TrustSecurity
The protections are arithmetic, not promises. This page lists exactly what the code enforces, how it was tested, how to verify it yourself, and what risk is left over.
Enforced by the code, on both chains
- Non-custodial by construction. Vault funds move for exactly one reason: a holder redeeming tokens. There is no withdraw function, no pause switch, and no privileged flow for anyone, including us.
- Worst case capped. Backing stays at or above the level fixed at launch (82.5% to 99%), so an instant round trip can never cost more than the published max loss.
- Floor monotone. Buys, sells and donations all move the floor one direction: up. Rounding always favors holders.
- No stranded value. Supply zero forces vault zero: a full exodus pays everyone out entirely, and a dead token holds nothing to scavenge.
- No admin functions on the EVM contracts. Every parameter is immutable at construction; there is no owner and no upgrade path.
- Program changes on Solana need more than one signature. The upgrade authority is a 2-of-2 Squads multisig, so no single signer can modify the program. Authority on Solscan: Cw3BeNU8QTH5MhY12XqTincrMXjP59p8ALpzsLiBq8LU.
Testing record
| Layer | Coverage |
|---|
| Solana program | 45+ on-chain integration tests plus native unit tests: round trips at the cap, whale buys, randomized fuzz proving price and floor never fall. |
| EVM contracts | 15 Foundry tests: bit-for-bit parity with the Solana math, path independence, max-loss bound, floor-monotone fuzz, full-exit invariant, fee routing, reentrancy. |
| Cross-chain parity | The Q48 fixed-point power law is ported integer for integer; test vectors force both implementations to agree exactly. |
| Audits | Two adversarial multi-agent review passes over the mechanic; findings fixed and regression-tested before mainnet. |
| Mainnet proof | Launch, buy, sell and full exit executed live on both chains; quotes matched execution to the smallest unit. |
Verify it yourself
- Robinhood Chain: the factory’s source is verified on Blockscout, byte-matched to the public repo. The factory address itself is reproducible from the published CREATE2 salt and init code, so the deployment provably is the audited code.
- Solana: the program builds reproducibly from the public repo; the on-chain hash matches the published source.
- Every guarantee above is a few lines you can find in the source: the sell path, the backing check, the full-exit branch. None of it depends on our servers or goodwill.
EVM-specific hardening
- Reentrancy guards on buy and sell.
- A fee recipient that refuses payment cannot block trading: the fee simply stays in the vault and lifts the floor instead.
- Quotes are views over the exact execution math, so integrators cannot be misquoted.
What can still hurt you, honestly
- The cap is real money. Buy a token that never sees another trade and your exit is the floor: up to 25% below your entry on the widest cap. The cap shrinks with volume, but volume is never guaranteed.
- Price needs inflow. The floor cannot fall, but the price only climbs when buying continues. A quiet token is a flat token.
- Software risk. The code is tested, audited and verified, but no software is beyond all doubt. Size accordingly.
- Market risk on the denominator. Floors are denominated in SOL and ETH. The token can hold its floor while the currency itself moves.
Rule of thumb: treat the max loss number as the cost of a ticket you might not use, and never commit funds whose full loss would change your life.