Security & Risk
Trust model
What the contracts guarantee, mechanically, and the exact list of what remains.
The core of every Robinwood Stocks basket is a single-contract, non-upgradeable, in-kind mint/redeem vault. The design goal is an attack surface as close to zero as possible, with radical explicitness about what remains.
What every basket guarantees
| Property | Mechanism |
|---|---|
| Full backing | Mint pulls ceil(amount × units / 1e18) per constituent and verifies the actual balance delta; redeem pays floor(...). All rounding favors the vault. Proven by the invariant suite; on agentic baskets, re-checked after every rebalance. |
| Redeem can never be blocked by the protocol | redeem has no pause, no cap, no guardian gate, and reads no price feed; verified by a dedicated test that redeems while minting is paused and the cap is below supply. |
| No admin control over funds | The guardian can only pause minting, move the supply cap (≤ immutable ceiling) and change the fee recipient — and on curated baskets even less (below). There is no withdraw, sweep, upgrade, delegatecall or selfdestruct path. |
| Reentrancy safety | nonReentrant on mint/redeem; attack mocks cover all four re-entry combinations. |
| Non-standard token rejection | The balance-delta check rejects fee-on-transfer / lying constituents at mint time. |
What the platform adds — and how it keeps the guarantees
The curator platform is live. Its wiring tightens the first-party model rather than loosening it:
- Curated baskets are guarded by the restricted CuratorGuardian, whose only power is raising the supply cap along the public roadmap. It cannot pause minting or redirect fees — those functions do not exist on it. Curators hold no admin power over their baskets.
- The
CuratorRegistryhas no admin at all: license burns are hard constants (10k $WOOD frozen / 25k agentic), with no privileged fee-collector anywhere. - The 60/40 fee split is a constant in an immutable
FeeSplitter;distributeis permissionless. - Agentic baskets add exactly one power — the agent's
rebalance— bounded by immutable ceilings (1-day cooldown, ≤25% turnover, ≤1% slippage per rebalance, registry-listed buys only, full backing re-proven every trade). The worst case of a rogue agent key is bounded and small: the policy page derives it.
What you still have to trust
Being honest about the residual list is the point:
- The issuer of the constituents (stock baskets): the dominant risk, detailed in Risks.
- Unaudited code: heavily tested (below), but no professional audit yet. Deposit caps are the mitigation; Phase 3 of the roadmap requires a published audit.
- The chain: a single Robinhood-operated sequencer (standard Orbit trust assumptions; finality is hard only on Ethereum).
- The guardian Safe for its bounded powers: on first-party baskets, the worst a compromised guardian can do is pause new mints, move the cap within the ceiling, and redirect future fees. On curated baskets, strictly less (cap raises only). It can never touch the vault or your redemption.
- On agentic baskets, the agent key — for at most the slippage budget per cooldown window, as derived in the policy, and the Safe-gated oracle/settlement registries as the global brake.
Test posture: unit, fuzz, invariant, attack-mock and mainnet-fork suites across every contract in the repository — current counts and the full static-analysis triage in Audits & analysis.