse for the leg cannot price the share either. It never reads the Treasury, and it refuses to answer while the vault is mid-transaction. Its leg settings are fixed at deployment: changing one on a leg means deploying and re-approving a new feed.

V4PositionValuer — the vault's view-only arithmetic sidecar, deployed by the vault's own constructor: the oracle reads, the sizing of a deposit at the pool's price, and the valuation at the oracle-implied price. It holds nothing and decides nothing — every number it returns is re-checked against policy in the vault.

FeeAllocator — the accumulation desk. The treasury share of every pool-fee distribution lands here rather than going straight to the accumulator, and its permissionless distribute() splits what it holds across the approved destinations by weight (rounding dust to the accumulator). Three parties, deliberately unequal: governance approves each destination one at a time and sets the floor; the operator sets the weights inside those bounds, any time; anyone may trigger the split, because a fixed-weight split is harmless to run. At launch there is exactly one destination — reserve accumulation at 100% — so the desk is a pass-through until a vote changes it.

Accumulator floor (minAccumulatorBps) — the minimum weight reserve accumulation may be given, 5,000 bps (50%) at launch and governor-only. It is what bounds the operator's fast lane: however the mix is re-weighted, at least half of the treasury share still buys reserves. Raising it binds the next time the mix is set, not retroactively.

Sink — an approved destination for allocated fee revenue. Up to 8, each approved by a separate governance decree. Approval and weight are separate facts: revoking a sink does not move funds or re-weight anything, so a revoked sink keeps being paid until the mix is re-set without it.

Trusted reserve holder — an address the Treasury counts as holding backing on its behalf, so its balances are valued into totalReserves even though the Treasury cannot move them. The FeeAllocator is one from genesis; LockLottery is registered as one when it is installed. It is a real trust extension, bounded two ways: at most 8 such addresses, and their counted contribution is capped at 25% of all backing (externalReserveCapBps) — anything above the cap is simply not counted. In-flight backing is not spendable: the redemption backstop pays only from what the Treasury custodies, which is why every surface must show the custodied / in-flight split rather than one total.

LockLottery — the loss-less draw. Lock gINVEST for [1 week, 1 year]; the weight is amount × multiplier, the multiplier being 1.0× for the first week plus 25% per further week, capped at 4.0× (so the cap binds at 13 weeks). Once a day five distinct addresses are drawn with chance proportional to their share of total locked weight and split the pot equally; winners claim (pull), so one address that cannot receive a transfer never blocks the other four. Principal is never at risk: gINVEST leaves the contract only as withdraw back to its own locker, and the admin's sweep refuses gINVEST unconditionally and refuses any prize a winner is still owed. Locks, extensions and withdrawals freeze while a draw awaits its randomness — at most an hour, after which anyone may cancel it — and claims never freeze. Funded by the FeeAllocator, added after genesis, and played in a separate games app.

Locked-gINVEST quorum effect — the honest cost of locking. gINVEST's quorum-exclusion set was fixed when the token was deployed, so a later LockLottery cannot be in it: locked gINVEST stays in the quorum base while the lottery never votes with it. A locker gives up their vote for the term of the lock, and every locked token raises the bar a proposal must clear without adding a vote that could clear it. No code fix exists short of redeploying the governance token; the levers are the quorum floor and the quorum percentage, and using either to offset the draw is a Boardroom decision.

ReserveAccumulator — turns the accumulation share of the pool fee into a governed basket of reserves, and runs rotation orders.

Basket — up to 8 unique assets with weights summing to 10,000. Operator-set; every non-USDG asset needs an allowed route.

Route — a governor-pinned Uniswap V4 path (1 or 2 hops) for one tokenIn → tokenOut pair, with a maximum deviation band, a per-fill cap and a rolling 24-hour cap. Hookless unless allowHooked.

Rotation order — an instruction to sell one existing reserve for another: immediately, as a dollar-cost average, or spread over time. It pulls the input out of the Treasury and returns the proceeds and any unspent input in the same transaction.

Skipped leg — a purchase or rotation slice that could not meet its price floor. It is skipped rather than forced: nothing is bought, nothing is lost, and the input returns to the Treasury or waits for the next cycle.

Governance

The Boardroom — the governing body: ICGovernor plus the TimelockController.

Timelock — the TimelockController that is authority.governor(). It calls every onlyGovernor function directly. There is no relay contract.

Quorum floor — the absolute gINVEST quorum minimum, GenesisQuorum.floorFor(polInvest) = polInvest × 1e9 / 10. Quorum is max(circulating × quorumBps / 1e4, quorumFloor).

Quorum exclusion set — the protocol-held addresses removed from the supply quorum is measured against: the Treasury, Staking, the bond depository, the redemption module and the Timelock. Fixed in the gINVEST constructor.

Parameter guardian — a seat that may only lower the quorum floor, quorum bps and proposal threshold. An escape valve, not a capture power.

Guardian — the Investors Center Safe. It can veto a queued proposal, revoke most Treasury roles, pause the game house, park the accumulator into stablecoins, and cancel pending reserve activations and rotation orders. It can stop things; it cannot enact them.

Operator — a two-step (push, then pull) seat on the accumulator and the lister. It authors baskets, rotation orders and reserve activations, but decides no valuation — governance does. The one exception is the opening mark of a self-service listing (lane 3), and only while governance has that lane armed.

Listing

ReserveLister — a scoped Treasury delegate. It may install or replace a price feed and enable/disable RESERVETOKENs, and nothing else. It is not the governor.

Vetting (lane 1) — the governance decision that records the exact configuration the Treasury may ever hold for a token: its feed, its heartbeat, its haircut and its price band.

Activation (lane 2) — the operator queues an activation; after an announced delay (1 hour at genesis) anyone may execute it, which installs the vetted configuration verbatim. It can be cancelled during the delay by the operator, governance or the guardian.

Self-service listing (lane 3) — PostedSelfServiceLane. Governance approves a policy once, covering a whole class of assets; the operator may then list any asset that provably belongs to that class with no further vote, supplying only an opening mark and a label. The record it writes is an ordinary vetted record and passes the identical validation, and the activation at the end is the same announced, cancellable one. The lane is switched off until governance arms it, and closing it again is one governance action.

Eligibility conjunction — the on-chain proof that replaces a per-asset vote in lane 3. A token qualifies only if both its contract body hash matches the one the policy names — every genuine Robinhood stock token shares one 283-byte body, and every known impersonator differs — and Robinhood's own token factory names that exact address for the asset identifier supplied. The hash alone is a perfect filter for rejecting fakes but is not proof of authenticity: the body can be redeployed verbatim by anyone. Only the factory's issuance record cannot be forged.

Listing policy — what governance approves in lane 3, once, for every asset it will cover: the eligible contract body hash and issuance registry, the haircut, the price-band width, the staleness bound, the pause check, the token's decimals, the posting limits, the authorised posters, and how many assets may be self-listed at once.

Self-listed cap — a hard ceiling of 8 live self-listed reserves, enforced by the lister itself above whatever tighter cap the policy sets. A slot is freed only when governance drops the record, not when the reserve is switched off. It is a count rather than a share of backing on purpose: a share cap cannot be kept true after listing with the accounting the Treasury has, and one that binds only at listing time would read as a guarantee it is not.

Vetting invariant — every enabled reserve's live configuration equals the configuration governance vetted for it, field by field.

FeedKind — the adapter ladder: CHAINLINK 0, LASTPRICE 1, V2TWAP 2, POSTED 3, FAIRLP 4, RATECOMPOSED 5, V4POSITION 6. The list is append-only and never reordered. Each carries a minimum haircut floor; a V4POSITION entry must also carry an armed price ceiling, a haircut no smaller than either of its legs', a staleness bound no looser than the staler leg's, no pause probe on the share itself, and leg settings — oracle feed, pause flag, price band — that match what the Treasury holds for those legs, checked field by field before the entry is recorded.

Posted feed — PostedPriceFeed, the last rung of the ladder, for assets with neither an oracle feed nor a usable pool. The mark can only be moved in bounded increments and by a bounded amount per day, always inside an absolute band, and it goes stale — and therefore unpriceable — if it stops being updated.

Denylist — setDenied, the impersonator list. A denied address can never be vetted or installed, through any lane.

Games

GameHouse — the bankroll vault, a BeaconProxy. Draws from the Treasury as a RESERVEMANAGER inside an admin-set riskBudgetBps.

Rake — the DAO's entire edge. ceilDiv(wager × rakeBps, 10_000), pushed to the Treasury. Bounded to [10, 1_000] bps; a zero-edge house is never valid.

Fair odds — payouts are priced on the rake-net stake, so bankroll EV is exactly 0 and player EV is exactly −rake.

Stale void — anyone may void a game round three days after it opened, charging the rake it snapshotted and refunding the rest. A withheld randomness result is not a free option.

Loss-less draw — LockLottery, the one game with no house, no wager and no edge: the protocol funds the prizes from its own fee revenue and a deposit is never at stake. Definition above, under the pool fee and the flywheel.

Chain

Robinhood Chain — an Arbitrum Orbit L2 settling to Ethereum. Chain ID 4663 (mainnet only).

Orbit block.number — an estimate of the L1 block number, not the L2 one. It is banned in these contracts; all timing uses block.timestamp.

ERC-8056 — the scaled-UI-amount extension the Robinhood stock tokens implement. A corporate action changes uiMultiplier() while raw balances stay static. The Chainlink feed price already includes the multiplier — never re-apply it.

Sequencer uptime feed — the Chainlink L2 liveness gate. None is published for Robinhood Chain, so the gate is left unset and off.