Documentation
Everything below describes the system as deployed and running today. If the site and the contracts ever disagree, the contracts win. Read them.
Overview
Tokenized stocks on Robinhood Chain trade 24/7 against USDG on Uniswap. The underlying equities trade 9:30–16:00 ET on weekdays. Liquidity providers earn swap fees around the clock, but carry a specific, recurring risk: while the real market is closed, news reprices the stock anyway, and at the next open the on-chain price re-anchors to the oracle in minutes. A concentrated LP position left sitting at the old price sells the winners cheap and buys the losers dear, to arbitrageurs, at the worst possible moment.
DOSS is one ERC-4626 vault over many stock pools, plus an off-chain keeper (“the agent”). Behind the vault sits a registry of small single-pair strategies, one per stock/USDG pool. The keeper allocates capital to whichever pool pays the best fee rate, rotates when the lead changes, and moves every position through a fixed daily rhythm: concentrate and earn while conditions are calm, pull everything to USDG before each market open, and redeploy once on-chain price has settled against the oracle. Depositors do two things ever: deposit and withdraw.
The vault
- Standard: ERC-4626 on OpenZeppelin’s implementation, USDG as the asset. Shares are a proportional claim on idle USDG plus the value of every registered strategy: its LP position, balances, and collected fees.
- Multi-pool: the vault holds a registry of strategies (one per stock/USDG pool, stamped by a factory). Capital moves between the vault and registered strategies only; there is no path to any other address.
- Valuation:
totalAssets()prices every position with the oracle feed, never the pool’s spot price, so a spot manipulation cannot mint or burn value. First-depositor inflation is mitigated with OZ’s decimal offset. - Profit accounting: each strategy tracks its deployed capital exactly. Deposits raise its high-water mark by the amount that arrived, withdrawals shrink it pro-rata, and the performance fee can only ever touch gain above that mark. Deposits are never taxed as profit.
- Withdrawals: no lockups. If a withdrawal exceeds idle USDG the vault
unwinds liquidity across its strategies in the same transaction.
pause()blocks deposits and agent actions; it can never block withdrawals. - Caps: the vault carries a global deposit cap the owner can only raise, and the app enforces $1,000 per wallet while the track record builds.
- Swaps: any internal swap enforces a maximum deviation from the oracle price (default 100 bps).
The agent
A TypeScript keeper holding a scoped hot key. On-chain it can drive the strategies and shuttle capital between the vault and its registered pools, and nothing else:
| Function | What it does | Bounds |
|---|---|---|
rebalance(lower, upper) |
Moves the range | Ticks must bracket the Chainlink-implied price |
deRisk() |
Pulls all liquidity to USDG | Funds can only land in the vault |
redeploy(lower, upper) |
Re-enters after a de-risk | Blocked while the feed is stale or price hasn’t settled |
harvest() |
Collects fees, skims the performance fee, compounds the rest | Fee only on gain above the capital mark; lands only in the FeeCollector |
deployToStrategy(s, amt) |
Moves vault capital into a pool’s strategy | Registered strategies only; the capital mark rises in the same tx |
recallFromStrategy(s, amt) |
Pulls capital back to the vault (rotation, wind-down) | Funds can only land in the vault |
Every fund destination in those functions is hardcoded to the vault, its registered strategies, and the fee collector. The agent key cannot transfer to an arbitrary address. This is the core security invariant of the system and it is covered by a dedicated Foundry invariant test, not a policy document. Agent actions are also rate-limited per hour, so a leaked key can annoy but not drain. Only the owner can register a new pool, so the agent can never invent a destination for depositor money.
Allocation
The keeper scans every USDG pool on the chain, estimates each pool’s fee rate from live volume and depth, and keeps all working capital in the best-paying registered pool. Rotation has brakes: it moves only for a meaningful, sustained edge, at most once a day, and only through the flat cycle, so positions are never yanked mid-session and noise never churns capital.
The daily rhythm
Inside EARNING, the agent also de-risks if pool price diverges
more than 150 bps from the feed, recenters when price drifts out of the band,
folds fresh deposits into the position, and harvests on a 12-hour cycle plus
once before every bell. All parameters are public configuration.
How it runs
The agent runs autonomously, and everything it does is public: every action
lands on-chain and appears in the log on the app page
with transaction links. It refuses to act on a stale or missing price, refuses
any harvest whose “gain” looks like capital instead of fees, and the owner can
always call deRisk() and pause() by hand.
Price feeds
Public Chainlink equity feeds do not exist on this chain yet. Until they do, each pool’s oracle is a minimal on-chain feed the DOSS keeper maintains from official market data, updated whenever the official price moves and sanity bounded so a bad print cannot poison it. This is a trust point and we say so plainly: you are trusting DOSS to publish honest prices, and every update is on-chain where you can check it. The moment real Chainlink equity feeds ship, the owner points the strategies at them and this trust point disappears.
Fees
One fee exists: 15% of harvested yield. It is hard-capped at 20% in the contract; the owner cannot set it above that, ever. It is charged only on gain above each strategy’s capital mark, so deposits and recoveries are never skimmed. There are no deposit, withdrawal, or management fees, and nothing is paid from token inflation.
Collected fees accrue in the FeeCollector. Once the $DOSS token exists (Phase 5, only after real fee history), the split becomes 50% to insurance stakers, 30% to buyback-and-burn, 20% to treasury.
Admin powers & timelock
Full disclosure of what the two keys can do:
| Key | Can | Cannot |
|---|---|---|
| Owner founder multisig / hardware wallet |
Raise the deposit cap (up only); set the fee rate under its 20% hard cap; register or retire pool strategies; swap a strategy’s price feed; pause instantly; rotate the agent key. | Exceed the 20% fee cap; lower the cap; block withdrawals; move depositor funds to itself. |
| Agent scoped hot key |
Call rebalance, deRisk,
redeploy, harvest, and move capital between
the vault and registered strategies, rate-limited. |
Anything else. All fund destinations hardcoded; cannot register a new destination. |
Contracts
This table is the single source of truth; any address circulating that isn’t listed here is a scam.
| Contract | Network | Address |
|---|---|---|
| DossVault (ERC-4626, multi-pool) | Robinhood Chain | 0x600a…cbDC |
| StrategyFactory | Robinhood Chain | 0xaB0b…40c1 |
| FeeCollector | Robinhood Chain | 0x1759…e637 |
| Pool strategies | Robinhood Chain | read strategyList on the vault |
| $DOSS token | — | does not exist |
Every strategy the vault runs is registered on-chain in the vault itself, so the registry can’t drift from this page.
A full internal security review of these contracts is public: trust model, findings, and test coverage. It is not an independent audit, and it says so.
The token
There is no $DOSS token today, and there won’t be until the vaults have at least 30 days of real, public fee history. When it ships: fixed supply, no emissions; staking backstops defined vault-loss events in exchange for 50% of performance fees; stakers get higher personal caps and first access to new vaults, and vote strategy parameters within owner-set safety bounds; 30% of fees market-buy and burn $DOSS, every burn transaction linked publicly.
Risk
- Unaudited contracts. DOSS ships with a full test suite and hard caps, not an audit. Caps and founder-first deposits bound the blast radius; they do not remove it.
- Impermanent loss. Concentrated ranges amplify fees and IL alike. De-risking removes the open-gap window; intraday moves, halts and after-hours prints remain.
- Oracle risk. Until public Chainlink equity feeds exist here, valuation depends on price feeds the DOSS keeper maintains from official market data. Updates are on-chain and sanity bounded, but it is a trust point, and an oracle fault is a vault fault.
- Operational risk. The keeper can go down. Manual controls exist, but a missed de-risk before a violent open would hurt.
- Underlying-asset risk. Robinhood’s stock tokens are MiFID II debt-token wrappers with jurisdiction restrictions (not offered to US, CA, UK, CH persons) and their own issuer risk. DOSS builds on top of them and inherits all of it.
- Young-chain risk. Robinhood Chain’s mainnet is months old. Sequencer downtime, RPC instability and thin liquidity are live possibilities.