What this is, how to buy it, and what it cannot do.
Robinhood Chain has 203 tokenised stocks. They trade every hour of the week. The market that prices them is open 32.5 hours of it. A reserve buys inside that window, funded by the pool’s own trading fee, and it can never sell.
That is the whole idea. The rest of this page is how, how much, and what it is not able to do.
This chain is new and most people reading this have never held anything on it. No step here assumes you have.
MetaMask or Rabby, browser extension or phone. It is your account and nobody else can reach it, which also means nobody else can recover it. Write the recovery phrase down on paper, keep it off your computer, and never type it into a website.
Chain id 4663, an Arbitrum Orbit L2. You need a little ETH there for network fees and USDG to buy with. Fees on this chain are fractions of a cent, so a small amount goes a long way. USDG is the chain’s dollar and it is 6 decimals, not 18, which matters if you ever read balances by hand.
Swap on Uniswap on Robinhood Chain. Before you confirm anything, compare the contract address in your wallet against the one in SEC. 08 of this page, character by character. Not the name, not the ticker, not the logo. The address.
There is nothing to stake, nothing to claim, no lock-up and no dashboard you have to visit. The reserve buys on its own schedule while the feeds are quiet, and every buy and every burn is a transaction you can read. Holding is the entire user action.
Ticker squatting kills more launches on chains like this one than rugging does. Six mints of a single ticker in four days elsewhere, and twice the impostor carried around a hundred times the real token’s market cap. A copy can take the name, the ticker, the logo and the artwork in about a minute. It cannot take the address. Nothing that is not the address in SEC. 08 is us.
Six contracts. Four you hold or trade against, and two that only ever run once.
The token. A plain ERC20. No mint function, no owner, no tax on buying or selling, no pause and no blocklist. It carries one extra thing: a per-address ceiling that applies for a short window after liquidity lands, so the first block cannot be taken by one address. It has no setter and it expires on its own.
The reserve. It checks two things before it is allowed to buy, in this order.
First the clock. It refuses outright for the whole 13:30 to 21:00 UTC window, Monday to Friday. That window is the union of both daylight-saving regimes, so there is no daylight-saving table to keep up to date. It costs an hour a day of refusal in one of the two regimes, and it refuses on market holidays too, because holidays are not modelled. Every error it makes is a buy it did not take. Then the feeds. All three feeds in the quorum, SPY, NVDA and AAPL, must have gone an hour without publishing. Chainlink states plainly that these feeds “do not have heartbeats during off-hours”: they publish while the market is open and stop when it shuts.
The order matters and it is not pedantry. We built the silence-only version first and replayed it against 67.7 days of real feed history: it would have called the market shut during one open minute in five, because SPY publishes about 1.6 times a day and the median gap inside a session is 71 minutes. A gate that fires mid-session by construction is not a gate. The clock is the gate; the feeds confirm it.
When both agree, the reserve may buy allowlisted equities, and it never sells them. The rest of what it earns buys NIGHTSHIFT on the open market and burns it.
It can be asked what it holds. stocks() returns the allowlist, holdings() returns every allowlisted token and its balance, and backingValue() returns what that is worth at each feed’s last real answer, along with the age of the oldest price it used and a count of anything it could not price, so a stale figure can never be printed as a live one.
The hook. The NIGHTSHIFT pool is a Uniswap v4 pool with a dynamic fee, and the hook that sets that fee reads the same clock the reserve does. While anyone is still pricing US equities the pool charges the day rate. While nobody is, it charges the night rate, and the night rate is the lower of the two. Every dynamic fee in production sets its number from something about its own pool: realised volatility, volume, inventory. This one sets it from whether a market it is not in has gone home.
The direction is deliberate and it costs us money. Volume on this chain concentrates off-hours, which Uniswap’s founder published himself, so a pool chasing revenue would widen its fee into exactly those hours. Three reasons it narrows instead. The buyback trades through this pool and can only trade while the market is shut, so a cheaper night is a larger burn. Every fee here already belongs to the reserve, because the position earning it can never be withdrawn, so charging holders more moves money between two pockets of the same protocol while making the token worse to hold. And a fee is a fact on chain rather than a claim on a page: either the number moved when the bell rang or it did not.
The hook has no owner, no setter and no upgrade path. Both rates and the address of the clock are fixed at construction. It never touches the swap, takes no share of it, holds no funds and decides for nobody whether they may trade. The pool it serves is named in its constructor rather than bound to whichever pool initialises it first, because the hook’s address is public before our pool exists and a stranger who initialised a junk pair against it would otherwise have taken that binding permanently.
The waiting. The gate forbids the reserve from spending for roughly four fifths of every week. For that whole time its settlement tokens would otherwise sit still, so instead they go into an ERC-4626 vault and earn until the market shuts and there is something to do with them. A buffer of four full-size purchases never leaves the contract, so ordinary operation never depends on a withdrawal succeeding, and every call into the vault is written so that a vault refusing or failing costs the yield and never the buying. The vault is fixed at construction, can be set to nothing at all, and every withdrawal pays this contract and no one else. It is a real dependency and it is the only one this contract has: the honest bound on it is that a total loss of the vault costs the reserve whatever was parked and nothing more.
The lock. The liquidity position is held by a contract that has no function to send it back out. The fees it earns can only be swept to the reserve, and the address it sweeps to is fixed at construction.
The launcher and the treasury buyer. The launch contract runs once, in a single transaction, and holds the team’s share afterwards under the terms in SEC. 04. The treasury buyer routes the open-market purchase at the open; it has no owner, holds nothing at rest, and the early-buy cap applies to it exactly as it applies to anyone else.
The money comes from the pool’s own trading fee, which a trader pays whether this project exists or not. There is no tax added on top of it.
There is no fixed split between the two halves. Buying an equity and buying back to burn are two separate functions, anyone can call either, and they share one spend cap and one cooldown. So the next $2,000 goes wherever the next caller sends it, and the running totals for each half are counted separately on chain and printed on the record. If you have seen a figure claiming a fixed percentage goes to the burn, it did not come from us and it is not in the contract.
Every value that governs this, in one table. All of them are fixed at deployment. None of them has a setter.
| Parameter | Value | What it means |
|---|---|---|
| Total supply | 1,000,000,000 | Eighteen decimals, minted once at deployment. There is no mint function. |
| Buy tax | 0% | Nothing is taken on a buy. |
| Sell tax | 0% | Nothing is taken on a sell, on day one or ever. |
| Into the pool | 85% | 850,000,000, provided as liquidity and locked in a contract with no withdraw. |
| Held by the team | 15% | 150,000,000, held from the mint. Not vested, not locked, not time-released, and discretionary. See below. |
| Bought at the open | up to 10% | A purchase on the open market across ten addresses, held to 1% each by the same early-buy cap that applies to everyone. A ceiling, not a figure. |
| Early-buy window | 300 blocks | About thirty seconds at this chain’s block time, counted from the block liquidity lands in. |
| Early-buy ceiling | 1% of supply | Per address, inside that window only. No setter, and it expires on its own. |
| Session window | 13:30–21:00 UTC | Monday to Friday. The reserve refuses for all of it, before it looks at a feed at all. |
| Hours it may buy | up to 130.5 | The week minus 37.5 hours of clock refusal. Not the same as the 135.5 hours nobody prices these: the window is deliberately wider than any real session, and every hour of the difference is a buy the contract declines to make. |
| Equities it may buy | 1 at launch | NVDA, through the deepest USDG book. Fixed at construction with no setter, so adding a second one means deploying a second reserve. |
| Feeds in the quorum | 3 | SPY, NVDA and AAPL. Every one of them has to be quiet; one still publishing stands the reserve down. |
| Feed counts as asleep | 1 hour | Silence longer than this. On its own it is not enough to open the window, and the clock above is why. |
| Spend cap | $2,000 | The most the reserve can spend in a single call, in settlement units. |
| Cooldown | 15 minutes | The minimum gap between two spends, shared by buying and burning, so the reserve cannot put its whole balance into one book in one block. |
| Maximum slippage | 3% | How far below the last real market price a fill is allowed to land, or the buy reverts. |
| Buyback band | 5 min · 3% | A burn reverts unless the pool sits within 3% of its own five minute average, checked before the swap and again after it. It does not fix the price paid: it refuses a pool that has been pushed, and refuses a book too thin to absorb the spend cap. |
On the 15%. The launch contract holds it, not a wallet. It cannot move while the early-buy window is open, and the only function that moves it sends the whole amount to one address fixed when the contract was built. Anyone can trigger that transfer; nobody can redirect it, resize it or bring it forward. Once it lands, nothing constrains what the holder does with it, and the intent stated for it, burning against supply and matching supply into staking if staking is built, is an intention rather than a property of a contract. It is on chain from the first block and so is every use of it.
On the 10%. It is bought on the open market at the open, at whatever price the book gives, across ten addresses. For the first 300 blocks the early-buy cap holds every address that is not the pool or the launch contract to 1% of supply, so ten addresses is what the treasury can buy through in that window. Two things worth being exact about: the cap limits a balance rather than a purchase, and it expires with the window and constrains nobody afterwards, us included. What holds after that is that every one of those addresses is on chain and every purchase is a public transaction.
These are the values the launch will be run with. Once there is a deployed contract, that contract settles it: if a figure here has drifted from what it says, read the contract and tell us, and we correct this page.
Safety here is not a promise about behaviour. It is a list of functions that do not exist.
Everything above describes machinery that has not yet been switched on.
Nothing is deployed. There is no contract address, no pool, no reserve and no token. The reserve has bought nothing, burned nothing and holds nothing, and the figures on the shift record say so rather than showing a projection.
What does exist: the contracts, their tests, and the readings. The suite runs on every change, a quarter of it against a live fork of chain 4663, and every new guard is mutation-tested. The count is in the repository, where it stays current. The stock figures on the record are read from the chain in your own browser every couple of minutes; none of them is typed here.
When something does run, this page changes to say so, and the addresses appear in SEC. 08 and nowhere else first.
We publish no projection, no APY and no target. There is no number of that kind anywhere on this site, and if you find one on a page claiming to be us, that page is not us. What the record shows is measured: what each stock is worth on chain against the last real price a market agreed on, and how long it has gone without one.
No third party has audited them, and we do not claim otherwise. What exists is a test suite that runs on every change, a quarter of it against a live fork of this chain, and mutation tests on every guard. The source is in the repository and the deployed bytecode will be verifiable against it.
The reserve loses whatever it had parked there, and nothing else. That is a real risk and it is the only outside dependency this contract has, so here is exactly how far it reaches. A buffer of four full-size purchases never leaves the reserve, so the vault failing does not stop it buying or burning. Every call into the vault is wrapped: one that refuses, reverts or cannot be read costs the yield and never the purpose, and the reserve carries on with what it holds. The vault is fixed at construction and can be set to nothing at all, in which case none of this applies and the reserve behaves exactly as it did before. Every withdrawal pays the reserve and nobody else, so this adds no path by which value leaves for a caller.
Worth saying plainly: as of today every USDG vault on this chain reports that it will accept no further deposits. So this is built, tested and switched off, and it starts earning the day one of them opens rather than the day we say it does.
No. Both rates are fixed when the hook is deployed and there is no function to change either one, no owner and no upgrade path. The only thing that moves is which of the two applies, and that is decided by the same Chainlink feeds the reserve reads, not by us. You can check the pair yourself with one call: currentFee() returns the rate and whether the market is shut, without simulating a trade.
Yes. The stock tokens are the issuer’s, and adminBurn reaches any holder of any of the 203 tickers, this reserve included, with a global pause and a blocklist beside it. We cannot empty the reserve. They can. The same key also reaches your own wallet, on every token on this chain, whether or not you come here.
Yes, and there is now a standard for it. Uniswap shipped Permissioned Pools in July 2026: an issuer of a restricted security can attach a hook that allowlists exactly who may swap and who may provide liquidity, and can force-close the positions of anyone who falls off that list. The permissioned asset never enters the pool at all: it sits in an adapter and the pool trades a virtual representation of it. Robinhood’s stock tokens are restricted securities and they trade in open pools today. If the issuer ever moves the 203 onto that standard, a reserve with no owner, no operator and no legal entity is not going to be on anybody’s allowlist. It is live on Ethereum mainnet now. We cannot mitigate it and we are not going to pretend we can.
It stays. There is no setter and there is no redeployment path for an existing reserve, so a wrong entry is wrong permanently. That is the price of not having an owner, and we would rather state it than quietly keep a setter for emergencies.
Whatever any address holds is on chain and readable, including ours. The supply split goes on the shift record before the contract address is broadcast, so it can be checked against the chain from the first minute rather than reconstructed afterwards.
The position is held by a contract with no function that sends it out, so there is nothing to unlock and no key that unlocks it. The fees it earns can only go to the reserve, and that address is immutable. You can read both without asking us.
Because that is when the price nobody is checking is the price. These tokens trade for 135.5 hours a week with no live market behind them. Buying into that window rather than into a session is the only part of this that is an opinion, and it is the opinion the whole thing is built on.
Whatever callers send there. It is not a percentage and it is not set anywhere. buy and buybackAndBurn are separate permissionless functions sharing one $2,000 cap and one 15 minute cooldown, so each window goes entirely to one or the other. Both totals are counted separately in the contract and both appear on the record, so the real ratio is readable at any time rather than promised in advance.
adminBurn, and after that the permanence of the allowlist. Both are in SEC. 05 and on the record. A contract that cannot be changed cannot be fixed either, and that is the trade being made here on purpose.
When these exist they appear here and on the shift record. Anything claiming to be NIGHTSHIFT before then is somebody else.
not deployed yet
Check this against your wallet before you confirm a swap. The name and the ticker are not identifying.
not deployed yet
Where the equities accumulate. Read the balance yourself rather than trusting a screenshot, including ours.