How a fund works

Somebody who is good at picking stocks opens a fund in one transaction. Anyone can put money in. When the manager buys NVDA, every backer's share buys NVDA in the same proportion. The manager takes a cut of the profit and can never take the money itself.

Why it can exist here

To let a person manage your money in the old world you have to hand it over. That handover is what pulls in the licence, the custodian, the minimum, the paperwork and the regulator. Every rule in asset management is downstream of somebody else holding your money.

With a wallet nothing is handed over. The money sits in a contract you can exit in one transaction, and the manager can only point at a trade. They never hold it.

The second half is the asset. Copy-trading vaults elsewhere follow a perpetual future, which is a bet, or a basket of DeFi tokens. Here it is NVDA. This format has not been pointed at real equities before, because until Robinhood Chain there were no real equities to point it at.

The three walls

The manager gets exactly enough power to be a fund manager and not one bit more. Each wall exists because removing it is a way to steal.

Wall 3 is also why this is stocks only. The moment any token can be bought, any token can be used to steal, and no guard can tell the difference between a real one and one the manager minted this morning.

The terms a manager sets

A fund is opened with its terms written into it. They are printed on its page and read from the fund itself. What matters is not how many there are, it is which of them can move afterwards and in which direction.

There is deliberately no function that raises a fee, lengthens a lockup, widens the asset list or reopens a closed fund. A term that can be raised on somebody already inside is not a term, it is a trap.

How the manager is paid

Two ways, both capped, both paid in shares rather than in money.

• A cut of the profit, at most 30%, charged only above the share price each backer came in at. Somebody who backs a manager at the top pays nothing until the fund passes that point again, and nobody pays while the fund is down. The mark is held per backer, so a late arrival never pays a fee on profit earned before they got there.
• A yearly fee, at most 2%, charged whether the fund wins or loses. This is capped ten times harder than the profit cut because it is charged for showing up rather than for being right. Above that a fund can lose money every year and still pay its manager well, and the record stops meaning anything.
• The manager must hold shares in their own fund before the contract will let them trade it. Without that floor the best strategy is to gamble with other people's money and keep a cut of whatever survives.

Paying in shares is what keeps the first wall standing. The manager's slice grows and everyone else's shrinks, but nothing is transferred to anybody who is not a share holder.

The days a fund cannot be priced

Stock feeds run 24 hours a day, five days a week, and pause outright while a corporate action is processed. The pools never stop. So for most of any given week there is no honest price for a fund holding stock. The contract splits that in two.

• Deposits refuse. Issuing shares needs a price, and guessing one hands the difference to whoever deposits at the right moment.
• Exits always work. You are paid a proportional slice of each holding, which needs no price at all. The only thing that needs one is the fee, so when the fund cannot be priced you still leave with your exact slice and the manager is simply not paid.

Whether a given fund can be priced this second is on the Status page.

What a fund can hold

Only assets with both a real Chainlink feed and a real pool on this chain: NVDA, SPCX, TSLA, MU, AMZN, MSFT, GOOGL and AAPL, with USDG as the quote. That is fewer than it sounds. It is about the number of positions a real retail fund carries. The list was fixed when the factory was built and cannot be added to, which is what stops a manager buying a token they minted themselves.

A manager may narrow it further at opening, and give one up later. Giving one up stops the fund buying it again for good and still allows selling, so nothing already held is trapped.

What we tried to steal

Five ways to take money out of a fund you manage, each written as a test that actually runs against a fork of Robinhood Chain mainnet, using the real NVDA pool and the real Chainlink feed. All five are refused. The names below are the tests: they are in the repository and they run in about twelve seconds.

The attacks

The rules, one question each

A bug this found

The performance fee was being minted rather than moved. The fee is supposed to come out of the shares a leaving backer is redeeming and be handed to the manager. The helper that credited the manager also increased the total share count, so every fee taken created a second copy of itself and quietly diluted everybody who stayed.

It was invisible in ordinary use and invisible to every test that only checked the manager got paid. What caught it was the fork test asserting that after the last backer leaves, the only shares still in existence are the ones the manager earned.

// before: this bumped the supply, whether shares were being
// created or only changing hands
function _credit(address who, uint256 shares, uint256 price) private {
    ...
    totalShares += shares;
}

// after: the callers say which it is
_credit(msg.sender, shares, price);
totalShares += shares;              // a deposit creates shares

_credit(manager, feeShares, price); // the fee only changes hands

Pinned by test_TakingTheFeeMintsNothing, which checks the arithmetic directly rather than waiting for a fork to disagree.

What is not covered

• No third-party audit. Nobody outside this project has reviewed the contract.
• The venue is trusted. A fund routes through one Uniswap V3 router and reads Chainlink. If a feed reports a wrong price confidently, the fund believes it.
• The manager can still be bad at their job. None of this stops somebody losing your money honestly, which is the ordinary way money is lost.

The Risk page is the longer version of this list.

What can still go wrong

The contract stops a manager taking your money. It does not stop you losing it. Those are different sentences and the rest of this page is the difference.

Losing money the ordinary way

• The manager is bad at it. A public record makes that visible afterwards. It does not make it less likely.
• A short record proves nothing. A manager up 40% over two weeks is mostly telling you the market went up. There is no length of record this site can enforce.
• Concentration. A fund is allowed to hold one stock with everything. Its holdings are on its page; a fund holding one thing is a bet on one thing.
• The fee is real money. A yearly fee is charged whether the fund wins or loses. Over several flat years it is the whole of your loss.

Things about this system in particular

• Deposits are shut most of the week. Stock feeds run five days a week and pause during corporate actions. Issuing shares needs a price, so a deposit refuses when there is not one. Exits always work.
• A lockup means what it says. If a fund has one, you cannot leave inside it, including on the day you decide the manager is wrong. It is printed on the fund's page before you deposit and it can only ever be shortened.
• Every fill costs something. A trade pays pool fees and moves the price against itself. Measured on a real pool an honest round trip cost 0.03%. A manager who trades constantly pays that constantly, out of your money.
• You are paid out in kind. Leaving gives you a proportional slice of whatever the fund is holding, which may be stock rather than cash. Selling it is your problem and your cost.

Things that could break underneath

• The contract is not audited. Five attacks were written and refused, and they are named on the Security page. An attack nobody thought of is not on that page.
• Chainlink is trusted completely. Every price check, every valuation and every fee depends on a feed. A feed reporting a wrong price confidently would be believed.
• One venue. A fund routes through a single Uniswap V3 router. If that router is compromised or the pool is empty, trades fail or fill badly.
• The chain is young. Robinhood Chain is new. Its liquidity is thin next to the venues these stocks normally trade on, and thin liquidity is what makes a fill bad.

Things outside the code entirely

• Managing other people's money without a licence is a real regulatory shadow, even where nothing is ever custodied and the manager cannot touch the money. Nobody has tested where that line sits for a contract like this one.
• Tokenised stock is not stock. What a fund holds is a token that tracks a share. What that entitles you to, and from whom, is set by whoever issues it, not by this contract.
• This site can go away. The funds do not. Every number here is read from the chain and every fund can be withdrawn from by calling it directly.

Reading chain status…

Privacy

What this software does with a request. Read what it is not before you read the rest.

What it does not do

None of the following appears in this application's source or its dependencies.

• No analytics and no telemetry. There is no analytics package, no product-metrics SDK, no session recorder and no error reporter.
• No cookies. Nothing is written to your browser to identify you across visits. There is no consent banner because there is nothing to consent to.
• No account. There is no sign-up, no email field and no password anywhere in this application. Connecting a wallet is not an account: it is your browser telling the page an address it already knows.
• No third-party embeds. No pixels, no ad tags, no social widgets, no chat bubble. The only asset loaded from outside this origin is a font.

What it does do

• It reads the chain. Every number on this site is read from Robinhood Chain over an ordinary RPC call. Those calls carry no identity of yours, only which contract is being read.
• It asks your wallet to sign. Depositing, trading and opening a fund each build a transaction and hand it to your wallet. This site never sees a private key and never holds funds.
• Its host keeps ordinary server logs. Whoever serves these pages sees the request: an IP address, a page path, a time. That is true of every website and is not something this application controls or reads.

What is public whether we like it or not

Everything a fund does is on a public chain, and that is the point of the product rather than an accident of it.

• Your deposit, your withdrawal and the size of your position are visible to anybody.
• The address that opened a fund is its manager, permanently and in public.
• A profile handle or a line of text a manager writes is written into a contract. It cannot be deleted afterwards, by them or by us.

If you would rather your position was not tied to an address people already know, use a different one. That is the only privacy control that actually works here, and it is not one this site can give you.