Security

The protocol is pre-mainnet. Mainnet use depends on completing the production checks below.

Enforced by the contracts

• OTFToken mints one billion tokens in its constructor and has no later mint, tax, blacklist, seizure, or upgrade path. Burns reduce live supply.
• Vault fee rates and beneficiaries are fixed at creation. The vault records the creator and buyback portions when it charges each fee.
• Token donations do not change the vault’s accounted backing or OTF fee split.
• The collector can settle only factory-recognized vaults through the factory’s canonical entry router and approved adapters. Its final purchase uses the immutable canonical OTF/WETH V4 pool.
• Reward claims require a valid proof of the user’s total allocation and pay that user directly. The root publisher has no direct withdrawal function.
• Only the current team-vesting beneficiary can record a milestone or nominate and cancel a successor. The nominee must accept the role.
• The launch manager enforces the bootstrap price corridor, burns its final OTF balance once, and permanently locks its V4 liquidity position.

External assets, venues, administrators, and price inputs remain trust dependencies.

Trusted roles

The fund creator can permanently shut down their vault at any time. Anyone can also trigger shutdown if a token balance proves that backing has fallen below the vault’s records; a failed balance read is not enough. Shutdown stops new mints and future annual fees, waives redeem fees, and leaves in-kind exits available for assets that pass the vault’s transfer checks. The vault charges accrued annual fees before entering shutdown.

Reward-root publisher

The publisher calculates rewards offchain and publishes each address’s total allocation to date. It must follow the rewards policy: 208 weeks, 650 million OTF for depositors, 50 million for creators, and a 10-million-OTF cap on each fund’s accounted OTF weight. Funds without accounted OTF receive no allocation.

The contract does not enforce this policy. A publisher can allocate the distributor’s full remaining balance at any time. Proof verification and claim accounting prevent invalid proofs and duplicate claims, but cannot detect an incorrect or early allocation.

Expense beneficiary

Only a vault’s fixed expense beneficiary can convert its pending fee shares into WETH and trigger the OTF buyback. The beneficiary chooses either to sell the shares or redeem them and sell the basket assets. They also supply the route, minimum WETH and OTF outputs, and a deadline.

The contracts check token identities, approved adapters, minimum outputs, and actual balance changes. The beneficiary is responsible for the price accepted: settlement does not find routes, consult an oracle or time-weighted average price (TWAP), or set a fair-value floor or fixed slippage limit.

The collector pays the creator’s portion of WETH to the beneficiary and uses the rest to buy and burn OTF through the canonical pool. It clears pending counters before trading and consumes the recorded shares. Any failure reverts the transaction and restores pending fees.

Adapter manager and trading venues

The entry-router owner chooses which adapters can execute trades and can revoke them. Each approved adapter must be permanently bound to that router. Users still depend on the adapter code and its trading venues, constituent tokens, WETH, Permit2, Universal Router, and the selected V3 or V4 pools.

Offchain callers supply routes. The contracts validate route structure and transfers, but cannot determine whether a route offers a fair price.

ETH/USD oracle

Team vesting values OTF using the configured ETH/USD feed and the current price in the canonical V4 pool. The contract rejects zero or negative answers and answers with future or stale timestamps. A fresh but incorrect answer can still satisfy a milestone.

The current beneficiary chooses when to record a milestone. The contract uses the price at that moment, with no TWAP, liquidity threshold, or observation delay. Restricting checkpoints to the beneficiary does not protect against spot-price manipulation.

Native ETH boundary

The entry router wraps ETH into WETH for basket entry and unwraps WETH for ETH exits. mintFromNative requires msg.value to match the requested input exactly. The router accepts callback ETH only from its fixed WETH contract, and an exit unwraps and sends only the current operation’s WETH output to the caller.

Wrapping, unwrapping, refunds, and ETH sends stay inside the reentrancy guard. Rejected sends revert the transaction. Pre-existing or forcibly sent ETH and WETH remain untouched; vaults and swap routes use ERC-20 tokens only.

Native basket entry and exit are enabled on testnet.

Launch and market assumptions

The pool opens at 15 ETH reference FDV and graduates just below 135 ETH. These values use the original one-billion-token issuance. Graduation replaces the bootstrap liquidity with a permanent position using the collected WETH principal and at most 50 million OTF. The security specification defines the exact price boundaries, liquidity constants, and rounding requirements.

Before graduation, only the launch manager can add liquidity. The beforeAddLiquidity hook reserves the capacity needed at the position’s price boundaries by checking the caller, pool, PositionManager, phase, ticks, and exact liquidity amount. Authorization exists only during each bootstrap or permanent mint call.

After graduation, anyone can add their own liquidity. They cannot withdraw or transfer the manager’s permanent position.

During bootstrap, swaps must finish inside the price boundaries. Reaching the exact final price sets GraduationReady and pauses swaps until finalization. The launch router partially fills orders that would cross a boundary and normally finalizes a boundary buy in the same transaction, after the PoolManager returns control. Anyone can also finalize separately once the boundary is reached.

For ETH output, sellOtfForEth takes WETH into the launch router, unwraps only the sale’s output after pool settlement, and sends ETH to the recipient. The reentrancy guard covers the payout; a rejected payment reverts the sale. The router accepts ETH only from its configured WETH contract and leaves pre-existing ETH and WETH untouched.

Swaps through the standard router can succeed inside the corridor. An order that crosses a boundary reverts because that router does not expose the required price limit.

Finalization derives permanent liquidity amounts from pinned V4 math. Extra WETH stays locked; extra OTF joins the final burn. Any finalization failure also reverts a boundary purchase that invoked it. Zero LP fees do not remove transaction-ordering, slippage, liquidity, or price-impact risk.

Vault accounting assumptions

Vaults record the assets backing their shares separately from their actual token balances. Donations do not increase this recorded backing. Tokens that charge transfer fees, change balances, call external code during transfers, or allow administrators to change their behavior may create deficits or block operations. Users must assess each constituent and venue.

Mint fees increase the backing required for the requested net shares and round up. Redeem fees also round up. The creator’s portion rounds down and the remainder goes to buyback. Annual expense splits carry fractional remainders across checkpoints so checkpoint timing does not change the cumulative allocation.

Rounding prevents unbacked shares and fee undercharging. Small operations may require one additional raw unit.

Deployment controls

Production deployment requires explicit WETH, PoolManager, StateView, PositionManager, Universal Router, Permit2, and ETH/USD oracle addresses, with no fallback defaults.

Testnet uses the Robinhood mainnet-address V4 deployment with runtime hashes pinned on chain 46630. A matching hash verifies the expected bytecode at an address; operators and dependencies still require review.

Run corepack pnpm contracts:validate:mainnet-routing to test a local copy of Robinhood mainnet at one recent block. It checks 23 pinned dependency runtimes and rehearses deployment and allocation. The suites cover launch graduation, basket and ETH entry/exit, mixed adapters, fee settlement, buyback burns, and rollback when output falls below a minimum. They also trade five real stock tokens, test in-kind exits after adapter revocation, and check vesting against the live ETH/USD feed.

The Solidity security workflow runs these tests on matching pushes and pull requests, and supports manual runs. The rehearsal allows a 90,000-second oracle age: the feed’s 86,400-second heartbeat plus one hour. Final production roles, multisig execution, and the broadcast procedure remain unvalidated.

Current source and the testnet deployment use the canonical five-field V4 tuple. The deployment’s adapters are approved, and temporary Permit2 approvals are cleared after execution.

Production blockers

Before mainnet use, the project needs:

• an independent audit of the current contracts and economic arithmetic;
• rehearsal of the final production deployment procedure with the selected roles and multisig;
• reviewed multisig, beneficiary, WETH, oracle, and adapter configuration;
• deployment and verification of the canonical-WETH entry router, including receiver and callback-reentrancy tests;
• deployed-bytecode checks and reconciliation of the complete one-billion-OTF allocation;
• operational procedures for route generation, minimum outputs, root publication, and artifact retention;
• browser and wallet tests against the final addresses.

Report vulnerabilities privately to the maintainers. Do not test public deployments with real user funds.