Token name: The Vault. Token symbol: VAULT.
Build the COMPLETE immutable multi-asset competition below on Robinhood Chain. Use
Playground's selected standard coin, ETH pairing and launch allocation; do not customize
token supply, transfers or allocation. No protocol admin, upgrade, proxy, delegatecall,
rescue, arbitrary router, borrowing, price oracle, signer or developer keeper. No
treasury redemption right. Block deployment on unresolved critical/high findings or
unmet gates.
PLATFORM: Existing platform/requester revenue uses Playground's launch revenue receiver
and distribution contracts; do not charge/split that revenue again. Preserve user
deposits/rewards. Complete required recipient setup before public use; no ongoing
operator dependency. The separate 25bp protocol levy below needs EXPLICIT platform
approval: it funds Commons/ops/bank, not creator revenue. If mandatory receiver rules
capture it, STOP before deployment; do not redirect it or silently change the economics.
FEE: Assume ZERO Vault entitlement to platform revenue. Only if approved, levy
additional25bp GROSS-ETH to immutableEngine.
D=10000,r=25,tax(g)=floor(gr/D),up(n)=floor(nr/(D-r)). beforeSwap specified+tax(G) for
exactETH-input G; specified+up(N) for exactnetETH-output N; otherwise0. afterSwap
requires rawETH=-(G-tax(G)) or +(N+up(N)) on those specified paths; reject partials. On
unspecifiedETH-input P charge up(P); unspecifiedETH-output P charge tax(P). Explicitly
mint nativeETH ERC6909claims; return positivefee ONLY for unspecified paths. Check
signs/int128/overflow. No LPoverride,hook routing,feeds,crew loops or native transfers
in swaps. Authenticate manager and EXACTPoolId; one authorizedfactory initialization
binds actualtoken/fullkey; manager-only orfirst-caller binding unsafe. Sweep
operation-bound unlock,burn ownclaimid0,takeETH,credit actualEngine receipt once outside
swaps. No WETH.
CUSTODY: Commons nativeETHsink has NO outgoing/approval/collateral/upgrade path.
Separate sleeveETH,ops,matchingbank,bid refunds,fundedcrew/work
claims,surplus,retiredcash/inventory. Separate VAULTescrow,neverinvested/approved.
Actual netfee f splits floor80%Commons,floor10%ops,EXACTremainder bank. Record
cumulative buckets. Direct/forced donations/claims neveralpha orlockcredit.
Claimreceivables aren'tcash. Exclude all user liabilities from protocol-ownedETH. Native
payouts pull-only,CEI/nonReentrant; failed recipient cannot block others.
ENTRY:16active licenses,max4rounds,immutablecontroller. Applicant NONREFUNDABLY sponsors
.005ETHtrial+.001ETHops: protocolproperty,NOTrefundabledeposit. Reject whenfull. Trial
C+=g,B+=g; ops notalpha. NO free fee-fundedtrial. Controller commits>=1000VAULT; backing
never increases authority. Renewal requires maturecontroller receipt and previous
positive completedcash result BEFOREprofitwithdrawal. No
perpetualseat/historyinheritance. Commit retirement cleanup even when no eligible crew
remains; no empty-round bounty.
ROUNDS:35days; firstT=authorizedlaunch+14days. Jobs/stakereceipts commit byT-7days.
Buybids[0,1d),execute[1d,2d);holduntil30d;sellbids[30d,34d),execute[34d,35d);cancel at
executionexpiry. Hardclock,no backdating.
Menu:nativeETH,USDG0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168(6dec),SPY0x117cc2133c37B72
1F49dE2A7a74833232B3B4C0C(18dec); VERIFY implementations/semantics beforedeploy. No
listings/selfVAULT. Weights10000bp,min10%ETH,SPYentryspend<=35%; costweights notliveNAV.
Positive rational rawtoken/wei buy and wei/rawtoken sell minima, ceil mulDiv; crew
choices NOTfairprice guarantees.
EXECUTION:whole-lot fully escrowed competitivequotes; highest actualconsideration
meeting committedreserve wins. Exact measured tokens,atomic exchange orrevert. No
arbitraryapproval/callback. Bidder funds aren'tprofit beforeexecution. Refunds
independentlyclaimable. At expiry cancellation withoutcallingfailedERC20
returnsETHtoORIGINALledger. No quote=>no fill; no floorrelaxation/two-bidder
independencefiction. Resolvealllots beforeglobalsettlement. Unsoldtokens
permanentlyquarantined with rawquantity/basis; NOrescue/recoveryauction. Failedtoken
cannot blocknativebookkeeping/VAULTexit.
CASHLOCK: sleeveC=actualETH,B=cumulativeNEW
assignedcapital(notrollover),P=fundedcrewrewards,S=surplusactuallylockedCommons,G=lifeti
mebankmatches,H=watermark. F=C+P+S-B; noncashzero ONLYforcashpayoutbound,notNAV. Retire
ALL cash/basis/counters/losses intohistory. Freeze ALL active+retired results first.
d_i=max(F_i-H_i,0),dg=max(sumALLF-Hg,0),X=min(dg,sumeligible d).
e_i=min(C_i,floor(X*d_i/sum d)); zero denominator/staketotal=>e0. r=floor(e/5),s=e-r.
DebitC by e;fundrewardescrowr,P+=r;TRANSFERs toCommons,S+=s ONLYafter success.
Funchanged. H=max(H,Fsnapshot),Hg=max(Hg,Fglobalsnapshot) evenunpaid/ineligible: no
contingentIOU/carry. Dust staysexistingledger. Prove P+S<=H,e<=max(C-B,0).
MATCH: d<=bank,local(S-G),global(sumS-sumG),max(0,sumALL(C+S-B)-sumG),10%license's
returnedprincipalcash. Reserve/debitbank/consumeG atomically againstONEsnapshot.
C+=d,B+=d,G+=d. LifetimeG neverreset/refunded; freshIDs inheritnothing. Profit cannot
remaintradable AND backgrant. Proof:
Commons>=feeCommons+S,bank=feeBank-G>=0,ops=feeOps+Q-O>=0,G<=S =>
protocol-ownedETH(excludeuserclaims)>=netfees+Q-O >=90%netfees afterfundedops.
NOTUSDvalue,tokenprice,redemption,fairfills,skill or sponsorprotection.
BACKERS: unique nontransferable owner/license/round/amountreceipts,VAULTbackedonce.
Commit next round byT-7d. ExitrequestbeforeT cancelseligibility/total; at/afterT
historicalrightsimmutable. Whole-receiptVAULTwithdraw7d afterrequest
regardlessround/assets; principalwithdrawn flag separatefromrewardclaimed.
Fundedreward*eligibleamount/frozentotal once/receipt; no late/newslot capture. No
fundedclaimexpiry/sweep. Start-snapshot,NOTtimeweighted.
LIVENESS: anyoneprogresses,boundedresumable work,monotonicIDs,noexclusivekeeper.
Benchmark actualETHrecovered vsETHcontributed,no oracle.
Workcredit<=.000001ETH/uniqueusefulitem,<=.0001ETH/license/round,fundedonly;
calibrategasBEFOREfreeze. No empty/retry/skippedround/bid/gas-reimbursement reward.
Sweepreward<=min(.000001ETH,sweep/100),ops-funded aftersplit. Dormancy permitted;
stake/fundedclaims independent. No protected-ledger topups.
GATES: auditEVERYchild;
verifyactualfactory/constructor/bootstrap/token/key/flags/code+initcode/gas,notassumedco
mpanion support. Standardtoken:noprivilegedmint/seize/freeze.
Fork4routermodes/partials/redemption/receivers onrealRobinhoodfactory. Invariants/fuzz:
custody,SphysicalbeforeG,lifetimecredits,lossnetting,retirement,snapshots,zero-legacy,fo
rcedETH,reentrancy,cancellation,frozentoken,exit/claims. Fault-inject
unbackedtrial,duplicateG,tradableS,latebacker. Mocks alone are not production proof. No
ownerrescue,pricefallback,revenue diversion or silent scope reduction. Publish
pinnedsource/parameters/gas/audit/proof; refuse deploymentwithunresolvedcritical/high
orunsupported assumptions.
UI: noir heist, brass/mint accents. Show actual Commons, bank, ops, crew
cash/basis/rewards/locks/consumed credit, jobs, auctions/deadlines, quarantine, receipt
exits and claims. No fake NAV or bribery detection. Portfolio assets may be
issuer-upgradeable/frozen; verify controls. Local reference tests are not certification
of generated code. Require IMD verification of ALL child artifacts.
Playground revenue (Robinhood, hub 0xe7db06c9726a69fdaa4020e7bc07a1c08328035e): the IMD payer is project 1's receiver 0x219fac9d73216a2601e9969dc1e58f7794d8f315.
Pay Playground's share to it.
Pay it ETH with a plain call; anyone then calls depositETH() on it.
Tokens sent to it wait for Playground's swap adapters.
Playground splits what it receives: do not split it again.
The pool's requester fees already go to the receiver: do not add or redirect them.