Contracts

Every address and every check, so you can verify the whole thing yourself rather than trust us.

The chain

NetworkRobinhood Chain

Chain ID4663

Explorerexplorer.mainnet.chain.robinhood.com

Our contracts

Not yet deployed. Nothing of ours is live on Robinhood Chain yet. This page reads the factory address from the environment at request time, so it will fill itself in when the deploy happens rather than waiting on a copy being edited by hand.

You can derive any vault address yourself. There is no checked-in list to go stale: addresses come from the factory's own mapping in a single call, and each one is reproducible from public information alone, because the salt that determines it commits to the exact implementation and to every parameter the vault carries. One pool can hold several vaults, and you never have to take our word for which is which.

Contracts we depend on

Uniswap v3 factory0x1f7d7550B1b028f7571E69A784071F0205FD2EfA

WETH0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73

USDGCarries 6 decimals rather than 18. Every amount path respects it.0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168

Multicall30xcA11bde05977b3631167028862bE2a173976CA11

The source

Four contracts and two libraries, built with solc 0.8.26. Small enough to read in an afternoon, which is rather the point when nothing can be upgraded later.

CompoundVaultCoreShare accounting, harvesting, the holder skim and the two pool callbacks. Never deployed on its own; the tick bounds are its subclass's business.Abstract

CompoundVaultThe full-range vault, and the one most people use. Adds the single-token entry and exit, which swap internally.Full range

CompoundVaultRangedA band, plus permissionless re-centring. Two-token entry only: the single-token zap and the band do not both fit under the size limit.Band

CompoundVaultFactoryPermissionless, ownerless deployment behind the gate below. Takes the vault's creation code as an argument and checks it against a hash fixed when the factory itself was built.Factory

PoolTwapThe 60 second average, and the guarded read that refuses a spot price too far from it.Library

PositionValueConverting between liquidity, token amounts and a single-asset value.Library

Vaults are immutable, so a different choice of parameters is simply a different vault rather than a change to an existing one. Deploying one costs about a dollar in gas, so the interface offers to do it for you rather than limiting you to whatever happens to exist. You are never stuck with someone else's settings.

What the factory refuses

Anyone can deploy a vault, and every one of these checks runs on chain before they can. This is what makes a permissionless factory safe to use: a vault wrapped around something that merely looks like a Uniswap pool cannot be created in the first place.

The fee tier must be one this factory accepts. The tier is read from the pool and the pool is then proven with it, rather than trusting a tier supplied by the caller.
The pool must be the canonical Uniswap pool for its two tokens at that tier. This is the load-bearing check: anything can implement the pool interface and report whatever it likes, and only Uniswap's own factory can say which address is really the pool.
Its price oracle must carry at least 120 observations, twice what the vault's 60-second average price asks for. A pool records at most one observation per second, so a floor equal to the window would leave it a second short of the question.
Neither token may use more than 18 decimals. Not a proof of safety, an honesty bound: the maths is exercised against 6 and 18 decimal tokens and nothing wider, so wider tokens are refused rather than deployed untested.
The deposit cap must be set, and no larger than the pool's own liquidity. A cap is the only protection a vault with no governor has, so it has to exist.