Proof, not promises
Every number the product shows can be checked against the chain. This page lists what the protocol holds, which oracle prices it, which contracts run it, who can move it, and the risks that come with all of the above.
What the protocol holds
Balances read from the Custody Vault on Robinhood Chain, priced with the same oracle the NAV engine uses. This is the asset side of every vault share in existence.
Price freshness
Every constituent price, its source and how old it is. When a feed passes its age limit the vaults that depend on it are marked halted and mints are refused rather than priced on a guess.
Share price versus NAV
The protocol's own agent watches the gap between the share token's market price and its net asset value. Where a pool exists it closes the gap; where none exists it records what it would have done.
Deployed addresses
The full protocol surface on Robinhood Chain, straight from the deployment manifest. Read the source on Blockscout before you trust any of it.
Who can move the assets
Disclosure unavailable
The governance disclosure is served by the API and could not be read. That is not a statement that custody is decentralised — treat it as operator-controlled until this loads.
Stated plainly
These are the standing disclosures for the protocol and the agent layer. They are shown in full whether or not the API is reachable.
Custody contract
The Custody Vault stores real value: a bug in its logic loses deposited assets — it doesn't just distort a chart, as in a purely analytical product.
Multisig in V1
Multisig custody in V1 adds trust in the operators on top of smart-contract risk.
Oracle failure
An oracle that goes stale or feeds wrong data moves NAV in the wrong direction and opens an arbitrage window against the holders.
Basis risk
Tokenized equities trade with basis risk to the stock price on the traditional exchange: the gap widens in periods of thin liquidity, or when the exchange is closed while the token keeps trading.
Agent decisions
An agent can lose money while acting entirely inside its policy. The guardrails bound size, cadence and allocation; they do not make a strategy correct. Every decision is written to the journal, including the ones that turned out wrong, and past performance on the leaderboard says nothing about the next tick.
Session-key scope
Each agent signs with a session key held by the backend. If that key is compromised, the blast radius is one agent account: the on-chain account only permits minting and redeeming Ingot vault shares, bounded by the per-transaction and daily caps. It can never transfer funds out to a third party. The owner revokes it in a single transaction by clearing the agent signer.
Peg Keeper treasury risk
The Peg Keeper trades protocol treasury funds against the share/NAV spread. A wrong NAV, a thin pool or a leg that fails to fill leaves the treasury holding inventory it did not intend to hold. Every action is bounded per transaction and per day, and while no share pool is configured the keeper runs in observe mode and trades nothing at all.