Shares minted at the oracle NAV. It lands in the buffer.
02Keeper reposes
One call: buffer in, old position out, new band minted.
03Fees compound
Flash accounting — nothing leaves the PoolManager in between.
04Withdraw
From the buffer. Beyond it, queued for the next repose.
This vault is not hedged
Concentrated LP is short gamma, so depositors carry the delta. The natural hedge is a
Hyperliquid perp — off-chain, and unprovable by the contract. v1 carries it and says so.
One vault per ticker
NVDAnot deployed
NVIDIA
Target pool
NVDA/USDG
Pool liquidity
$3.92M
24 h volume
$36.86M
Band
±5 %
Vault TVL
—
SPYnot deployed
S&P 500 · SPDR ETF
Target pool
SPY/USDG
Pool liquidity
$3.64M
24 h volume
$15.83M
Band
±5 %
Vault TVL
—
GOOGLnot deployed
Alphabet
Target pool
GOOGL/USDG
Pool liquidity
$182k
24 h volume
$947k
Band
±5 %
Vault TVL
—
AAPLnot deployed
Apple
Target pool
AAPL/USDG
Pool liquidity
$715k
24 h volume
$2.14M
Band
±5 %
Vault TVL
—
PLTRnot deployed
Palantir
Target pool
PLTR/USDG
Pool liquidity
$257k
24 h volume
$505k
Band
±5 %
Vault TVL
—
SPCXnot deployed
SpaceX · pre-IPO
Target pool
SPCX/USDG
Pool liquidity
$4.31M
24 h volume
$9.35M
Band
±5 %
Vault TVL
—
HIMSnot deployed
Hims & Hers Health
Target pool
HIMS/USDG
Pool liquidity
$209k
24 h volume
$3.31M
Band
±5 %
Vault TVL
—
What the contract enforces
Share price never reads the poolNAV comes from the oracle. Read slot0 and anyone can move the pool for one block and redeem at a price they picked.
The keeper cannot move moneyIt can call repose() and nothing else. A leaked hot key costs gas, not deposits.
The band must sit on the markMore than 200 ticks off the oracle and it reverts. A stolen key can repose — only around the truth.
One repose per five minutesStops a compromised keeper draining the vault through gas alone.
Explicit amount boundsamount0Max / amount1Max, always. The sandwichable FROM_DELTAS actions are never used.
The swap is capped and floored60 % of a leg, max. The output floor is measured against the oracle, so minOut = 0 reverts.
Withdrawals are honestmaxWithdraw is the buffer, not the total. Concentrated liquidity does not exit on demand.
Tested against the real thing
Thirteen tests on a fork of Robinhood Chain — live PoolManager, no mocks. One runs the full
cycle inside the real SPY pool.
PASSUSDG in, swap, band out, withdrawcycle
PASSfull cycle on the live SPY poolcycle
PASSsecond repose needs no swaprepose
PASSdeposit sits idle, valued at the markdeposit
PASSwithdraw is limited to the idle bufferwithdraw