Build
Architecture
How Eden is built: the contract stacks, who can do what, the timelocks, the price oracle, pairs and the zap, the indexer, operations and keepers, and how private data stays private.
1. Chain
- Robinhood Chain mainnet, chain id 4663 (Arbitrum Orbit). Blocks arrive at about 9.7 per second; the sequencer is first-come-first-served with no public mempool.
- Third-party contracts used: Uniswap v4 (PoolManager, PositionManager, Universal Router, Quoter, StateView), Uniswap v3 factory (zap routes), Permit2, Safe v1.4.1, Chainlink ETH/USD and 36 Chainlink stock feeds, USDG and the 194 Robinhood tokenized stocks. Every external address was checked against mainnet before deployment.
2. Contract stacks
All contracts are Solidity. Per-launch contracts are deployed by the factory; singletons are deployed once in the genesis ceremony and owned by the Eden Safe.
2.1 Launch stack
| Contract | Role |
|---|---|
EdenV2LaunchFactory | Creates launches from approved configs; launchEnabled gate; snipe-tax and graduation-guard settings. 24,402 B (174 B under the EIP-170 limit) |
EdenV2LaunchDeployer / EdenV2LaunchAndBuy | Deploys token + curve; launch-and-buy with the mandatory 20 % creator buy and its vesting lock |
EdenV2LauncherToken | The launched ERC-20 (1 B supply, no mint, no tax) |
EdenV2BondingCurve | Curve trading, 3 % fee, fee sweeps, creator routing, held-back LP growth |
EdenV2GraduationExecutor / EdenV2LaunchLocker | Seeds the Uniswap v4 pool at the curve's last price; locks the LP position and the unsold 4 % forever |
EdenV2MemeHook | Uniswap v4 hook on every graduated pool: 3 % fee on the unspecified leg, graduation guard (1 % per trade for one L1 block ≈ 12 s), fee sweep |
EdenV2FeeEscrow | Creator claims (pays msg.sender only) |
EdenV2LPGrowthVault / EdenV2BuybackVault | Creator-side locked liquidity and the creator's own-token buyback (locked 5 years) |
LaunchBurnGate | Charges the $500 ROOT launch burn through the oracle |
ApprovedPairRegistry | Which pair assets may be launched against (ETH, USDG, 194 stocks) |
EdenV2ZapBuy | Stateless, ownerless periphery: pay with ETH or USDG for any pair (swap → buy in one transaction), EIP-2612 permit entry points |
DevBuyVestingLock | Creator allocation vesting (30 days – 4 years), no admin |
2.2 Fee routing
| Contract | Role |
|---|---|
CreatorRouting | Score ramp: creator share = f + (50 % − f) × score; f = 30 % backed, 10 % unbacked; unearned share redirected |
ProtocolFeeAdapter | Keeper entry point that pushes swept protocol fees into the router; trading-fee source only |
FeeRouter | Splits the protocol bucket into six lanes (Eden, holders, ROOT buyback, grants, scoring oracle, index); lanes sum exactly; a failing sink is skipped and retried, never blocks the others |
HolderDistributor | Daily Merkle roots per token and asset; claims after 24 h, for 90 days; unclaimed rolls forward |
ScorerRewards | Per-second reward-per-weight accumulator per (token, asset); hour-bucketed expiry; conservative 5 % cap; 7-day drip; 30-day score window; solvency invariant covered by invariant tests |
RootBuybackVault | Books the buyback lane per token; keeper swaps to ROOT every 3 hours in small slices spread over the next 3 hours, each with an oracle floor and per-call cap; half burned, half to ROOT liquidity |
RootLPGrowthVault / RootGenesisLiquidity | Adds bought ROOT to the ROOT/ETH pool; genesis position has no remove function |
FeeLaneEscrow, OracleOpsVault, TreasuryYieldForwarder | Lane sinks (index, holder, oracle) and the yield route into the router |
LeafTokenPricer | USD value of launch tokens (curve price before graduation, pool price after) |
2.3 Scoring
| Contract | Role |
|---|---|
AttestationRegistry | Epoch roots signed by the attestation signer; 72 h challenge window; finalisation |
AdjudicatorRegistry | Eden reviewers who can dispute a root (never signers) |
HumanScoreRegistry | On-chain human scores with thesis hash; per-scorer cooldown 14 days; burns $100 of ROOT per score |
ValidatorRegistry | Scorer registration: 2,500 ROOT stake, $100 registration burn, 7-day unstake cooldown; unstake request ends reward positions at once |
DataSourceRegistry | Creator data sources, stored only as an encrypted envelope plus a commitment |
VerificationTierRegistry | Manual "Verified" flag: set by an adjudicator after review, revoked manually by an adjudicator or the Safe; no expiry |
ResearchAuthorRegistryV2 | Research author proofs, stored as hashes only |
ScoreVisibilityRegistry, WeightVectorRegistry | Public-score toggles and per-track weight vectors |
The scoring pipeline (verification, winsorised normalisation, weighted functional, gate, moving average, share cap), the Merkle and EIP-712 commitment and the human-score blend are derived in Scoring and rewards math.
2.4 ROOT, treasury and index
| Contract | Role |
|---|---|
RootToken | 1 B fixed supply; renounceMinter sealed in the genesis transaction |
SteppedVestingLock | Team allocation: 3-month cliff, 16 quarterly tranches; immutable beneficiary |
RootFeeHook | ROOT/ETH pool hook: 2 % fee to Eden (bounded 1–3 %) and the on-chain TWAP accumulator |
RootTwapOracle / ChainlinkPairUsdFeed | Keeper-free ROOT/USD and pair-asset/USD prices (section 5) |
NAVTreasury, NAVOracle, AuthorizedParticipantRegistry | Treasury book, NAV marks, authorised-participant redemption rail |
IndexVault, IndexToken, IndexConstituentRegistry, IndexDeploymentKeeper, StaleEquityAdapter | EDEN index: stablecoin inflow, per-epoch deployment into the seven stocks, published weights, price adapter that fails closed when stale |
TreasuryGrantPool | Grants treasury |
3. Roles and powers
| Role | Holder | Powers |
|---|---|---|
| Owner of every contract | Eden Safe, 2-of-3, hardware-wallet owners | Parameters, pointers, role grants, launch gate |
| Fee keeper | Dedicated key | Sweep fees, distribute, run buybacks and ROOT-LP sweeps (bounded by on-chain floors and caps) |
| Quality keeper | Dedicated key | Prove thesis grades, poke reward buckets, finalise epochs (all permissionless calls) |
| Holder poster | Dedicated key | Post daily holder roots |
| Attestation signer | Dedicated key | Sign epoch score roots |
| Index publisher | Dedicated key | Push index constituent prices |
| Identity attester | Dedicated key | Attest research author identities (hash only) |
| Ops admin | Dedicated key | Drain the index sink into the index vault; index epochs |
| Adjudicators | Eden reviewers | Dispute roots; set or revoke "Verified" |
| Deployer | Ceremony key | Deploys, then hands every contract to the Safe; holds nothing afterwards |
Every role key is a fresh EOA with no EIP-7702 delegation, not reused across roles and not a known test key; a role preflight script checks this on-chain before ownership hand-off and before launches open. Keeper keys never hold user funds; every amount they move is bounded on-chain (oracle floors, per-call caps, fixed fee sources).
4. Timelocks and upgrades
- Loosening is slow, tightening is fast. Every pointer (which contract talks to which) and every parameter that could loosen a limit goes through an on-chain timelock of 48 hours on the fee router, scorer rewards, buyback vault, scorer registry, both oracles, holder distributor, fee adapter, yield forwarder and creator routing. The change is queued publicly and applied by the Safe after the ETA. Changes that only tighten a bound apply immediately.
- Instant Safe powers: stop new launches (
setLaunchEnabled(false)— trading, sweeps and claims continue); grant or revoke keeper roles. - No upgradeable proxies. Per-launch contracts are immutable. A new version of a singleton is deployed next to the old one and switched in through a timelocked pointer; launches already live keep their own contracts. Before genesis any change is free; after genesis every switch costs a 48 h wait.
5. Price oracle
There is no posted price on mainnet. ROOT/USD is computed on-chain:
- TWAP accumulator in the ROOT/ETH pool hook. Before every swap the hook folds the current tick into a cumulative (Uniswap v3 semantics, folded before the price moves). Each fold moves the recorded tick by at most 9,116 ticks per elapsed second, which blunts sub-8-second spikes. A 1,250-slot ring keeps at least 4 hours of observations and is prefilled at genesis.
- Protocol-favourable read. The oracle charges
min(30-minute TWAP, 4-hour TWAP): a pump has to be held for hours before it lowers what a burn costs, while a dump is charged within one window. Tick rounding favours the protocol. - × Chainlink ETH/USD, read from the real Chainlink proxy, with a 25-hour max age (the feed has a 24-hour heartbeat and a 0.5 % deviation trigger). Robinhood Chain publishes no sequencer-uptime feed; the age bound is the guard.
- Fail closed. Burns and buybacks revert — they never fall back to spot — when Chainlink is stale, the TWAP window is not covered, or the price is outside its bounds. The factory opens launches only after the 30-minute window is covered.
Pair assets are priced by ChainlinkPairUsdFeed: ETH via Chainlink, USDG at $1, mapped stocks via their
Chainlink feeds (max age 4 days, covering market closures). These prices set the buyback floor (oracle value
− 7 %) and USD values in the UI.
Known limitation. ROOT trades in one pool at launch, so nobody arbitrages a skewed price back; the cost of moving the TWAP is the round-trip pool fee. The 4-hour anchor, the per-call buyback cap, the keeper's divergence hold and the monitors bound the damage. A second venue or deeper ROOT liquidity is the structural fix (see Security).
6. Pairs, the zap and confirmations
- Pairs. ETH, USDG and every one of the 194 Robinhood tokenized stocks are approved launch pairs. Each stock's curve uses the same dollar economics as USDG ($3,125 starting value, $12,500 graduation bar, 1 : 4 ratio), converted at the stock's reference price on the day it is approved. Price feeds, scorer reward assets and buyback settings for the pairs go through the timelock, so the ceremony queues them 48 hours before launches open.
- Zap.
EdenV2ZapBuylets a buyer pay with ETH or USDG for any pair: it routes through Uniswap v4 or v3 (191 of 194 stocks have a route), buys on the curve or pool, and holds nothing between transactions. It has no owner and no state. - One confirmation. Where a wallet supports batched calls (EIP-5792, available on Robinhood Chain via EIP-7702), approve + trade or approve + launch is one confirmation. Buys paid in a token that supports EIP-2612 (such as USDG) use a signed permit through the zap, so a plain wallet signs once and confirms once.
7. Indexer and read API
- Eden's indexer records launches, trades, fees, scores, rewards and holders and serves them to the app, with a live stream for new blocks. The UI reads history from the API and only the live tail from the chain; when the indexer is unreachable the UI falls back to transaction receipts and RPC reads.
- On mainnet it keeps up with ~9.7 blocks/s on 2-second polling (measured lag p95 4 s). A lag watchdog restarts it; a second instance behind a health-checked router is built and can be switched on.
8. Operations and keepers
- An ops service runs every recurring protocol job: fee sweeps, distribution and buybacks, quality proofs and reward pokes, epoch finalisation, the daily scoring epoch, systematic re-scores, index inflows, index epochs and price pushes, oracle monitoring, launch discovery and a daily cost report.
- It runs as a primary and a hot standby sharing a Postgres leader lease; only the lease holder signs, and it re-checks the lease before every broadcast. Takeover measured at 39–66 seconds.
- Per-duty keys (fees, quality, holders, attestation, index prices) limit what any one leaked key can do; a leaked key is rotated by a Safe transaction.
- RPC failover: every component takes an ordered list of providers and falls back automatically.
- Alerts go to Telegram (critical to phones, warnings to a channel) and webhooks.
- If operations stop, nothing is lost: fees accumulate in the contracts and are swept when they resume.
- Detail: Operations.
9. Data privacy
- Data sources are private. A creator's sources are encrypted in the browser to the scoring oracle's published key (ECIES, secp256k1) and stored on-chain only as ciphertext plus a salted commitment. The UI and the public API never return them.
- Inputs are private, scores are public. Each epoch publishes scores in one signed Merkle root; the underlying business data stays with the oracle and is archived privately per epoch.
- Research authors are never public. Author identities (ORCID, OpenAlex, institutional e-mail) are stored on-chain only as hashes; the cleartext stays in the identity attester's private store, and the UI and API never show it. On-chain text such as a launch description is immutable, so the UI masks personal identifiers it finds there.
10. Source code
Eden is closed source for now. None of the repositories, the scoring oracle's code or the app's code is public. These docs describe how every part behaves, and Contracts and Integrating cover the public interface an integration needs.