Robinwood StocksDocs
Security & Risk

Risks: read this

Everything that can go wrong, ordered by how much it matters.

This page follows the protocol's docs voice: radically honest. If you read one page before depositing, read this one. Nothing here is investment advice.

1. Issuer risk (the dominant risk, stock baskets)

The underlying Stock Tokens are debt instruments of Robinhood Assets (Jersey) Ltd, not direct share ownership. The issuer can pause or freeze the underlying tokens. Robinwood Stocks inherits this risk and cannot remove it:

  • If any constituent's transfers are frozen, redeeming the whole basket reverts until the freeze lifts; redemption is all-or-nothing by design (a partial-redeem escape hatch was deliberately not built, to keep the contract minimal and its invariants simple).
  • This risk exists identically when holding the Stock Tokens directly; the basket neither adds to nor subtracts from it.
  • Deposit caps exist primarily to bound aggregate exposure to this risk.

HOOD6's chain-native constituents have no issuer and no freeze function; they carry ordinary crypto market and liquidity risk instead.

Some community tokens carry the same class of risk from their own deployers. Tokens launched through Virtuals Protocol (and similar launchpads) keep an owner able to set a transfer tax on pool trades and to blacklist addresses. Today no basket-relevant address is blacklisted and plain transfers are untaxed — the vault holds and returns these tokens loss-free — but if a token's owner ever blacklisted a basket's vault, minting and redeeming that basket would revert for as long as the blacklist stands, exactly like an issuer freeze on a stock constituent. The recipe is immutable, so an affected constituent cannot be swapped out. Weigh this before minting any basket that contains issuer-controlled tokens; the studio marks them.

2. Agentic-basket risks

Agentic baskets add one power (the agent's rebalance) and therefore a short list of risks frozen baskets don't have:

  • A compromised or malicious agent key can trade at bad prices — at most the slippage budget of NAV per cooldown window (1% per day on the live pilots). It has no path to custody, minting, redemption or fees; the derivation is on the policy page. The curator can rotate the key at any time.
  • TWAP manipulation: chain natives are priced by one-hour TWAPs of their own pools. Holding a pool at a false price for a full hour against arbitrage is expensive, and the damage of a manipulated read is already capped by the same turnover/slippage budgets — but thin pools make the attack cheaper. This is bounded, not impossible.
  • Strategy risk: the agent can simply be wrong. Backtests are published honestly (including WCT's negative return edge) and are not promises; a rotation can underperform holding.
  • Snapshot timing on payouts: distribution cycles pay on a permissionless snapshot, which creates a timing game around cycle boundaries — described in Payouts.

What agentic baskets do not add: any path to blocked redemption. A dead feed, a disabled venue, a rogue agent — each freezes rebalancing at worst. Redemption reads no prices and stays ungated.

3. Unaudited contracts

The contracts have not undergone a professional audit. Mitigations, not substitutes: a small custom core on OpenZeppelin v5, 100% coverage on the frozen BasketToken, 230+ tests across unit/fuzz/invariant/fork layers, adversarial internal reviews before the immutable V2 deploy, and triaged static analysis (details, with precise per-contract coverage). Supply caps stay at ≈$100K per basket until traction, and $2M requires a published audit (roadmap).

4. Market & product risks

  • Weight drift (frozen baskets): units are fixed; weights drift with prices, like an unrebalanced ETF. Documented behavior, not a bug (explainer).
  • Constituent volatility: a basket is exactly as risky as what it holds. HOOD6 holds young, thin-liquidity chain-native tokens.
  • Zap execution: thin pools mean worse prices; the 5% per-leg impact gate bounds this loudly, and in-kind mint/redeem never depends on pools.
  • Secondary-market pricing: if basket tokens trade on DEXes, the pool price can deviate from NAV; in-kind mint/redeem is the arbitrage anchor, but arbitrage needs liquid constituents.

5. Chain & infrastructure risks

  • Robinhood Chain runs a single sequencer operated by Robinhood; soft finality depends on it (hard finality on Ethereum).
  • Price feeds never touch the mint or redeem path of any basket. On frozen baskets they are display-only; on agentic baskets a stale or dead feed freezes rebalancing (fail-safe, how) — never redemption.

6. Compliance restrictions

Not available to US, UK, Canadian, Swiss or UAE persons; the hosted frontend geoblocks accordingly (HTTP 451). These mirror the underlying Stock Tokens' own restrictions. Users are responsible for their local law.

What is not a risk here

For balance, here are failure modes common in DeFi that Robinwood Stocks's design excludes:

Common failureWhy it's excluded
Admin rug / treasury drainNo function exists to withdraw vault funds, for anyone
Upgrade to malicious codeNo proxy, no upgradeability
Oracle manipulation minting unbacked tokensNo oracle in the mint path: mint is in-kind against the current units, on every basket
Depeg from fractional reservesFull backing is a contract invariant, checkable via isFullyBacked()
Locked exits during a bank runRedemption is ungated by construction; there is nothing to run on, since every token is a claim on specific vault holdings

On this page