Contracts

StockVault

An ERC-4626 vault over one Stock Token. Deposits are managed as a single Uniswap v3 position on the Stock Token / USDG pool, recentred at 02:00 UTC after each NYSE trading day within a band of plus or minus rangeBps around the Chainlink price. Shares are a pro-rata claim on idle balances plus both legs of the position. Valuation uses Chainlink for price and the pool TWAP for the position's composition, and every priced path (deposit, mint, withdraw, redeem, rebalance) reverts when feed, TWAP and spot disagree.

UptickRouter

The USDG on-ramp for a StockVault. It swaps USDG into the Stock Token through the same Uniswap v3 router and pool fee the vault uses, then deposits to the receiver. The swap floor is the Chainlink-implied stock amount from health().price less slippageBps, so a deposit reverts when the pool sits far below the oracle. The router holds no balances and leaves no allowances behind after any call.

VaultFactory

Deploys one StockVault per (Stock Token, pool, Chainlink feed) and keeps the registry the app and the keeper read. The factory pins the keccak256 of StockVault's creation code, so the only contract it can ever register is the audited build. The owner passes the creation code with each call; the factory checks it against the pinned hash, appends the constructor arguments and deploys with CREATE2 at the salt keccak256(stock, pool, feed).

Chain components in use

Each address returns bytecode from cast code against https://rpc.mainnet.chain.robinhood.com.

The v4 hook

StockVault trades on a Uniswap v3 pool. The separately deployed UptickHook is a dynamic-fee hook for a v4 Stock Token / USDG pool, and it is built on CappedTakeHook. The fee follows the NYSE session: regular hours, off hours, and weekend, with the 20 observed NYSE full-day holidays of 2026 and 2027 compiled in. A swap that pushes the pool further from Chainlink adds min(gapBps * surchargePipsPerBp, maxSurcharge); a swap that moves it toward the reference pays the session fee only.

The cap is a property of the bytecode. CappedTakeHook stores the declared maximum as immutable and registers it in CapRegistry; the constructor rejects a schedule whose worst fee plus surcharge exceeds it with BadSchedule, beforeSwap refuses to quote above the cap with FeeAboveCap, and afterSwap re-checks the realised take with TakeExceedsCap. The nested-swap guard counts an inner swap against the same ceiling.

Session pricing is a measurement, not a preference. Fee per dollar of one-hour markout on the NVDA, SPCX and TSLA pools ran 1.03 to 1.35 in NYSE hours and 3.94 to 33.27 on weekends; the pooled figures are 1.16 and 13.64. The schedule is a deploy parameter, so a new pool can set its own three fees within the same cap.

Test surface

The vault, router, factory and hook suites run against a fork of Robinhood Chain with the real pools, position manager, router and feeds. Only latestRoundData is mocked, to set price and age. Coverage includes fuzz and invariant suites for share accounting, safety tests for the owner's limits, dust exits, minimum-output bounds, the router path, the factory, and a hook suite that walks all 20 holidays and each daylight saving boundary with independently generated timestamps.