The NAV Prover
A custody product proves it holds the asset behind the number. Every figure here reconciles to Robinhood Chain: what each Lot holds, which oracle priced it and how old that price is, the sum equalling published NAV, and the orders netting in the open epoch. Click any row through to the chain and check it yourself.
Orders netting now
Creations and redemptions net against each other every 15 minutes; only the difference reaches the market, and the whole batch settles at one price or rolls to the next epoch.
Orders net against each other, then settle whole.
USDG filing in to mint Parcels at settlement.
Awaiting the netting engine
Parcels burning back to USDG at settlement.
Execution band 50 bps. If the epoch VWAP would breach the tolerance against oracle NAV, the batch is cancelled and every order rolls to the next epoch rather than filling off-mark.
The board is at rest. Filed creations and redemptions appear here as tickets the moment the netting engine is live; the figure above previews the current epoch’s net flow.
What each Lot holds, reconciled
One reconciled ledger per Lot: every constituent held in custody, the applied price and its age, actual weight against target, and the value. The footing rule proves the custody sum equals the published NAV.
Price freshness
A price older than 15 minutes pauses that constituent's swap; a feed stale enough closes USDG primary while in-kind redemption stays open. This is the graded degradation the ledger colours above trace back to.
Price freshness
Every constituent price, its source and how old it is. When a feed passes its age limit the vaults that depend on it are marked halted and mints are refused rather than priced on a guess.
Who can move the assets, and the way out
V1 runs on a multisig custody signer behind a 48-hour timelock. In-kind redemption is always live; the escape hatch is the last-resort exit if governance ever goes dark.
Multisig behind a timelock
A multisig, not a single key. No one wallet can move custody alone.
Custody-level changes queue behind a 48-hour delay, giving holders time to exit in-kind before any change takes effect.
Balances are read directly from the Custody Lot and priced with the same oracle the NAV engine uses.
The last-resort exit
You can always burn Parcels and take each constituent straight from custody — no oracle, no DEX, no permission. The escape hatch is the stronger guarantee: if the protocol is abandoned or frozen, holders can force an orderly wind-down. It arms under any of these conditions.
If deposits, redemptions and rebalances stay paused for more than a week, the hatch can be armed.
A month of silence from the custody signer is treated as an abandoned protocol.
Holders can vote to arm the hatch directly, independent of the two timers above.
The verified surface
Every contract that runs the protocol on Robinhood Chain, straight from the deployment manifest. Read the source on Blockscout before you trust any of it.
Deployed addresses
The full protocol surface on Robinhood Chain, straight from the deployment manifest. Read the source on Blockscout before you trust any of it.
Stated plainly
The standing disclosures for the protocol. Shown in full whether or not the API is reachable.
Custody contract
The Custody Vault stores real value: a bug in its logic loses deposited assets — it doesn't just distort a chart, as in a purely analytical product.
Multisig in V1
Multisig custody in V1 adds trust in the operators on top of smart-contract risk.
Oracle failure
An oracle that goes stale or feeds wrong data moves NAV in the wrong direction and opens an arbitrage window against the holders.
Basis risk
Tokenized equities trade with basis risk to the stock price on the traditional exchange: the gap widens in periods of thin liquidity, or when the exchange is closed while the token keeps trading.
Epoch timing
Primary creations and redemptions are batched and priced at settlement, not at the moment you file them: your fill is set by the epoch's execution, not the quote you saw. If the epoch's VWAP would breach the tolerance band against oracle NAV, the epoch is cancelled and your order rolls to the next window rather than executing at a bad price.
Backstop cap
The Backstop Module is first-loss capital: stakers absorb shortfalls before Lot holders, but only up to a 30% slash cap per event. A loss larger than the backstop can cover is borne by Lot holders — the module reduces the blast radius, it does not remove it.
USDG execution
Redeeming to USDG sells each constituent on-chain in the next epoch, so it carries DEX slippage and a flow-impact fee, and it pauses when the oracle feed degrades. In-kind redemption — burning Parcels for the underlying constituents straight from custody — needs no oracle or DEX and stays available even when the USDG path is closed.