TETRAVAULT

Abstract

TETRA is a token on Robinhood Chain whose every unit can be burned for its share of a basket of four real tokens: SPY (US stocks), GLD (gold), USO (oil) and WETH (Ethereum), 25% each. The basket sits in a reserve contract with no owner, no withdraw, no pause and no upgrade. Assets leave it only in three ways: a holder redeeming TETRA, a USDG loan against TETRA locked in the reserve, and the harvester spending the reserve's spare cash, either on the four legs or, when the reserve is large next to the pool, on buying back TETRA and burning it.

Every trade pays a 5% tax in USDG. After the 2-minute launch window, 4 points go into the reserve and buy the basket and 1 point goes to the team, fixed forever. Selling near the backing burns tokens, bonds sell new TETRA up to 20% below market but never below the backing, and stakers are paid only from real growth of the reserve, through a payout bank that spreads a good day over the next rounds instead of minting it all at once.

This is the third vault after SEMI (MU-backed, Robinhood Chain) and OHMVAULT (OHM-backed, Ethereum). It keeps their engine of staking, bonding, a ratcheting mint and a launch-window tax, and changes the one thing those two could not offer: a reserve you can actually redeem, in assets people already want to hold.

The reserve

The backing per TETRA is the reserve's value divided by the TETRA in circulation, and anyone can redeem at it at any time after the 2-minute launch window.

• What the reserve holds. Four legs at a fixed 25% weight each: SPY, GLD, USO and WETH, all real Robinhood Chain tokens, plus USDG cash. The larger of 20% of the reserve's value and $1,000 always stays in USDG, so loans and the instant USDG exit always have cash; only cash above that is converted. Cash is turned into legs by a permissionless harvest once a leg's budget reaches $100, and only while that leg's pool trades no more than 1% above its Chainlink price (a pool below Chainlink is a cheaper buy, so it is allowed). The cash kept also covers any USDG out on loan.
• How it is valued. Each leg is priced by Chainlink and checked against its pool's 30-minute TWAP. If the two differ by more than 5%, or a feed is stale (7 days for stocks, so market holidays never trip it; 26 hours for crypto), that leg is down: bonds and staking payouts pause, and new loans and the instant USDG exit count it as worth nothing, until it recovers. A leg that stays down for 14 days is retired and stops blocking anything. Redeems never pause.
• Circulating supply. Total supply minus the TETRA owned by the protocol's own pool position. TETRA locked as loan collateral still counts, and the USDG lent against it still counts as reserve money, so an open loan never changes what a token redeems for. The pool's TETRA is never counted as circulating, so it can never be redeemed against the reserve.
• Redeem in kind. Burning TETRA pays its pro-rata share of every leg and of the cash, at once, to any address. 5% of the share stays behind: 4 points remain in the reserve for every holder who stays, 1 point goes to the team. A paused or frozen stock token becomes a claim the holder collects later; the other legs still pay immediately. A helper contract can sell the legs to USDG in the same transaction for an extra 0.5%.
• Donations. Anyone can fund the reserve with USDG or a leg. Donations unlock over 7 days so nobody can redeem just before one lands and snipe it.
• First-hour guard. During the first hour after launch the redeem denominator is never smaller than 25% of the initial supply, so an early whale cannot drain a tiny reserve by redeeming against a tiny circulating count.

The reserve and redeeming, in detail

Any wallet holding TETRA can burn it at any time from 2 minutes after launch and receive, in the same transaction, 95% of its exact share of everything the reserve holds. No price feed, keeper, team member or pause can stop it.

What the reserve is

The reserve is one contract, Reserve, that holds five assets: SPY, GLD, USO, WETH and USDG cash. It has no owner, no admin function, no withdraw, no rescue, no pause and no upgrade path; its four legs and their 25% weights are fixed at deploy.

For each asset it keeps three books, and only one of them can be redeemed:

Book	What it is	Redeemable
Settled	Everything that has fully arrived and counted	Yes
Pending	Donations still unlocking over 7 days	Not yet, it moves into settled each second
Claims	Payouts owed to redeemers whose leg transfer failed	No, already owed to them

Settled is always re-checked against the real token balance: settled = min(recorded, balance − pending − claims). If a stock issuer burns or freezes tokens held by the reserve, redeems simply pay less of that leg. They never revert and never pay out more than is there.

How money gets in

Source	Credited	Counts in the reserve
Trade tax (4% of every trade, fixed)	In USDG, every time $50 of tax has gathered	At once
Bonds (95% of the USDG)	In USDG, in the bond transaction	At once
Redeem retention (4 of the 5 points)	Never leaves	At once
Donations through fund()	Any leg or USDG	Linearly over 7 days
Tokens sent to the reserve directly	Picked up by absorb()	Linearly over 7 days
Loan repayments	The exact units that were lent	At once

Cash does not stay cash. A permissionless harvest buys each leg back to its 25% weight once that leg's budget reaches $100, only while the leg's pool trades no more than 1% above Chainlink (buying below it gets the reserve more units per dollar), and with a 2% (3% for WETH) slippage limit, and always leaving the larger of 20% of the reserve and $1,000 in USDG. Harvesting changes what the reserve holds, not what it is worth.

The reserve buyback

When the reserve grows past 60% of the USDG in the pool, the pool is the thinner side, so new cash does more as price support than as more basket. The harvester then buys TETRA from the pool and burns it.

• Trigger. Reserve value (low valuation) above 60% of the pool's USDG. The pool's USDG is read as the larger of its spot and 30-minute-TWAP value, so dumping the pool cannot fake a trigger.
• 10-minute hold, both ways. Crossing 60% starts a 10-minute clock; while it runs the reserve buys nothing and keeps new cash in USDG. Crossing back inside the 10 minutes cancels the switch. The same hold applies on the way back to buying the basket.
• Size and caps. Each buy is at least $100 and at most 1% of the pool's USDG, one per minute, sized to bring the reserve back to 60%. It spends only cash above the buffer (the larger of 20% of the reserve and $1,000, plus any USDG on loan). The four basket tokens are never sold for it.
• Price guard. No buy while the pool price is more than 2% above its 30-minute TWAP. The buyback's own price impact is excused, but the reference it may climb to is capped at TWAP + 5%, so pumping before each buy cannot walk the buy price up.
• Burned at once. Everything bought is burned in the same transaction.
• Stakers keep being paid. The payout reference is lowered by exactly what the reserve spent, so a buyback is never read as lost growth, and never as new growth.

Simulation of the on-chain rules ($70k reserve, $100k pool USDG). The same rules are tested in test/integration/Buyback.t.sol.

What changes for holders: supply shrinks and the price rises, while backing per token falls by the amount spent divided by circulating supply. It only runs while the reserve is large next to the pool, turning an over-funded reserve into price support. A keeper calls harvest about once a minute so it can act within a minute of the 10-minute hold ending.

When you can redeem

• Open from the end of the launch window, 2 minutes after trading opens, and from then on, always.
• Never paused by prices. An unhealthy price feed stops bonds, staking payouts, new loans and the instant USDG exit, but not redeems: a redeem pays a share of each asset in kind and needs no price at all.
• No cooldown, no queue, no minimum. Any amount up to the circulating supply, in one transaction.
• First hour after launch. The redeem divides by at least 25% of the initial supply (2,500,000 TETRA), even if less is circulating. This stops a single early buyer from redeeming a tiny circulating supply against the first tax inflows. After one hour the plain circulating supply applies.

Who can redeem

• TETRA in a wallet: any holder, for any destination address.
• Staked TETRA: unstake first (6-hour cooldown, free) or leave instantly (20% penalty), then redeem.
• Bonded TETRA still vesting: take the unlocked part at any time, then redeem it.
• Never redeemable: the TETRA inside the protocol's own pool position. It is never counted as circulating, so it can never claim any of the reserve. TETRA locked as loan collateral can't be redeemed until the loan is repaid, but it still counts as circulating.

How a redeem works

1. The redeemer approves the reserve for the amount (the site does this in the same flow) and calls redeem(amount, to).
2. The reserve settles every asset's books, then computes the share of each asset: amount ÷ circulating × settled.
3. It removes the whole share from its books before any transfer, burns the TETRA, then sends each asset separately: 95% of the share to to, 1% of the share to the team, and the remaining 4% simply stays.
4. If one leg cannot be sent (a paused stock token, a frozen address), that leg becomes a claim of the redeemer, collected later to any address with claimLeg. The other legs still pay at once.

Worked example. 1,000,000 TETRA circulating; the reserve holds 20 SPY, 40 GLD, 95 USO, 6 WETH and $400 USDG. Redeeming 10,000 TETRA (1% of circulating):

Asset	1% share	You receive (95%)	Team (1%)	Stays (4%)
SPY	0.2	0.19	0.002	0.008
GLD	0.4	0.38	0.004	0.016
USO	0.95	0.9025	0.0095	0.038
WETH	0.06	0.057	0.0006	0.0024
USDG	$4.00	$3.80	$0.04	$0.16

The 10,000 TETRA are burned. Every remaining holder now owns a slightly larger share of a reserve that kept 4% of the redeemed part.

Redeem to USDG. A helper contract (RedeemToUSDG) redeems and sells each leg to USDG in the same transaction for an extra 0.5%. The redeemer sets a minimum per leg; a leg that cannot be sold within it is delivered in kind instead. The site shows the in-kind value and the pool sale side by side and picks the better exit.

What counts as circulating

circulating = total supply − the pool's TETRA. For the pool's TETRA the reserve takes the smallest of three readings: now, at the round's snapshot, and the lowest seen after any swap this round. Selling into the pool raises the pool's TETRA, so without the minimum someone could sell, shrink circulating and redeem a bigger share in one block. With it, circulating can only fall through burns inside a round.

What moves the backing per token

Event	Effect on the backing per token
Trade tax, donations	Up
A redeem	Up (4% of the share stays)
A sell near the backing	Up (part of the sale is burned)
A bond	Never down (it pays at least backing ÷ 0.95 per token)
A loan, or a loan that is closed unpaid	Up
Staking payouts	Down, never below 90% of the best close
Prices of SPY, GLD, USO, ETH	Up or down with the basket
Harvest	Flat, minus at most its slippage limit
Reserve buyback	Down by the cash spent ÷ circulating; the price goes up and supply goes down

Worked example: from the seed to 20× and back

This follows one path with real launch numbers, so you can see when redeeming starts to make sense. All values are computed from the contract formulas and checked by an on-chain test (below).

The start. The live pool opens with 9,250,000 TETRA and 10,000 USDG (about $0.00108 per TETRA); the other 750,000 TETRA (7.5%) go to team, advisor and investor wallets at launch. This example rounds to a 10,000,000-token pool at $0.001, which changes no ratio below, so market cap (every token × price) is $10,000. The pool itself holds $20,000 of value ($10k USDG plus $10k of TETRA), which is why the start can look like a $20k market cap. It isn't: the TETRA half of the pool is the same supply that the market cap already counts.

The pool's USDG grows with the square root of the price, not with the price. The pool is full range and constant product, so 10× the price puts √10 ≈ 3.16× the USDG in it.

Price vs launch	Price	Market cap	USDG in pool	TETRA in pool	Circulating	USDG bought in
1×	$0.001	$10,000	$10,000	10.00M	0	$0
2×	$0.002	$20,000	$14,142	7.07M	2.93M	$4,142
5×	$0.005	$50,000	$22,361	4.47M	5.53M	$12,361
10×	$0.01	$100,000	$31,623	3.16M	6.84M	$21,623
20×	$0.02	$200,000	$44,721	2.24M	7.76M	$34,721
50×	$0.05	$500,000	$70,711	1.41M	8.59M	$60,711
100×	$0.10	$1,000,000	$100,000	1.00M	9.00M	$90,000

So a 10× is $31.6k of USDG in the pool, not $100k. The pool only holds $100k of USDG at 100× ($1M market cap).

A big day at 20×. Price $0.02, market cap $200k, 44,721 USDG and 2.24M TETRA in the pool, 7.76M TETRA circulating. That day trades $500,000 of volume, and 4% of it goes to the reserve: about $20,000.

• Backing per token: $20,000 ÷ 7.76M = $0.00258.
• Redeeming pays 95% of that: $0.00245 per TETRA, about 12% of the price.
• Selling pays about $0.019 per TETRA before slippage (95% of the price after the 5% tax).
• Price ÷ backing is about 7.8×.

Redeem is open from 2 minutes after launch, but at 20× nobody uses it: selling pays almost 8× more. The reserve is the backing under the price, not an exit at the price.

When redeeming wins: if holders dump. Say holders keep selling in small pieces from that point. Every sell pays 4% into the reserve, and every sold token leaves circulation (it goes back into the pool, or is burned near the backing). So backing per token rises while the price falls:

• The near-backing sell burn starts when the price drops under 1.4× backing: at about $0.0052 (−74% from the peak), after 28% of circulating has been sold. Backing is already up to $0.0037.
• Redeeming pays as much as selling at about $0.0042 (−79% from the peak, market cap ~$41k). Backing is then $0.0042, 61% higher than at the peak: the reserve grew to ~$21k while circulating fell from 7.76M to 5.05M (35% sold back into the pool, 51k TETRA burned).
• From there, redeeming and selling pay about the same, and the price can't go much lower: anyone can buy under the backing and redeem at a profit, which pushes it back up.
• The backing ends at about 4.2× the launch price.

Without a dump: how fast the backing catches the price. If the price just sat at $0.02, backing reaches the price once the reserve holds $0.02 × 7.76M = $155k. At 4% of volume that is $3.9M traded, or about 8 days of $500k days. Rule of thumb: the backing reaches the price after total volume of about 25× the circulating market cap (1 ÷ 4%).

Tested on the real contracts. test/integration/RedeemExample.t.sol runs this path on the full system (seed scaled to 1M TETRA + $5k; every result is a multiple of the seed, so the ratios match):

• 10× the price leaves 3.16× the seed USDG in the pool.
• At 20× after a heavy day: price ÷ backing 7.69; redeeming 10,000 TETRA pays $123, selling them pays $909.
• During a dump in 40 pieces, redeeming catches up with selling after 14: at 20% of the peak price, 4.16× the launch price, with backing 50% above its peak level and price ÷ backing 1.06.

Not included: staking payouts (they add supply and dilute backing a little), slippage when you convert redeemed stock tokens to cash, and timing (the burn reads backing from the last 6h snapshot).

Reserve FAQ

What is the reserve, in one line? A contract with no owner that holds SPY, GLD, USO, WETH and USDG for TETRA holders, and pays any holder their share in kind when they burn TETRA.

Why have a reserve at all? So TETRA has an exit that does not depend on someone else buying. SEMI and OHMVAULT showed a floor number that nobody could actually claim; here the reserve is a function anyone can call. Every trade's tax keeps adding to it, so volume turns into backing instead of disappearing.

Why four assets instead of one? One asset ties the token to one story. Stocks, gold, oil and Ethereum rarely all fall together, so the basket is steadier than any one of them, and each is already a token on Robinhood Chain that people want to hold.

Why 25% each, and why can't it change? Equal weights need no manager and no opinion. Weights and legs are fixed at deploy, so nobody can swap the basket for something worse later.

Can the team take the reserve? No. There is no owner, no withdraw, no pause and no upgrade. Assets leave only through a holder's redeem, a loan against TETRA locked in the reserve, or the harvester spending spare cash on the legs or on the reserve buyback.

When can I redeem? Any time from 2 minutes after launch. No cooldown, no queue, no minimum, and price-feed problems do not stop it.

What do I receive, tokens or dollars? Either. In kind: your share of SPY, GLD, USO, WETH and USDG, sent to any address you choose. In dollars: the instant USDG exit pays 94.5% of your share (the legs valued at their lowest live price) straight from the reserve's cash in one transaction, while every leg is up and the cash covers it. The USDG helper, which sells the legs for an extra 0.5%, also still works.

How much do I get? 95% of your TETRA ÷ circulating TETRA of every asset the reserve holds. The site shows that value and the pool price side by side and uses whichever pays more.

Why is 5% kept? 4 points stay in the reserve for the holders who remain, so every exit lifts the backing for everyone else, and 1 point goes to the team. It also means a bond bought at the backing and redeemed straight away always loses money, so nobody can farm the reserve.

Why does the backing per token grow? The trade tax (4 of every 5%), bonds sold above the backing, the 4% kept on every redeem, sell burns near the backing, donations and unpaid loans all add value or remove tokens. Two things lower it: staking payouts, which can never push it below 90% of its best close, and the reserve buyback, which spends reserve cash to burn TETRA. The buyback lowers backing per token but raises the price, and it only runs while the reserve is worth more than 60% of the pool's USDG.

Can the backing go down? Yes, if SPY, gold, oil or Ethereum fall: the reserve holds them, so it moves with them. Staking payouts lower it slightly, and so does the reserve buyback (by the cash spent ÷ circulating supply). Nothing else can.

What if a stock token is paused, or its issuer freezes the reserve? Each asset pays separately. A leg that cannot be sent becomes a claim you collect later to any address; the other legs still pay at once. If an issuer burns tokens from the reserve, redeems pay less of that leg and never revert.

What if a price feed breaks? Redeems keep working, because they pay a share of each token and need no price. Bonds, staking payouts, new loans and the instant USDG exit pause until the feeds agree again. A feed that stays broken for 14 days is retired and stops blocking them.

Why does the TETRA in the pool not count? It belongs to the protocol's own liquidity, not to any holder. If it counted, the pool could be cashed out against the reserve. It also never can be: when the liquidity lock ends, a withdrawal burns the pool's TETRA.

Why do donations unlock over 7 days? So nobody can buy just before a large donation, redeem right after it lands and take a share of a gift meant for long-term holders.

Why the first-hour rule? In the first hour very little TETRA is circulating. Dividing by at least 2.5 million tokens stops one early buyer from redeeming most of the first tax inflow.

Is redeeming better than selling? It depends on the price. Far above the backing, selling into the pool pays more. Near the backing, sells burn part of the tokens, and redeeming can pay more. The site compares both for your exact amount.

Are these real stocks? They are the Robinhood Chain tokens for SPY, GLD, USO and WETH (wrapped ETH), held by the reserve and paid out as those same tokens. What each token gives its holder is set by its issuer, not by TETRA.

The pool and the launch

TETRA trades in one Uniswap v4 pool against USDG, owned entirely by the protocol and seeded with 10,000 USDG against 9,250,000 TETRA, an opening price of about $0.00108. The other 750,000 TETRA (7.5% of the 10,000,000 supply) are sent at launch: 500,000 to five team and advisor wallets (100,000 each) and 250,000 (2.5%) to a private investor. Part of this allocation went to private investors who paid for it before launch. There was no public presale, and nobody could buy from the pool before the first trade. The allocation has no vesting: it trades, stakes and redeems like any other TETRA. There is no other premine and no mint key.

• One pool, protocol-owned. Nobody else can add liquidity, and the pool charges no LP fee: the 5% tax is the whole cost of a trade.
• Locked until 1 January 2027. Before that date nothing can move the liquidity. After it the lock owner can extend the date, burn the lock forever, or withdraw. A withdrawal sends only the USDG side out; the TETRA side is burned, so circulating supply and the backing per token do not change.
• The launch window. Trading opens with a 97% tax that slides to 90% at 10 seconds, 70% at 30 seconds, 40% at 60 seconds and 5% at 120 seconds, smoothly between those points. A bot buying in the first seconds hands almost all of it to the tax; a real buyer who waits two minutes pays the normal 5%. Everything taxed inside those 120 seconds goes to the team; redeems and bonds stay closed until the window ends.
• Trading through the site. Hooked v4 pools cannot be traded straight from a wallet, so the site uses a small router (VaultSwap). It adds a 1% site fee in USDG on top of the 5% pool tax, 6% all-in; any other contract can trade the pool without it. The router can also buy with ETH, and can buy and stake in one transaction.

The trade tax

Every buy and sell pays 5% in USDG: 4% to the reserve and 1% to the team, always. The split is fixed forever from the end of the launch window.

State	Reserve	Team	When
Base	4%	1%	From the end of the 2-minute launch window

• No gates, no tiers. Volume, reserve size and price have no say in the split.
• A hard ceiling. The 1% team share is a constant in the contract code. No owner, setter or parameter can raise it.
• No keeper needed. The tax leaves the pool on its own whenever $50 has gathered: the reserve's 4% is sent to it and counted at once, the team's to its fee router. If a transfer or the reserve's accounting ever fails, the swap still goes through, the amount is retried on the next flush, and auto-flush pauses for an hour so a frozen address cannot tax every trade with extra gas.
• Why the split is fixed. An earlier design raised the team's share once volume, reserve size and price all passed set levels. It was dropped: a fixed 1% keeps the reserve's 4% at every size, and anyone washing volume pays 5% of it, 4% straight into the reserve.

The sell burn near the backing

When the price is within 1.4× of the backing, a sell burns part of the tokens sold, so selling into the pool pays about what redeeming would and the backing per token rises for everyone who stays.

With P the pool price (the lower of the 30-minute TWAP and spot) and B the backing at the snapshot:

Computed from the Controller's burnBpsAt formula.

• At 1.05× the backing a sell burns 3.76%, at 1.10× 8.09%, at 1.2× 15.66%, at 1.3× 11.03%, and nothing from 1.4× up.
• Between 1.2× and 1.4× the burn fades out gradually, so what a seller receives rises smoothly with the price and there is no threshold worth waiting for.
• Buys never burn. The burned tokens are destroyed, not paid to anyone.
• B is taken at the round's snapshot, at the high valuation of the legs, so a pool trade inside the round cannot move the band.

Buy cheaper (bonds)

A bond sells newly minted TETRA for USDG at up to 20% below market, and the reserve always receives at least the backing value for every token minted, so no bond of any size lowers the backing.

M is the higher of the 30-minute TWAP, spot and the round's snapshot price; B_high is the higher of the live and the snapshot backing at the high valuation. Taking the higher value on both sides means a pool buy, a 30-minute price push or a dump inside the round can never make a bond cheaper.

Price ÷ backing	Discount
1.316× and above	20%
1.20×	12.3%
1.10×	4.3%
1.0526× and below	closed

• Never above the pool. A bond opens only while its price is also below the live pool price, the lower of TWAP and spot. After a dump below the round's snapshot price, bonds close until the pool recovers or the next snapshot, so nobody ever pays more for a bond than for a market buy. After a sharp pump the 30-minute TWAP lags the spot price, so bonds can also stay closed for up to about 30 minutes until it catches up.
• Capacity, not a cap per buy. Each 6-hour round can bond up to 50% of the USDG in the protocol's pool, valued at the lower of the spot and the 30-minute TWAP price and read at every bond, so it grows with the pool during the round. Any single bond can take all of it. This bounds how much new TETRA can reach the pool per round, and a buy-bond-sell sandwich cannot inflate it.
• Where the USDG goes. 95% enters the reserve and counts in the reserve at once; 5% is the team's bond fee. The discount is not reduced by the fee. The smallest bond is $5.
• Vesting. Bonded TETRA unlocks evenly over 24 hours inside the staking contract and earns no payouts while it unlocks. The unlocked part can be taken at any time for free, or moved straight into staking in one step with no tax; closing early takes 20% of the still-locked part (15 points burned, 5 to the team), which makes a bond-and-dump no better than a market buy.
• Pay with anything. A zap swaps ETH, the stock tokens, cbBTC or NetNet's NET into USDG and bonds in the same transaction, for 0.3%.

Staking and emissions

Stakers are paid new TETRA only from real growth of the reserve: a third (33%) of every round's real growth goes into a payout bank (nothing on launch day, when the reserve is too small to measure growth fairly), and the bank pays out at most 1% of supply per 6-hour round.

What happens at every 6-hour close (Controller._closeEpoch).

1. Measure real growth. At each round's close the protocol compares the backing per token and the reserve's units, both valued at today's prices, with the reference it took at the last close. Growth is the smaller of the two increases, so price moves of the legs pay nothing (they move both sides of the unit comparison equally) and burns pay nothing (they raise the backing per token but add no units). Only money coming in counts: tax, bonds, the redeem retention, donations.
2. Bank a third of it. 33% of that growth, in TETRA at the current backing, is added to the bank. The reference then moves up, so the same growth is never banked twice. A round with no growth leaves the reference where it was, so growth that a round could not see is counted at the next one.
3. Pay from the bank. Each close pays the lesser of the bank and 1% of circulating supply, minted straight to stakers. What stays unpaid shrinks by 25% per round, so a big day pays over the next several rounds and then fades instead of hanging over the token. The faded part is never minted: its value stays in the reserve and raises the backing of every token. The dilution from a big inflow is spread over several rounds and capped, never forced into one. The Statistics page lists every close: growth, the share banked, what was paid and what decayed into backing.
4. Guards. A payout is cut so the backing per token never falls below 90% of its best close. Nothing is paid while the pool's USDG, measured at the TWAP price, is under 75% of its 7-day high, so emissions stop the moment liquidity leaves. No stakers, an unhealthy mark or a failed read: nothing is paid and nothing is lost.

Why a bank. Paying a round's growth out in full at its close would put all the dilution from a big inflow into one round, right when the price is most exposed. The bank lets rewards follow the reserve's growth without that: 33% of the growth is owed to stakers, at most 1% of circulating is minted per round, and the part the cap holds back fades by 25% a round without ever being minted. Over time stakers receive at most a third of real growth, and the other two thirds or more stays in the reserve as a higher backing per token. The Statistics page shows each close's split: growth, banked, paid, and decayed into backing.

The growth measure is loan-neutral: USDG lent out by the reserve counts as reserve cash and the escrowed collateral counts as circulating, so a borrow-tick-repay sandwich around a close moves neither the bank nor the backing's best close. The liquidity high is recorded at the lower of spot and TWAP, so one large buy just before a close cannot lock payouts for a week.

Staking starts earning after one full round: a new stake waits as pending until the next 6-hour close, joins the stake there, and shares in the payout of the close after that. A stake made between two closes is therefore first paid at the second close after it. Rewards are paid in TETRA from the staking contract; outside reward tokens can also be streamed to stakers by anyone.

The ratchet in detail

The ratchet is the reference the Controller measures growth against. It only moves up after growth was banked or a payout was minted, so no growth is ever paid twice and no growth is ever lost.

What the reference holds. Two things, both taken at the last close that moved it:

• Bref, the loan-neutral backing per token: the reserve's settled units plus the units out on loan, valued at the low Chainlink mark, divided by circulating supply (which includes loan collateral).
• qRef, the unit vector: how many SPY, GLD, USO, WETH units and USDG the reserve held, loans included.

The close, step by step. The first swap of a new 6-hour round, or anyone calling tick(), closes the previous round in this order:

1. Health. If the mark is unhealthy (a feed stale, or Chainlink and a pool more than 5% apart), nothing is banked, nothing is paid and the reference stays. Round 0 only sets the first reference: there is no free first round.
2. Growth. Both sides are valued at today's prices:

B is the loan-neutral backing now and V(q) the value of today's units. A leg price move changes V(q) and V(qRef) by the same factor, so the second term is zero. A burn raises B but adds no units, so again zero. When the reserve converts cash into a leg, the same slice of the reference is moved from cash into that leg, so the leg's later price moves are not paid either. Only units that came in from outside count.

3. Bank. bank += circulating × g × 33%, in TETRA. The best close of the backing so far, ATH, is updated.
4. Liquidity guard. The pool's USDG at the TWAP price must be at least 75% of the highest close in the last 7 days (28 rounds, each recorded at the lower of spot and TWAP). If not, nothing is paid this round.
5. Payout.

C is circulating supply. There is no bonus for a high price: payouts come only from banked growth. The payout is then cut so the backing after the mint stays at or above 90% of ATH:

6. Decay. The part paid from the bank leaves it; whatever stays unpaid keeps 75%: bank = (bank − paid from bank) × 0.75.
7. Mint and ratchet. m is minted to the staking contract and spread over active stakers. The reference then moves to the post-mint backing and today's units. If nothing was banked and nothing paid, it stays where it was, so growth the round could not see is still counted next time.

Every round that pays nothing emits a reason on chain: 1 unhealthy mark, 2 nothing to pay, 3 no stakers, 4 a read failed, 5 the liquidity guard, 6 the backing guard, 7 a leg retired or restored this round, 8 the launch-day warm-up.

Worked example. 1,000,000 TETRA circulating, a $100,000 reserve (backing $0.100), after the launch-day warmup.

Round	Inflow	Backing at close	g	Banked	Paid	Bank after	Backing after mint
1	$8,000	$0.1080	8.00%	26,400	10,000 (1% cap)	12,300	$0.1069
2	$0	$0.1069	0	0	10,100 (1% cap)	1,650	$0.1059
3	$2,000	$0.1078	1.85%	6,234	7,884	0	$0.1070
4	$0	$0.1070	0	0	0	0	$0.1070

Round 1's $8,000 banks 33%, paid over two rounds instead of one (the 1% cap spreads it) with a small remainder decaying, and the backing ends 7% above where it started: stakers receive at most a third of the growth, holders keep the rest in the reserve. Under SEMI's ratchet the 16,400 left over in round 1 would have been thrown away; under OHMVAULT's trailing mark round 4 would still have paid against a mark set rounds earlier.

Loyalty and payout modes

The longer a stake has been held, the more of each payout it keeps: 50% in the first day, 75% on the second, 100% from the third. There is no lock; anyone can leave at any time.

Held	Share of payouts credited
Under 1 day	50%
1 to 2 days	75%
2 days and more	100%

• Where the rest goes. The forfeited part stays in the staking contract and is added to the next payout for everyone still staked. Short-term stakers fund long-term ones.
• When it applies. The share is set at the moment rewards are settled, which happens on every stake, unstake, claim or compound. A reward once credited is never cut again: leaving, or adding more stake later, does not touch it. Leaving all but a dust stake does not dodge the rule either, because the leave itself settles at the current share.
• The clock. Holding time is stake-weighted: adding stake moves the clock later in proportion to the amount added, a partial unstake keeps it, a full exit resets it. Compounded rewards do not move it.
• Two modes. Claim mode (the default) keeps rewards waiting until the holder claims them. Auto-compound restakes them: anyone, usually the keeper, can trigger compounding for every holder who switched it on. A holder who has fully left is never re-staked; their rewards wait for a claim.
• Buy and stake. Through the site router, a USDG buy can be staked in the same transaction.
• Leaving. Unstaking takes a 6-hour cooldown and is free. Leaving instantly costs 20% of the whole stake: 15 points burned, 5 to the team.

The daily raffle

Once a day, one ticket holder wins half the pot. The pot comes only from the tickets: never from the reserve and never from the pool.

• Tickets. Each ticket costs a fixed dollar amount set at deploy, paid in TETRA at the higher of the pool's TWAP and spot price, so pushing the price down cannot buy cheap tickets. Up to 1,000 tickets per purchase.
• Where each ticket goes. 80% to the day's pot, 15% burned, 5% to the team.
• Stakers' edge. A buyer with free stake gets extra weight per ticket by holding time: ×1.25 after one day, ×1.5 after two. The bonus covers at most as many tickets as the stake is worth at the ticket price, so a dust stake earns a dust bonus.
• Payout. 50% to one grand winner, 4 × 10% to runners-up (picks weighted by tickets, one ticket can win more than once), 10% rolls into the next day's pot. A day with no tickets rolls its whole pot over. The caller who triggers the draw receives 0.5% of the pot.
• The draw. After the day ends, the first call (or the next day's first ticket) fixes a target block about 20 blocks ahead. The seed is that block's hash mixed with every purchase of the day, and it is recorded the first time anyone sees it, so nobody can wait out a bad result for a re-roll. The chain's sequencer is the one party that could bias it; Robinhood Chain has no VRF yet.
• Optional at launch. The raffle has no special role in the system and can be deployed any day after launch without touching anything else.

Loans against the reserve

Holders can borrow USDG against their TETRA instead of selling it, the way Olympus's Cooler Loans work: no price liquidation, no interest rate, one fee per term. Every loan can only raise the backing per token for everyone else.

• You lock TETRA in the reserve and borrow up to 85% of what redeeming it would pay, in USDG. Legs that are down or can't move count as worth nothing.
• The fee is 1% of the loan per 90-day term, taken upfront: half to the team, half stays in the reserve for holders.
• The locked TETRA still counts as circulating, and the lent USDG still counts in the reserve as money owed to it: at face value while the locked TETRA covers it, and at the locked TETRA's worth if prices fell so far that it no longer does (so nobody gains by redeeming ahead of a default). So borrowing and repaying move nobody's backing except by the half fee that stays, and a redeem while loans are open pays exactly what it would pay with no loans.
• Anyone can repay the USDG at any time; the TETRA always goes back to the borrower.
• Before the term ends, anyone can extend it by 90 days for another 1% fee, as long as the loan is still at most 95% of the collateral's redeem value.
• If the loan isn't repaid by the end of the term, anyone can close it: the locked TETRA is burned and the USDG is written off. The loan was at most 85% of what that TETRA redeemed for when it was opened, so holders gain unless the basket fell more than about 15% since. In the stress test, gold and oil lost 90% and every loan at full size defaulted; holders lost 0.66% of the backing.
• At most 50% of the reserve's USDG can be out on loan at once. The harvester keeps the USDG on loan plus 20% of the reserve in cash, and the instant USDG exit never takes the cash below the USDG on loan, so an in-kind redeem always gets its full share of the cash. If in-kind redeems alone ever drain the cash, loans can no longer be extended and each one is repaid or closed within its term.
• Loans don't move staking payouts: lent USDG counts as reserve cash and locked TETRA counts as circulating, so a borrow and repay around a payout changes nothing.

Why this design

TETRA keeps what worked in SEMI and OHMVAULT and changes what did not.

	SEMI	OHMVAULT	TETRA
Backing	MU, not redeemable	OHM, not redeemable	SPY, GLD, USO, WETH, redeemable in kind or as USDG
Emissions	Ratchet: unpaid growth thrown away; a 10× pump paid about 3 rounds	20% trailing mark: paid too many rounds, diluted	Growth bank: pays a pump out over a day or so, stops when liquidity leaves
Team share	3% of volume	3% of volume	1%, fixed forever

• A reserve people can use. Neither earlier floor could be redeemed, and holders treated it as a number on a page. Here the exit is a function anyone can call.
• Emissions between the two. SEMI ran to about $9M and its liquidity grew past $1M, yet its ratchet paid only a handful of rounds on the way up and nothing after. OHMVAULT's trailing mark kept paying long after the growth was gone. The bank pays real growth only, spreads it, and decays what is not paid.
• No outside liquidity. One pool, owned by the protocol. Every flywheel runs on the token itself.
• No public presale. 92.5% of supply starts in the pool. The other 7.5% is the team, advisor and investor allocation described under The pool and the launch; nobody can buy from the pool before the first trade.
• A short, steep launch window. 120 seconds starting at 97%, after Cerberus's five-minute curve kept buyers out too long.

What nobody can do

No contract in the system has an owner who can change a number, move reserve funds, mint, pause or upgrade. Every parameter is a constant or a value fixed at deploy.

• The reserve has no withdraw. Assets leave only through a holder's redeem (in kind or as USDG), a USDG loan against escrowed TETRA, or the harvester spending spare cash on the legs or on the reserve buyback.
• The token can be minted only by the Controller (emissions to stakers) and the bond contract (bond payouts into vesting). Every other path burns.
• The tax split is fixed in code at 1% for the team, with no setter.
• Two keys exist, both narrow. The pool lock owner can extend or burn the lock, or after 1 January 2027 withdraw the USDG side while the TETRA side is burned. The team's fee router decides only where the team's own fees go.
• Tested. 465 unit, integration, invariant and fuzz tests (including loan sequences, a cash run, a leg retired and restored, and loans defaulting after a crash), plus a fork test against Robinhood Chain mainnet that deploys, seeds, launches, buys, sells, flushes, harvests all four legs, bonds and redeems with the real tokens, feeds and pools.
• Reviewed. Three adversarial reviews by independent review agents, on 19, 20 and 21 October 2026, plus economics, market-structure and longevity reviews on 21 October. Every finding of the second and third reviews, on staking loyalty, loan-neutral emissions, the liquidity guard, bond pricing after a dump, bond capacity, the tax flush and the raffle draw, was fixed and covered by a regression test. These are internal reviews; the third-party audit is listed under Audit.

Numbers at a glance

Every value below is written into the contracts; the site re-reads each one from the chain once they are live.

Area	Value	Contract
Supply, seed	9,250,000 TETRA against 10,000 USDG, opening price ≈ $0.00108; 750,000 TETRA (7.5%) to team, advisor and investor wallets	Deploy config
Pool lock	until 2027-01-01 00:00 UTC	VaultHook
Launch window	97% → 90% at 10 s → 70% at 30 s → 40% at 60 s → 5% at 120 s, all to the team	VaultHook
Trade tax	5%: 4% reserve / 1% team, fixed forever	VaultHook, Controller
Team share	1% of volume, forever	Controller
Auto-flush	every $50 of tax; 1 h pause after a failure	VaultHook
Site fee	1% through the site router	VaultSwap
Sell burn	1 − backing/price − 1%, max 25%, full below 1.2×, fading to 0 at 1.4×	Controller
Bond price	max(0.8 × market, backing ÷ 0.95), below the live pool price	Controller, BondDepository
Bond capacity	50% of the pool's USDG per 6 h round	BondDepository
Bond fee, vest	5% to the team; 24 h linear	BondDepository
Bond zap	0.3%	BondZap
Close a bond early	20% of the locked part (15 burned, 5 to the team)	Staking
Round	6 h	Controller
Emissions	33% of real growth into the bank (none on launch day); pays ≤ 1% of supply per round; unpaid bank − 25% per round	Controller
Emission guards	backing ≥ 90% of its best close; pool USDG ≥ 75% of its 7-day high	Controller
Loyalty	50% under 1 day, 75% day 2, 100% from day 3	Staking
Unstake	6 h cooldown, free; instant exit 20% (15 burned, 5 to the team)	Staking
Redeem	95% of the share in kind; 4% stays, 1% to the team	Reserve
Redeem to USDG	+0.5%	RedeemToUSDG
Donations	unlock over 7 days	Reserve
Harvest	All spare cash per harvest, 25% per leg, a leg bought once its share is at least $100 (incl. WETH); leg pool at most 1% above Chainlink; the larger of 20% of the reserve and $1,000 (plus any USDG on loan) stays USDG	Harvester
Mark	Chainlink vs pool TWAP within 5%; feeds ≤ 7 days (stocks), 26 h (crypto)	Mark
Loans	USDG, ≤ 85% of the redeem value, 90 days, 1% fee per term (half to the team), extendable, burned if unpaid	Reserve
Raffle	80% pot, 15% burned, 5% team; 50% / 4 × 10% / 10% rolls; 0.5% draw bounty	Raffle

Contracts and addresses

TETRA's contracts on Robinhood Chain (chain id 4663). Each link opens the contract on Blockscout, where the verified source code can be read.

Contract	Address
TETRA token (VaultToken)	0x7E187fE67ae04c1B1738f01B424656390E45E1C9
Reserve	0x6681f24a6347772D9e0F861717C35cf462f6f194
Controller	0x5070d85615F50324976e4b988FF5b5D04003d81b
VaultHook (pool hook)	0x8EE7f46b728628bBf007802A8B3Cc04e594f68CC
Mark (prices)	0x11d26007cDe0022f7B1c94917Ea086aDe0E97925
Staking	0x046fb87B3de0668124f918F216987092755E0004
BondDepository	0xEDb0E9BFcD36C1da04Cf0DD17d41B3B1e7D8C11f
BondZap	0xfe8B75cF9fB79eAaD35189128d97A599ce4dB6e5
Harvester	0x2066955af52F0fcDF478006746CBb2509b8Ee77C
RedeemToUSDG	0x8d9F9E4C5441D02192EF32c8bcb8d91320f55Dea
VaultSwap (site router)	0x1F8aC7684A0164780dDeEAf58e351C15AF92fEeB
VaultLens (read-only)	0x4F56BB3AA04252C28A3c5b6Ac744F61Df252582C
FeeRouter (team fees)	0xB6849338Bf088a0EE4079CB86ec5121551BfFa97

The assets and infrastructure they use:

What	Address
SPY token	0x117cc2133c37B721F49dE2A7a74833232B3B4C0C
GLD token	0xC9a981FEE1F9DEc688bb123ccDeCc63D0deBFC4e
USO token	0xa30FA36Db767ad9eD3f7a60fC79526fB4d56D344
WETH token	0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73
USDG	0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
Uniswap v4 PoolManager	0x8366a39CC670B4001A1121B8F6A443A643e40951
Chainlink SPY feed	0x319724394D3A0e3669269846abE664Cd621f9f6A
Chainlink GLD feed	0x470A51258068043bd43dC0a56245625C9fE86eB0
Chainlink USO feed	0x75a9c76Ef439e2C7c2E5a34Ab105EcFe3766431c
Chainlink ETH / USD feed	0x78F3556b67E17Df817D51Ef5a990cDaF09E8d3A9

The Raffle follows separately.

Audit

Serialized audit of the token, 21 October 2026: Safe. Serialized reviewed the TETRA token contract (0x7E187fE67ae04c1B1738f01B424656390E45E1C9) and rated it Safe, with no transfer trap. Its one note is that authorized minters can increase the supply. That is by design: the only two minters are the Controller, which mints staking payouts from real reserve growth (at most 1% of supply per 6-hour round), and the BondDepository, which mints bonds at or above the backing. Neither has an owner, and the minter list was fixed at deploy and can never change. Read the report.

Serialized audit of the pool hook, 21 October 2026: Safe. Serialized also reviewed the VaultHook (0x8EE7f46b728628bBf007802A8B3Cc04e594f68CC), the Uniswap v4 hook that runs the TETRA/USDG pool, and rated it Safe, with nothing scam-level. Its note is that the hook owns all of the pool's liquidity, takes a fixed 5% swap tax, and burns part of a sell made close to the backing. All three are the design described above: the liquidity is protocol-owned and locked until 1 January 2027, the tax is 4% to the reserve and 1% to the team and can never be raised, and the sell burn is the one under The sell burn near the backing. Read the report.

TETRA is an experimental token. The reserve depends on the four underlying tokens, their issuers and their price feeds; tokenized stocks can be paused by their issuer, and redeemable value moves with the market. Nothing here is financial advice.

Numbers here match the deployed contracts; where a constant is quoted, the contract is the source of truth. Back to the app.