Commodity Rebalanced Index · Robinhood Chain
One token. A basket of real commodities. Keepers keep it on target, and an immutable contract makes sure they can only ever help. Withdraw whenever you like — in dollars, or in the commodities themselves.
Phase 0 · contracts tested · not deployed yet
A demonstration, not live data. Prices wander, weights drift away from the gold marks, and when the drift crosses the band any stranger may call rebalance() and be paid a few cents for it. The contract simply refuses every trade that would not close the gap.
The gap
Fifty-six of them, in fact — and most through thin synthetic coins. If you want the asset class rather than a position, you are on your own.
There is no commodity index on this chain. Diversifying means buying five things, working out the weights, watching them drift, and trading them back into line yourself. Forever. Most people simply don't.
Most commodity coins here are synthetic: one key can mint them, and the bid side of their peg is only the dollars the pool has collected so far. Meanwhile "index products" usually mean a custodian and a manager's fee.
Build the basket on the assets that are genuinely backed — the official tokenized gold, silver and oil — use synthetics only in a small, capped sleeve, and let an immutable contract hold the weights. Calm on the surface, checkable underneath.
How it works
You deposit and, one day, you redeem. Everything between those is somebody else's gas bill.
YOU THE VAULT ANYONE YOU
─────────── ───────────────────── ─────────── ───────────
deposit USDG ──▶ buys GLD · SLV · USO ──▶ prices move ──▶ redeem, any time
at the target weights weights drift ▸ back to USDG
and mints you shares past the band ▸ or in kind
│
▼
rebalance() — permissionless
trims what grew, tops up
what fell, pays the caller
a capped few cents
Send USDG. The vault buys the underlying at the target weights and mints you a share of the basket. Your shares are worth exactly what the vault actually gained — you pay your own entry slippage, not everyone else's.
Gold runs, oil stalls, weights slide away from target. The vault publishes the gap as a single number, in basis points, that anyone can read.
Once the drift crosses the band, anyone may submit a plan. There is no keeper allowlist and no manager. The contract reverts unless the plan measurably closes the gap.
Burn shares, take your slice. In dollars if the venues are working, or in the underlying tokens themselves if they are not. That second door can never be closed.
Baskets
Every basket shows what actually backs it. Not a category, not a promise — the split between real-backed tokens and synthetic exposure, on the card.
Those coins are priced by a feed one key writes, their peg mints the ask but only collects the bid, and their pools hold tens of thousands of dollars — not millions. So: 10% of a basket by default, 5% for any one coin, and a 25% ceiling that governance cannot raise. Before selling one, the vault asks the venue how deep the bid actually is, and refuses to push more size than that into it.
Agriculture and livestock are deferred: the tokens exist, the liquidity does not. Two categories are excluded permanently — one because fast food is not a commodity, the other because pharmaceuticals are a legal minefield nobody needs an index of.
The walls
rebalance() is open to anyone. That is deliberate, and it is why
these are written in code rather than in a policy nobody can enforce.
Governance can move weights and caps behind a 48-hour timelock. It cannot
touch a single one of these.
A rebalance reverts unless the drift strictly falls — and unless the value it moved is proportionate to the gap it closed. Selling the basket into cash is the largest drift there is, so it fails. Washing one asset out and back changes nothing, so it fails. Padding an honest trade with unnecessary size fails on the same wall.
Every leg's minimum comes from the oracle, never from the caller. And the fill is measured as the vault's own balance before and after — the router's return value is a claim, the balance difference is the fact. A stale or non-positive price stops the trade rather than guessing.
Redemption pays the redeemer, and in-kind redemption can never be switched off — it is the exit that still works when every swap venue on the chain is broken. The only other outflows in the contract are a capped keeper bounty and a bounded fee. There is no admin address in the vault. Not a paused one, not a timelocked one.
A keeper's ceiling: one tenth of one percent of what it moved, and it may not move more than four times the gap it closed. Bringing a badly drifted $50,000 basket back in line pays roughly one dollar. It is a gas subsidy, not a business.
Proof
Everything below was read off Robinhood Chain, not off documentation. The test suite runs against the live chain, so the wiring is checked rather than assumed.
assets
USDG 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 6 decimals
GLD 0xC9a981FEE1F9DEc688bb123ccDeCc63D0deBFC4e 18 decimals
SLV 0x411eFb0E7f985935DAec3D4C3ebaEa0d0AD7D89f 18 decimals
USO 0xa30FA36Db767ad9eD3f7a60fC79526fB4d56D344 18 decimals
the synthetic price feed 0x3B784715e1ecFDC6A59707d5b05e5bc898159ab7
the contract is not verified on the explorer, so its interface was
recovered by probing the dispatcher and confirmed against live values:
key keccak256(symbol) e.g. keccak256("XPT")
latest(key) → (price, sourceTs, publishTs) selector 0x79feb107
price 18 decimals XPT read back at $1830.50
assetCount() 56
assetConfig() carries the feed's own staleness bound: 3600s
CRI applies a stricter bound than the feed sets for itself, and checks
both timestamps: one catches a feed that stopped writing, the other a
feed that keeps writing a stale quote.
Most of them are a hostile keeper trying things: liquidating the basket for a bounty, washing a trade to inflate the notional, splitting one rebalance into ten to farm a cap, routing through a pool that pays badly, quoting a fill it never delivered. Each attempt has a test, and each test names the wall that stops it.
Two addresses: the Chainlink feeds for gold, silver and oil, and the Uniswap router on this chain. The deploy script deliberately refuses to guess either — deploying a vault against a feed nobody checked is exactly the mistake this is built to avoid. And it is not audited. The cap stays at $50,000 until it is.
Found while building
Paying a keeper a slice of what it moved is the obvious design: it scales with the work, and splitting a job into ten transactions pays exactly what doing it once pays, so there is nothing to farm. That part held.
What didn't: a keeper could submit a plan that genuinely closed a little of the gap, then pad it with a large round-trip that closed none of it. The gap fell, so the wall let it through — and the fee was priced off the padding. The keeper paid gas; the basket paid the slippage.
The fix is one line, and it is now part of the first wall: a rebalance may not move more than four times the value of the gap it closes. Honest plans sit near half of that, so the ceiling is eight times looser than the work needs — and padding stops being possible rather than merely unprofitable. It fell out of writing the test that was supposed to prove the design was already safe.
Status
There is no sale, no allowlist, no points, and nothing to buy. When there is, it will be after the thing works.