Risk

Read this before buying a pack. It is ordered by what is most likely to cost you money.

1. Equity market risk

A slip holds a fixed quantity of one Robinhood Stock Token, which tracks the price of a listed company. If that company's share price falls, the slip's floor falls with it. A pack contains stock worth the pack price at the moment it is opened, not afterwards. SCRIP does not protect against, hedge, or compensate for price moves, and nothing in this protocol is an investment recommendation.

Stock Tokens are economic exposure, not legal ownership of shares. You do not hold voting rights, and dividends are not paid to you in cash: the issuer folds them into the token's uiMultiplier (see Gate 3 in EVIDENCE.md). Read Robinhood's Stock Token terms before holding any.

2. Jurisdiction

Robinhood Stock Tokens are not available to US persons and are restricted in other jurisdictions. The token contracts carry an issuer blocklist (isBlocked(address), verified on the mainnet implementation). If your address is blocked by the issuer, redeem will fail at the token transfer, exactly as any transfer of the raw token would; SCRIP cannot override it. The app refuses to show a purchase flow to users who identify as US persons and requires an explicit attestation before every commit. That attestation is yours; SCRIP does not verify identity.

3. Issuer control of the underlying token

The Stock Token implementation sits behind an upgradeable beacon controlled by the issuer and exposes pause(), isBlocked, mint, and multiplier updates. The issuer can therefore pause all transfers, change the multiplier, or upgrade the token logic. SCRIP holds the tokens like any other holder and is exposed to these actions in the same way. It adds no pause of its own and no way to remove the issuer's.

4. Swap slippage on the way in

Opening a pack swaps the escrowed USDG into five Stock Tokens through Uniswap. The only cost of entry is that swap's slippage plus the pool fee. The contract refuses any swap whose execution price is more than 2 % worse than the Chainlink Total Return Value price (MAX_DEVIATION_BPS = 200) and redraws instead. The app shows the expected slippage before you commit and the realised slippage per slip after the reveal. Measured slippage for the launch series is in DEPTH.md.

5. Randomness

There is no Chainlink VRF on Robinhood Chain. The draw uses a future L2 block hash fixed at commit time. The chain's single sequencer could, in principle, bias it; no user can. A reveal that nobody performs for ~51 minutes is retargeted to a fresh unknown block, which gives a patient buyer a second unknown sample but never a chosen one. Details and mitigations: RANDOMNESS.md.

6. Off-hours and oracle pauses

Chainlink equity feeds update 24/5 and hold their last price when markets are closed. When fewer than a pack's worth of companies are fresh, commit reverts with MarketClosed; you cannot buy a pack the protocol could not open. If a company's oracle is paused for a corporate action at reveal time, that company is skipped for that pack and another is drawn. If every company is unavailable for 24 hours after your commit, you can refund the full escrow.

7. Liquidity of slips

A slip's floor is enforced by redeem. Its ceiling depends on whether anyone wants to buy it. There may be no buyer for a given serial, company, or set, in which case the slip is worth exactly its contents and nothing more.

8. Smart-contract risk

The contracts are new, unaudited at the time of writing, and non-upgradeable. Their properties are documented in SECURITY.md and enforced by the test suite, including a 50 000-call invariant over the backing accounting. Bugs may still exist. Do not commit more than you can afford to lose to a contract failure.

9. Governance

Series creation and asset registration sit behind a 48-hour TimelockController. Within its powers the owner can add companies to the registry, disable them for future draws, change the feed-staleness grace, and withdraw royalties. The owner cannot move backing, escrow, or pause redemption. Proposer keys are a trust assumption for what gets published, never for what you already hold.

10. Keeper liveness

Packs are opened by whoever calls reveal, paid a 0.25 USDG bounty from the royalty balance. If the royalty balance is empty and no one runs a keeper, packs still open but the caller pays their own gas. The protocol runs a keeper (scripts/keeper.ts) and funds the bounty balance at launch.