documentation

the mechanism

Once per day, at 02:00 UTC, the protocol reads two prices. The target is Chainlink's SPY/USD feed — time-weighted at the source, and frozen over weekends exactly as the index is. The market is a 24-hour TWAP of $SPX's own pool, converted to US dollars through the Chainlink USDG/USD feed. It computes the deviation between them. At deviations under 5%, nothing happens. At 5% or more — the boundary is inclusive — total supply changes by the deviation divided by a lag factor of 10, hard-capped at ±10% of supply per epoch. Roughly one-tenth of the gap is closed per rebase, so a persistent mispricing is corrected over a number of days rather than in one shock.

deviation = marketTWAP_usd / targetFeed - 1

if |deviation| < 0.05:
    supplyDelta = 0                                  // under the band — no rebase
else:                                                // triggers at exactly 5%
    supplyDelta = totalSupply * deviation / lag      // lag = 10
    supplyDelta = clamp(supplyDelta, ±10% of supply) // immutable per-epoch cap

how balances scale

Balances are not edited wallet-by-wallet. Internally, every account holds a fixed quantity of an indivisible unit (“gons”), and the visible balance is that quantity divided by a single global scalar. A rebase changes only the scalar. Every balance in existence scales by the same factor in the same block. On contractions that is the whole story: each holder's share of total supply is exactly constant. On expansions, 10% of the newly created supply is carved out for the geyser, so holders receive 90% of the delta pro-rata and their share dilutes by that skim — and only by that skim. No transfers occur and no per-wallet operations are performed.

worked examples

oracle design

target oracle

The target is Chainlink's SPY/USD feed — time-weighted at the source, updated around the clock on trading days, and frozen over weekends exactly as the index is. The protocol never holds, custodies, or touches the geo-fenced stock token itself — it only reads the feed. Staleness and validity are checked on every read; a stale or paused feed does not produce a bad rebase, it produces no rebase.

market oracle

The market price is a 24-hour TWAP of $SPX's own canonical pool (SPX/USDG on Uniswap v2), converted to US dollars through the Chainlink USDG/USD feed so a stablecoin wobble is never mistaken for an $SPX mispricing. If USDG trades outside [$0.98, $1.02], the oracle reports invalid and the rebase is skipped.

execution

An orchestrator contract executes the rebase and then calls sync() on registered AMM pools in the same transaction, so pool reserves reprice atomically with the supply change and no sandwich window opens between the two. The rebase call itself is permissionless — anyone can trigger it once the daily window opens. There is no caller reward; we run a keeper so it happens on time.

manipulation analysis

Moving a 24-hour TWAP requires out-trading the pool for the better part of a day — sustained capital at risk, not a single-block flash loan. The canonical pool is a standard Uniswap v2 pool with the standard 0.30% fee, so every round trip a manipulator makes pays real fees. (Arcus RFQ, the chain's zero-fee venue, is not part of the oracle and the protocol never trades there.) The honest caveat is depth: a thin pool makes sustained manipulation cheaper regardless of fees. Thin pools are a real exposure and are listed under risks.

source governance

The economics — band, lag, skim, per-epoch cap — are immutable. The oracle sources are the one governed surface: a guardian behind a 48-hour timelock can re-point the target feed, the USDG conversion feed, or the market pool, until the guardian role ossifies (published target: within 12 months). The two legs are not protected to the same standard, and the difference matters enough to spell out.

the pool is pinned. the feeds are not.

Market pool: pinned by identity. The contract accepts a pair only if it is the canonical Uniswap v2 factory's own pair for exactly {SPX, USDG}, and it re-checks that the pair's two tokens are exactly ours. The guardian cannot substitute a pool it controls, because there is only one address that satisfies the check.

Price feeds: validated by shape, not identity. A replacement feed must be a contract that reports decimals() between 6 and 18, answers description(), and returns a positive latestRoundData(). That is the whole test. It is not an allowlist, not a codehash check, and not a comparison against Chainlink's registry. After the 48-hour timelock elapses, a guardian can point the target or USDG feed at any contract that answers like an aggregator, including one that reports whatever price the guardian wants.

The documented upgrade path is a pool-TWAP target once real on-chain SPY depth exists. If sources go stale or diverge beyond sanity bounds, the rebase is skipped rather than executed on bad data — but “sanity bounds” means staleness and peg checks, not proof that a feed is the feed it claims to be.

deployment

$SPX deploys on Robinhood Chain (chain id 4663). The canonical contract addresses are published in this table before they appear anywhere else.

Liquidity policy: 100% of the genesis supply is paired with the USDG seed in the canonical pool, and the LP tokens are burned inside the genesis transaction itself — there is no lock-up period and no key that can ever withdraw the pool, because the position stops existing the moment it is created. The consequence cuts both ways: the pool's 0.30% swap fees accrue to those burned LP tokens and are unclaimable by anyone, including this project.

license & prior art

$SPX is a fork of Ampleforth's uFragments contracts and inherits their GPL-3.0 license; this fork is distributed under the same terms.

lineage & precedents

GPL-3.0