How a fund works
Somebody who is good at picking stocks opens a fund in one transaction. Anyone can put money in. When the manager buys NVDA, every backer's share buys NVDA in the same proportion. The manager takes a cut of the profit and can never take the money itself.
Everything on this page is a description of code you can read, not a promise this site is making. Where a sentence says the contract refuses something, there is a test that tried it. Those are on the Security page.
Why it can exist here
To let a person manage your money in the old world you have to hand it over. That handover is what pulls in the licence, the custodian, the minimum, the paperwork and the regulator. Every rule in asset management is downstream of somebody else holding your money.
With a wallet nothing is handed over. The money sits in a contract you can exit in one transaction, and the manager can only point at a trade. They never hold it.
The second half is the asset. Copy-trading vaults elsewhere follow a perpetual future, which is a bet, or a basket of DeFi tokens. Here it is NVDA. This format has not been pointed at real equities before, because until Robinhood Chain there were no real equities to point it at.
The three walls
The manager gets exactly enough power to be a fund manager and not one bit more. Each wall exists because removing it is a way to steal.
1. Money only leaves to its owner
test_Attack_ManagerCannotWithdrawwithdraw pays the caller a proportional slice of every holding the fund has. There is no other function that moves value out, and no argument anywhere that names who to pay. Both fees are paid in shares, so the manager leaves the same way a backer does.
2. The manager names a token, never a call
test_Attack_NoArbitraryCallPathA trade names the token to sell and the token to buy. No function takes a target address or calldata, so the fund cannot be made to call a contract the manager wrote.
3. Both sides on the list, and the fill is checked afterwards
test_Attack_ZeroSlippageSelfSandwichA slippage limit alone is not enough. A manager can set it to zero and collect the difference as the other side of their own trade, which is how trading vaults are usually drained. So the check is on the price the trade actually got, compared against Chainlink after the swap, not on the minimum the caller promised.
Wall 3 is also why this is stocks only. The moment any token can be bought, any token can be used to steal, and no guard can tell the difference between a real one and one the manager minted this morning.
The terms a manager sets
A fund is opened with its terms written into it. They are printed on its page and read from the fund itself. What matters is not how many there are, it is which of them can move afterwards and in which direction.
| Term | Set at | Afterwards |
|---|---|---|
| Cut of the profit | Opening, at most 30% | may only be lowered |
| Yearly fee | Opening, at most 2% | may only be lowered |
| Lockup | Opening | may only be shortened |
| Manager's own money in it | Opening | fixed |
| Smallest deposit, fund cap | Opening | fixed |
| Which assets it may buy | Opening | may only be narrowed |
| Open to new money | Opening | may be closed once, never reopened |
| Price band, feed staleness | The same for every fund | never |
There is deliberately no function that raises a fee, lengthens a lockup, widens the asset list or reopens a closed fund. A term that can be raised on somebody already inside is not a term, it is a trap.
How the manager is paid
Two ways, both capped, both paid in shares rather than in money.
- A cut of the profit, at most 30%, charged only above the share price each backer came in at. Somebody who backs a manager at the top pays nothing until the fund passes that point again, and nobody pays while the fund is down. The mark is held per backer, so a late arrival never pays a fee on profit earned before they got there.
- A yearly fee, at most 2%, charged whether the fund wins or loses. This is capped ten times harder than the profit cut because it is charged for showing up rather than for being right. Above that a fund can lose money every year and still pay its manager well, and the record stops meaning anything.
- The manager must hold shares in their own fund before the contract will let them trade it. Without that floor the best strategy is to gamble with other people's money and keep a cut of whatever survives.
Paying in shares is what keeps the first wall standing. The manager's slice grows and everyone else's shrinks, but nothing is transferred to anybody who is not a share holder.
The days a fund cannot be priced
Stock feeds run 24 hours a day, five days a week, and pause outright while a corporate action is processed. The pools never stop. So for most of any given week there is no honest price for a fund holding stock. The contract splits that in two.
- Deposits refuse. Issuing shares needs a price, and guessing one hands the difference to whoever deposits at the right moment.
- Exits always work. You are paid a proportional slice of each holding, which needs no price at all. The only thing that needs one is the fee, so when the fund cannot be priced you still leave with your exact slice and the manager is simply not paid.
Whether a given fund can be priced this second is on the Status page.
What a fund can hold
Only assets with both a real Chainlink feed and a real pool on this chain: NVDA, SPCX, TSLA, MU, AMZN, MSFT, GOOGL and AAPL, with USDG as the quote. That is fewer than it sounds. It is about the number of positions a real retail fund carries. The list was fixed when the factory was built and cannot be added to, which is what stops a manager buying a token they minted themselves.
A manager may narrow it further at opening, and give one up later. Giving one up stops the fund buying it again for good and still allows selling, so nothing already held is trapped.