The garden and the exile

You've been here long enough to know the feeling. You open the screener at 2am and scroll past four hundred launches with a flick of your thumb, and somewhere in that blur you stop noticing them as projects at all. They become weather. That numbness is the most important market signal of this cycle, and almost nobody is trading on it. We are. EDEN is a tokenized, non-dilutive venture platform for AI startups — compute networks, inference hosts, models, data providers, agents, robotics fleets, payment rails, apps, and research labs — where launching is one track among several, built on one inadmissibility rule: the protocol grades the business behind the token and never the token itself. Token price, trading volume, and holder counts are permanently excluded from the scoring input set — not down-weighted, excluded. What remains is verified output, re-fetched from each project's own systems, scored through a five-stage published functional, sealed under a per-epoch Merkle root that anyone can challenge, and paid for through four independent channels: a creator share of the token's own fees that rises with its verified score, payouts to its holders in the asset it trades against, streaming rewards to the staked scorers who grade it, and grants and capital access for its builders. Underneath everything sits a treasury of real assets with a redemption facility and a floor that only ratchets up. This paper is the full architecture — the story and the functional, the garden and the math.

1. 1The Exilewhat three generations of launch infrastructure taught us
2. 2The Rulethe excluded input set, stated formally
3. 3System Overviewnine tracks, one oracle, five downstream engines
4. 4Launch Mechanicscurves, every tokenized stock, graduation, the vesting floor
5. 5The Scoring Functionalfive stages, published constants, an absolute grade, challengeable roots
6. 6Consensus Was Never Truthexternal ground truth vs. internal agreement
7. 7The Human Hand, Boundedstake, a burn per score, graded theses, a capped modifier
8. 8Public Score, Private Bookssalted commitments, private sources, the disclosure trade
9. 9Scorer Rewards & the Square Rootno emissions: per-second streams, paid for quality, the cap, the burn
10. 10Fees, Holders & the Score Rampone fee, paid in real assets, earned by the score
11. 11ROOT & a Price Nobody Postsfixed supply, genesis, the keeper-free oracle
12. 12The Treasury, the Index & the Floorfour sleeves, the vol throttle, AP redemption, grants
13. 13Five Firesthe burn architecture: three structural, two funded
14. 14The Builder's Ledgerthree incentives, each answering a different refusal
15. 15The Flywheeleleven stages, and why the loop doesn't stall
16. 16Ten Attacks We Wrote Down Firstthe standing hardening specification
17. 17Disclosureswhat this document is, and is not

#The Exile

The launch machine worked perfectly. That was the problem.

Crypto's launch machinery is a miracle, and we mean that without irony. Anyone, anywhere, can stand up a market for a new idea in under a minute — no permission, no gatekeeper, no pitch meeting. Capital formation collapsed from eighteen months to ninety seconds. That is a genuine invention, and it isn't going away.

But we built the planting machine and never built the harvest. Nothing in the stack — not one contract, not one incentive, anywhere — ever circles back to ask the only question that matters: did the thing grow? So the field filled up. Tens of thousands of seeds a day, planted by machine, watered for an afternoon, abandoned by dinner — cast out east of the garden the moment the next launch arrived. Walk the rows now and this isn't cultivation. It's exile: an endless procession of tickers banished on arrival, because staying was never on offer. Being alive was never a requirement — being planted was the whole event.

Three eras took turns believing three lies, and each lie was a different way of avoiding the same expensive question. The first lie was that access was enough — open the gates and quality will sort itself out. It didn't, because nothing anywhere in the pipeline priced quality; frictionless entry with no downstream judgment produces volume without selection. The second lie was that scoring was enough — pay continuously for performance, let the network decide what performance means. Noble, until you notice who's grading: when the judges live inside the system they're judging, grades follow attention and attention follows grades, and the loop closes with nothing real inside it. The third lie was that revenue was enough — tie the token to real fees and the story finally has a floor. Until volume sleeps. And it always sleeps.

None of these are execution failures. They are verification failures. Every era found a more elegant way to not look.

The market has metabolized all three. People aren't cynical because they're broken; they're cynical because they're calibrated. Their taste sharpened while the product stayed the same — and taste, once sharpened, does not dull back down.

This paper is the harvest machine. Every section that follows is one component of a single answer to the question the industry has spent a decade declining to ask.

#The Rule

One inadmissibility rule, stated once, enforced everywhere. Everything else in this paper is a consequence.

Everything a token does can be manufactured. Price can be walked up by anyone with patience and a second wallet. Volume can be washed for less than the cost of a billboard. One holder can become four hundred before you finish your coffee. A bid wall can be posted and pulled in the same block. These aren't exploits — they're the ambient physics of permissionless markets, and they're never going away.

Which means any scoring system that admits these signals — even glances at them, even "as one input among many" — has wired a subsidy for manipulation directly into its foundation. You cannot weight your way out. You can only refuse.

Strip away what can be faked and look at what remains. A support agent either resolved real tickets in a real helpdesk this week or it didn't. Code either got merged and shipped or it didn't. A trading system either produced audited, realized profit or it didn't. Compute either held under real load or it didn't. These are facts about the world. They live in the systems where work actually happens — helpdesk, CRM, repository and CI, brokerage fill feed, payment processor, fleet telemetry, proof-of-capacity probe — and they can be read there, re-read there, and sealed.

Grade the business. Never the token. The gate only ever asks one question: does the claimed output reconcile with data re-pulled directly from the project's own systems?

The one rule everything follows from

That's the flag. The rest of this paper is us building the pole.

#System Overview

The whole of AI, not just chatbots — each layer judged by rules that fit what it actually does.

Projects launch into one of nine tracks, each with its own verification adapters, feature set, and published weight vector: compute (GPU, storage, and node providers — audited uptime, delivered throughput), inference (serving providers hosting models at an SLO — metered tokens served, p99 latency against the SLO, uptime under real load), models (fine-tunes and checkpoints — benchmark performance, real query volume through a metered gateway), data (datasets, labeling, RLHF and synthetic data — licensed delivery, labeling throughput, QA accept rate, read from the platform's own ledger), agents (resolved tickets, merged PRs, realized PnL — read from the work systems themselves), DePIN (robotics fleets, wireless and sensor networks, energy and mapping networks — fleet telemetry, task completion, utilization, coverage, safety incident rate), agentic commerce & payments (purchasing agents and settlement rails — settled volume, payment success rate, dispute and chargeback rate, read from the processor's own ledger), apps (revenue and daily active usage against an auditable source, a home that also covers tooling and middleware), and research (labs and research teams — papers by authors who have privately proved their identity, graded for form and external signal, never for whether a result is right). A support agent is never scored against a GPU provider, and a robotics fleet is never winsorized against a wireless network; cohorts are per-track, and per adapter family inside a track, by construction. The taxonomy extends without touching the math — a new track is a new adapter family plus a published weight vector, zero mechanism changes.

Underneath run five downstream engines, all fed by one oracle. Launch mechanics — the curve, graduation, the locked pool — extend proven, live bonding-curve infrastructure, because launch mechanics are a solved problem and re-solving them is unpriced risk. The differentiation lives in what sits on top: the scoring and attestation oracle with its bounded human layer (§5–8), the score ramp that sets each creator's share of their own token's fees (§10), per-second scorer rewards paid in real assets (§9), holder payouts in the pairing asset (§10), the buyback-and-burn engine for the platform token (§13), and the NAV treasury with its index and redemption facility (§12). There is no protocol-wide emissions pool. Every reward is paid from real fee flow.

Every launch now makes the same kind of claim. Holders of every token are paid from its trading fees, in the asset it trades against, from the first trade — they are never throttled by verification status. What verification changes is how much of the fee the creator has earned, and whether anyone is paid to keep grading the project. That replaces an earlier two-track design in which only some categories carried holder payouts: one rule for everyone is easier to audit than two.

#Launch Mechanics

Instant and permissionless — because the gate belongs on rewards, not on entry.

Anyone launches in minutes against a deterministic bonding curve on Robinhood Chain. The creator makes one structural choice at launch: the pairing asset — ETH as the neutral default, USDG for calm dollar pricing, or any of the chain's tokenized stocks (194 approved at the time of writing, every one the chain lists) as a real-world benchmark. A compute project pairing against a chipmaker's stock is making a legible public commitment about what it tracks. The choice matters twice: it denominates the curve, and it denominates every future holder payout (§10).

A buyer doesn't need to hold the stock first. On a stock-paired launch the buy card offers pay with ETH or USDG: one transaction swaps into the stock over the best on-chain route and buys on the curve for the signing wallet, with any unspent amount returned in the same transaction. Sells can settle back to ETH the same way. The router is stateless and ownerless, and it holds nothing between transactions. Wallets that support batched calls confirm a launch or a trade once.

The curve carries protections inherited from live, battle-tested infrastructure and deliberately not weakened: the protocol never takes custody; a snipe tax applies to buys only and decays to zero within seconds of open; and when a curve reaches its fixed graduation bar — 5 ETH on an ETH pair, 12,500 USDG, or $12,500 of the paired stock — graduation atomically builds a permanently locked liquidity pool. Anyone can trigger it; every launch on a given configuration lands with the same amounts and opening price. Graduation is a checkpoint, not a reward — it changes where the token trades, not what it has earned. There is no launch fee. Instead, every launch burns $500 of the platform token, priced on-chain, in the same transaction that creates it (§13), so using the platform is itself deflationary to the platform.

And for the business that was real before it launched, verification doesn't wait for graduation. Data sources are declared at launch — encrypted to the oracle, never published — so the oracle can begin scoring during the bonding phase, with the score shown on the token page while the curve is still filling. An inference provider with eighteen months of metering history bonds with a live verified score instead of as a blind ticket, and the market prices that information itself. The curve never changes — same shape, same snipe tax, same gauntlet for every launch, because the moment verified projects get different parameters, buyers are back to diligencing parameters instead of businesses. Pre-verification changes what buyers know, never what they pay.

#4.1 Team allocations and the 20% vesting floor

A team allocation is a standard launch parameter, declared like the pairing asset — and on Eden it is bought, not granted. The creator's opening buy is the team allocation: at least 20% of supply, at most 80%, bought on the curve at the same price as everyone else. What the platform refuses to allow is an unlocked floor:

The platform token follows the same principle at a larger scale: its team allocation sits in a stepped lock with a three-month cliff and sixteen quarterly releases over four years (§11). Why a floor at all: it's the baseline serious investors already demand before taking any token deal seriously. Making it platform-enforced means every project here clears that bar by default — the diligence is in the contract, not the deck.

#4.2 Liquidity that compounds

Graduation, as described above, is a single event — a pool gets seeded and locked forever at whatever size it reached. On most launchpads, every trade after that pays a fee that does nothing to the pool itself. Depth is frozen on day one. Eden closes that gap twice. A fixed slice of every creator payout is turned into permanently locked liquidity in the token's own pool — escrowed during the curve and added at graduation, minted as fresh locked positions afterwards, never withdrawable by anyone. The pool gets harder to move the more a token actually trades. Separately, a creator may choose at launch to route part of their own payout into buying their token on its own market, locked for five years; they can pause or resume that buyback at any time. Neither mechanism touches the pairing-asset benchmark the oracle reads — both are additive market structure.

#The Scoring Functional

A report card that is hard to forge: five pure stages, published constants, one sealed fingerprint per epoch.

Scores are computed per epoch and per category cohort. For project j in cohort C, let x_j be its vector of verified feature values for the epoch — components that failed source re-fetch are zeroed before entering the vector, per §2. The scoring map is five pure stages, each governed by published, version-pinned constants that no participant supplies. In plain terms: check the numbers, compare them with the track, weigh them, drop projects that produce too little, and smooth the result over time. What comes out is a grade from 0 to 100, not a slice of a shared pot.

#5.1 Winsorized cohort normalization

Each feature is clipped to its cohort's 5th and 95th percentiles, then min–max scaled to [0, 1]:

This caps the marginal value of raw magnitude. Once a project sits at the top of a metric, more of it is worth nothing — which kills the incentive to inflate whichever signal happens to be cheapest. Percentiles only mean something in a crowd: below twenty projects in a track, the top project could set its own ceiling, so small tracks are measured against fixed reference ranges published with the weights instead. Clipping limits outliers; it does not detect fake data — that is the job of re-verification (§2).

#5.2 Weighted linear score

A published weight vector combines the normalized features, and every vector sums to exactly one, so a project that tops every metric in its track scores one. The dispute-rate penalty sits on top as a separate deduction. For the agent cohort:

Every vector is tiered: hard-to-fake measurements anchor it, and softer signals are capped in combined weight, so no vector can lean on what is cheapest to inflate.

#5.3 Eligibility gate

A hard floor, not a soft penalty: below a minimum verified-output threshold, below a per-track merit floor, or below a minimum project age, the score is zero. A claim that fails verification never reaches this point — it is dropped before scoring and counts against the project's dispute rate, the penalty term of §5.2. The gate zeroes the week, not the history: a project that fails it keeps 60% of last week's score and loses another 40% every further week it fails — 100, 60, 36, 22, 13. One data outage doesn't erase months of delivery; a project that stops delivering loses most of its score within a month, and with it, its creator's earned share.

#5.4 Temporal smoothing

#5.5 A grade, not a share

The score is absolute. Each project is graded on its own verified output against its track; there is no fixed pot of score to divide, so one project's success never pushes another's score down, and every project can reach 100. Earlier drafts turned scores into capped shares of an emission pool. The pool is gone, and so is the share cap — applied to a grade, it would have held every project at fifteen. Concentration is bounded where money actually moves instead: a fixed ceiling on the creator's share (§10), a 5% cap per scorer (§9), and a ±20% band on human influence (§7).

#5.6 The seal

The chain holds the part that matters: the commitment. Scoring itself computes off-chain, by necessity — re-fetching a helpdesk's resolved tickets or an inference host's metering logs is not something a contract can do — and by design: it's the same division of labor every rollup runs, heavy computation where computation is cheap, settlement and verification where tampering is impossible. Each epoch, the pipeline builds a Merkle tree over (project, score) leaves, signs the root via EIP-712, and proposes it to an on-chain registry with a posted bond. The registry checks the cheap invariants — valid signature, strictly sequential epoch, no replay — and then the root sits in a challenge window: anyone may dispute it with a matching bond, and disputes go to adjudicators who by construction can never be signers. An unchallenged root becomes final when the window closes; an upheld challenge pays the challenger and the corrected root is resubmitted.

Only final roots are readable. Every creator payout, scorer reward, and human-score weight reads scores through the registry, and any consumer — a contract, a third-party auditor, you — verifies any single project's score against the stored root with a Merkle proof, in O(1) gas, regardless of how many projects are live. Change one grade and the fingerprint breaks. The math runs off-chain; the truth settles on-chain.

Trust in who signs is staged deliberately: v1, a single accountable signer, bonded and challengeable — centralized, shippable, honest about being so, and what launches on mainnet; v2, an m-of-n signer committee; v3, staked attesters, slashable when a signed root contradicts re-fetched source data. The read interface never changes across stages — hardening trust never touches the payout path.

#Consensus Was Never Truth

The deepest design decision in the system, and the easiest to miss.

The performance-weighted networks that came before us aggregate their graders' opinions into a stake-weighted, outlier-clipped consensus — and punish graders who diverge from it. It's genuinely hard to game alone. But notice what the mechanism actually optimizes: agreement. A grader's score is checked against other graders' scores, never against anything outside the network. A coalition that converges on a shared, wrong answer is not just possible — it's stable, because in that design, consensus and truth are the same word.

We split what those systems conflate. Two roles, two mechanisms, never recombined:

• The scoring layer is external ground truth, not internal opinion. The systematic score is not anyone's judgment about a project — it is the actual source-of-truth data re-fetched from the project's own systems, run through the published functional, and sealed. The question is never "do we agree with each other." It is "does this match reality, independently re-checked." A sealed root that the re-fetched data contradicts can be challenged by anyone, and agreeing with your coalition doesn't help you when the external data won't back the signature.
• The scorer layer is where stake enters — on a narrower job. Becoming a scorer costs a real ROOT stake and a burn; every score costs another burn and must carry a written thesis with cited sources (§7). But a human score can only nudge a real systematic score within a fixed band. It cannot create one, and it cannot rescue a zero. Scorers are paid for the quality of their reasoning, never for agreeing with each other or for being right about price.

Prior systems answer "is this good?" by asking graders to agree with each other. We answer it by re-checking the real world directly — and keep "pay to score" as a separate, bounded mechanic that refines a verdict, never what is true.

The two-way split

#The Human Hand, Bounded

Humans arbitrate uncertainty. They do not manufacture truth.

The systematic, re-verified score is always the anchor. On top of it we allow a bounded human contribution — never a co-equal vote, never able to override the machine's verdict about reality:

• Dual cost to hold the pen. A scorer stakes 2,500 ROOT — returned on exit after a seven-day cooldown — and burns $100 of ROOT to register. After that, every score burns another $100 of ROOT, first score and every re-score alike, inside the score transaction. Neither the stake nor the burn buys weight; they buy the right to be heard, and they make "score everything" expensive. A token's own creator, fee recipient, and lock beneficiaries may not score it.
• Graded theses. Every score is bound to a written thesis and its cited sources. A grading pipeline fetches each source by code — a dead link or a quote not on the page scores zero — and grades the thesis for effort and form, never for whether its conclusion is correct. An originality check runs in submission order: copies count for nothing, derivative work for half. Grades land as extra leaves in the epoch's signed root, inside the same challenge window as the score itself, and an Eden adjudicator can override a grade.
• A capped multiplicative adjustment within a band (±BAND, set at ±20%). It can nudge a real score. It cannot manufacture one: a systematic zero stays zero.
• Concave influence. Each human delta is weighted by w = 4s(1−s) × quality × originality, evaluated at the project's attested systematic score s — maximal in the ambiguous middle, collapsing to zero at both extremes. Humans matter exactly where the data is genuinely uncertain, and nowhere else. Theses graded below 0.3 carry no weight.
• Rate limits. One score per scorer every 14 days, across all projects; aggregation happens at epoch close, after grading.

A project with no systematic data yet is not left in silence: it starts at zero and human scores move it step by step in submission order — the first counting score by up to twenty points, every later one by up to five, each scaled by quality and originality — capped at 50 until real data arrives. That human-only score never counts as a systematic one, and the first attested score ends the mode for good.

Verified is a badge, set by hand. Eden's adjudicators may mark a team with a track record as verified. The flag is recorded on-chain, it is never set automatically by any data source, pipeline, or signer, it never expires, and only a manual decision revokes it. It does not change a project's score. It lifts the pre-data cap above, and it starts the creator's share from the standard floor instead of the unverified one (§10).

The blend runs off-chain in the pipeline and lands inside the same signed Merkle root. Consumers read one stable surface whether a score was pure-systematic or blended — and every raw score, thesis, grade, weight, and actual move is published.

#Public Score, Private Books

Auditability without forced disclosure — a real business shouldn't have to publish its P&L to prove it has one.

Only the final score is ever public on-chain. The financial inputs behind it are, per project and toggleable: PUBLIC — raw inputs archived in the clear, permissionlessly challengeable by anyone, the strongest mode and the default; or PRIVATE — the archive stores a salted commitment over the raw inputs, cleartext and salt held by the project, never published. The oracle still binds itself to the fixed input set — the commitment is folded into the signed root, so inputs can't be silently swapped after the fact — and on dispute, the project opens the commitment to an arbiter under NDA.

The sources themselves are private in both modes. Where a project's data lives — its helpdesk, its ledger, its metering endpoint — is declared encrypted to the oracle's published key and stored on-chain only as ciphertext. No page, API, or block explorer shows it. Research-track author identities are proved privately in the same spirit and never published.

The trade is disclosed, not hidden: private projects are challengeable-on-opening rather than permissionlessly. The score itself stays public, signed, and challengeable in both modes. A serious company gets to keep its books closed and its grade open — which is exactly the deal real businesses have always wanted from markets, and crypto has never offered.

#Scorer Rewards & the Square Root

No emissions. Each token's own fees pay the people who grade it — and the geometry favors the small.

Earlier drafts of this design paid verified projects from a protocol-wide emissions pool in the platform token. That pool is gone, and so is every mechanism that only existed to feed it. There are no protocol-wide ROOT emissions, for any reason, and no emissions allocation at genesis. A token that would otherwise be printed and sold pays no one; a fee that was actually charged pays someone real.

Instead, a share of every token's trading fee is set aside for the scorers who grade that token, kept in the token's own quote asset — ETH, USDG, or the stock it trades against — and never paid in ROOT, so scorers have nothing to dump on the platform token. The pool streams every second, and scorers withdraw whenever they like:

• Earning window. A score starts earning once its thesis grade is proven final, and stops 30 days after the score. Re-scoring opens a fresh window (and burns another $100 of ROOT). Requesting to unstake ends every open position at once.
• Drip. Each funding of the pool is released smoothly over 7 days, so a single fee spike can't be captured by whoever scored that afternoon.
• Weight. Thesis quality. Every scorer stakes the same 2,500 ROOT, so the weight — √stake × quality — comes down to quality alone. Quality below 0.3 earns nothing.
• Cap. No scorer may take more than 5% of a token's pool rate.
• Remainder. Everything not earned — above the cap, while nobody qualifies, rounding dust — returns to the buyback engine in the quote asset and is bought as ROOT and burned. With fewer than twenty equal scorers, some of every drip always burns.

Stake buys the right to be heard, not weight. Because every scorer locks the same amount, a large holder cannot buy a larger share of any token's stream: the only way to earn more is to write a better thesis, and even the best thesis is capped at 5%. The whale skim of earlier drafts is retired; the cap does its work at the moment of payment, with no second pass. The contract keeps the √stake form so a variable stake could be introduced later through governance — at launch it changes nothing.

Running several wallets doesn't get around it, it just costs more. Each extra wallet locks its own 2,500 ROOT, burns $100 to register and $100 on every score, must write its own thesis — graded independently, with copies earning nothing and derivatives half — may score only once every 14 days, and is capped at 5%. A wallet whose expected 30-day reward on a token is below its $100 burn loses money on every score. On a busy token, extra wallets pay only if each one does genuinely original work, which is exactly what the reward exists to buy. We don't claim this makes extra wallets impossible; we claim it makes them pay their own way. For tokens whose rewards grow large, the registry can also scale the per-score burn with a published reward estimate:

The marginal dollar goes to the careful thesis, not the biggest wallet — which is either radical or obvious, depending on how long you've been here.

#Fees, Holders & the Score Ramp

Holders are paid in the pairing asset from the first trade. The creator earns their share with the score.

Every trade pays one trading fee, the same on the curve and after graduation. The fee router splits it into dedicated lanes — the creator, the token's holders, its scorers and the platform-token buyback, the EDEN index, oracle operations, the protocol, and the grants treasury — each with a fixed, published destination and no discretionary pot in between. Treasury yield flows through the same lanes. The protocol takes its share from trading; it never takes a share of a project's business (§13).

Holders are never throttled. Their lane runs from the first trade, for every launch, verified or not, and it pays in the pairing asset chosen at launch — ETH, USDG, or tokenized stock. Not points. Not a reflexive token whose value is the next buyer's optimism. The thing your grandmother would recognize as getting paid. Payouts settle per epoch: balances are snapshotted, a Merkle root of everyone's share is posted, and after a one-day review window each holder claims their share, any time in the next ninety days — paid only to the holder's own wallet, or to a recipient that wallet signs for. No operator can redirect it. Buying after a snapshot earns nothing for that epoch; moving tokens to a fresh wallet earns nothing either, because the claim names the snapshot holder. Unclaimed amounts roll forward into the next epoch's pot, and pool, curve, locker, and vault balances are excluded from every snapshot.

The creator's share is earned, not granted. Earlier drafts gave new projects a grace window that decayed until first verification. That decay is retired, and so is the latch. The creator's share of the fee now slides linearly with the project's latest attested score — every epoch, in both directions — between a floor and a ceiling:

What the creator hasn't earned goes to the protocol, the platform-token buyback, the index, and the holders. A project that stops producing slides back toward its floor in real time; a project that proves itself climbs. Farming the ramp is pointless by construction: the score that drives it is computed from re-fetched data the creator doesn't control, sealed, and challengeable.

A project that clears the gate before its curve sells out — pre-verified during bonding, §4 — simply starts higher. The reward for being real is immediacy, never subsidy: no burn rebate, no curve change — so a forged early attestation buys only a badge that continuous re-scoring and the challenge window destroy within epochs.

#ROOT & a Price Nobody Posts

One fixed supply, one honest price, and no keeper in the middle.

ROOT is the platform token. It is not launched on a curve, it is never scored, and it sits outside the launchpad economics it anchors. Its supply is one billion, fixed at genesis: the five genesis mints run, total supply is asserted, and the mint authority is renounced in the same broadcast. There is no minter, no mint controller, and no inflation schedule. Supply only falls — through launch, registration, and score burns, through buyback-and-burn, and through redemption.

ROOT trades against ETH in its own pool, whose hook charges a small swap fee to the protocol. The genesis position is locked in a contract with no remove or collect function; secondary pools are allowed, and ROOT carries no transfer restriction.

Every burn in this paper is denominated in dollars — $500 per launch, $100 per registration, $100 per score — and charged in ROOT. That makes the price of ROOT load-bearing, and a posted price is a trust assumption: someone has to post it, and whoever posts it can be late, wrong, or bought. So on mainnet nobody posts it. ROOT's own pool hook keeps a tick accumulator on every swap, and the oracle reads it directly:

It fails closed only when it should: a bad or stale Chainlink answer, an uncovered averaging window on a brand-new pool, or a result outside sane bounds. It never compares itself to spot, so a spot move can neither change nor block a burn. A one-second spike to an absurd price moves a thirty-minute mean by a rounding error; holding a skewed price for hours is a position the market can take the other side of. Pairing assets are priced the same way, from their Chainlink feeds.

#The Treasury, the Index & the Floor

A book you can read, a thesis made literal, and a floor sized for the day it gets tested.

Start with why a venture platform holds a treasury at all. Every launchpad before this one ran on a single fuel: fee velocity. Trading fees paid for everything, which means attention paid for everything — and attention is the least reliable revenue in existence. When volume died, buybacks died, incentives died, and the platform died, in that order, every time. The treasury is the structural answer: a balance sheet that does not need the market to be loud. It gives the system a second heartbeat — one that keeps beating through the quiet months that kill everything built only on noise.

It is a published book in four sleeves, with working targets: the NAV floor reserve (≈46% — backs the per-token floor, never draws down), the EDEN index (≈26% — long-only tokenized AI equities), the grants program (≈13% — §12.3), and liquid reserves (≈15% — stablecoin, buybacks and operations). Grants are the treasury's only discretionary outflow, and the floor and index sleeves never fund them.

#12.1 The index — why we hold it, and why long

A treasury could sit entirely in stablecoin and T-bill equivalents and still fund the floor. We deliberately don't, and the reason is coherence. This entire protocol is one directional claim, made over and over at every layer: AI startups will do more real, verifiable work every year. A creator launching on the curve makes that bet. A buyer of a bonding-curve token makes that bet. The scoring oracle exists because we believe there will be more real output to verify, not less. It would be strange — actually incoherent — for the balance sheet underneath all of that to sit neutral on the very industry the platform grades. So the treasury takes the same side of the same trade as everyone standing on top of it: some protocols hedge away direction to harvest a spread; EDEN runs the opposite book — long only, no shorts, no leverage, just long different assets. If AI compounds, the platform that verifies AI compounds with it.

The long book does four jobs. Yield in silence: the index's dividends and interest are the one revenue line that fires at zero trading volume — it replenishes the grants sleeve and the buyback engine precisely when fee velocity can't. Weight under the floor: real, priceable, redeemable assets are what turn the NAV floor (§12.2) from a promise into a number. A counter-cyclical bid under the root: when markets turn violent, fee revenue collapses with volume and a fee-funded buyback would go silent exactly when it's needed. The index inverts that — and every dollar of inflow the throttle parks in stablecoin during high-vol regimes is dry powder, so the treasury walks into the worst markets with its cash position growing. Alignment on the way in: weights are set by research, not sentiment — supply and demand read directly from manufacturers and providers, chip order books, datacenter capacity, and energy contracts, layered with market-trend analysis. The current book spans the AI stack: the energy that powers the datacenters (Bloom Energy), the clouds that rent the compute (CoreWeave, Nebius), the silicon itself (AMD, Intel, NVIDIA), and the layer that puts AI to work in the physical world (Tesla). Weights are published, reviewed per epoch, and subject to change.

The basket is wrapped in a transferable index token, EDEN: one unit is a pro-rata claim on the vault, dividends accrue inside it, and creation and redemption run only through authorized participants. Its risk is disciplined structurally, not rhetorically. Deployment of inflow into equities throttles on the index's own realized volatility and drawdown — not a proxy asset's:

Floor coverage is computed against a volatility-buffered value of the equity sleeve — never a raw last close over a weekend. While reference prices are stale, redemptions pause and floor-adjacent quotes widen; curve trading never pauses.

#12.2 The floor and the redemption facility

ROOT is redeemable against the reserve at NAV per token, through a rail borrowed from ETF structure but deliberately not copied whole: retail freely trades ROOT and every leaf token on the open market with nothing but a wallet, while a small set of whitelisted, KYC'd authorized participants — and only they — redeem directly against the reserve, pinning the floor exactly as APs pin an ETF's downside. What we didn't borrow is the other half. A real ETF's AP desk also creates: mints new shares against fresh collateral and sells them into a premium. We kept only the half that protects holders. There is no create function. ROOT's supply is fixed at genesis and only ever shrinks, so there is no rail through which new ROOT can be minted and sold into demand to cap it.

The floor is honestly framed — a design target, not a promise — but it is sized, buffered, and published per epoch for the day it gets tested. Burns help the floor; they cannot guarantee it — a falling equity market, illiquid reserves, or no authorized participant willing to redeem can each leave ROOT trading below NAV, and the treasury book is stress-tested against exactly those cases before redemption opens. Net chart shape, when the treasury holds its value: a floor that rises on real yield and burns, and a ceiling that stays open to speculation. A token that cannot go to zero on bad vibes alone, in an industry where "bad vibes alone" is the leading cause of death.

#12.3 The grants program

The grants sleeve funds a standing program of direct, non-dilutive grants to consistently scored projects — not equity, not a loan, no token dilution, no strings on the grant itself. A grant round strikes every two months, on a fixed schedule. Eligibility is consistency-gated: a trailing score average over the scoring window, penalized for variance — one good epoch doesn't qualify; steady ones do. The gate is binary and timestamped: a project must hold approved status at the moment the round strikes; pending or lapsed means skipped, no retroactive payouts. Every round's list is approved by a council multisig before it can pay, and pays at most once. Funding is isolated by construction — grants draw only on the grants sleeve, replenished by treasury yield and the protocol's grants lane, never the floor or the index — so the program pays out even in a fully quiet market, which is exactly when a real builder needs non-speculative support most.

#Five Fires

Three structural, two funded — and the structural three burn even when nothing is trading.

Every prior burn engine had exactly one fuel source, and died with it. EDEN's supply retirement runs on five, split into two categories that fail independently. All five burn ROOT, all five are on-chain events, and all five show on a public burn ticker.

#13.1 Three structural burns

• The launch burn — $500 of ROOT, every launch, good or bad, ever verified or not, burned in the same transaction that creates the token. There is no launch fee; the burn is the price of entry.
• The registration burn — $100 of ROOT to become a scorer, alongside a 2,500 ROOT stake that is held, not burned.
• The score burn — $100 of ROOT (or more, per §9) on every score and every re-score, for the life of the platform.

Passive trading and holding stay burn-free — this is not a tax on speculation. It is a conviction filter on the people who launch and the people who judge, and a permanent deflation event every time either one acts.

#13.2 Two funded burns

• Buyback-and-burn — part of every token's fee lane, and of treasury yield, buys ROOT on its own pool every three hours, in small equal slices spread across the next three hours — never one large, predictable buy — each slice slippage-bounded and oracle-floored. Part of what it buys is burned; the rest is paired and added to ROOT's pool as permanently locked liquidity, so ROOT's own depth compounds alongside its shrinking supply.
• The scorer remainder — every unit of scorer reward nobody earned (§9) is bought as ROOT and burned.

These run on a keeper schedule, not a marketing calendar — every buyback and every burn is a transaction anyone can read, and the ticker shows them as they happen. Redemption against the floor (§12.2) retires ROOT too, as a sixth exit that only fires when it's needed.

The distinction matters: funded burns require activity to generate revenue; structural burns require only that people want to participate at all — a lower bar and a more resilient floor. And because the fee splits dual-layer on every trade, one successful project compounds its own holders' payouts and the entire platform's ROOT simultaneously.

#The Builder's Ledger

Verification costs a builder real effort. Here is what clearing it buys — three incentives, each answering a different refusal.

"Why should proving real usage pay me more than launching somewhere easier?" Answered by the score ramp (§10): your share of your own token's fee rises with your verified score, every epoch, and falls if the work stops. Being real is worth more here than being loud — and the score that pays you is computed from your systems, not your chart.

"Show me you can pay me in something unambiguous." Answered by the treasury grants program (§12.3): direct, non-dilutive grants of real value every two months — not equity, not a loan, no token dilution, no strings on the grant itself — consistency-gated so one lucky epoch never qualifies, and funded from the sleeve that treasury yield replenishes, so it pays out even in a fully quiet market. It lives in the treasury chapter, because that's what it is.

"None of this matters if I can't raise real capital." Partially answered — and we say "partially" on purpose — by the incubation layer: performance-ranked verified projects become eligible for direct introductions to institutional venture capital, plus hands-on help standing up the legal entity a real fundraise requires. This is a door to a pool of capital no crypto-native launchpad has a path to. It is also honestly scoped: unproven until a track record exists, a real chicken-and-egg, and we will not lean on it as a claim until the first cohort has made it true.

Earlier drafts promised a protocol emissions pool and subsidized compute. Both are retired: each depended on printing the platform token, and we would rather pay builders from fees that were actually charged.

Four channels, four different currencies: a rising fee share for the creator, pairing-asset payouts for holders, streaming quote-asset rewards for scorers, grants and capital for builders. The gate is one; the rewards are many.

#The Flywheel

Eleven stages. Every section of this paper is one component; the loop is what makes them compound.

1 — Launch. A creator in any track pairs against a real asset and launches instantly; the launch itself burns ROOT. 2 — Speculate. Retail trades the curve freely, paying with ETH if they like — pure conviction on the team and idea, encouraged, because it funds everything downstream and surfaces attention before performance data exists. 3 — Graduate. A curve at its bar auto-builds permanently locked liquidity. A checkpoint, not a reward. 4 — Verify. The oracle measures real output against category ground truth, continuously, and seals it under a challengeable root — the gate that is always running. 5 — Activate. The score lifts the creator's share; staked scorers write theses, burn ROOT on every score, and start earning. 6 — Capture. Trading fees and treasury yield throw off revenue — one needs activity, the other doesn't — while three structural burns fire on participation alone. 7 — Return. Every fee splits dual-layer: leaf holders are paid in real assets and ROOT is bought back and burned. 8 — Reward the judges. The square root, the quality weight, and the cap reshape who captures scorer flow, every second; what nobody earned burns. 9 — Deepen. Creator payouts and ROOT buybacks lock new liquidity, so every pool gets harder to move the more it trades. 10 — Compound. Treasury yield and burns ratchet the NAV floor, independent of sentiment. 11 — Reinforce. A rising floor, real payouts, and grants pull in the next wave of builders and scorers — back to launch, at a larger base, with dead weight falling out at every pass because stage 4 never stops.

#Ten Attacks We Wrote Down First

A mechanism paper that only describes the happy path isn't a design. It's a horoscope.

The system assumes it will be attacked by smart, funded, patient adversaries — so the attacks are part of the specification, each with its remediation shipped into the design rather than promised for later:

Trust hardening is staged the same way (§5.6): single accountable signer, then committee, then staked-and-slashable attesters — with the payout path untouched at every stage. We would rather ship an honest v1 with a named, bonded, challengeable signer than a decentralization theater with none.

#Disclosures

Plain statements, no fine-print games.

This whitepaper is a design specification for a protocol that is built and mainnet-ready on Robinhood Chain: its full launch ceremony has been rehearsed end to end on a fork of Robinhood Chain mainnet with production scripts and a 2-of-3 Safe, and every parameter in that rehearsal matched the reference deployment apart from documented, expected differences such as live price feeds. The treasury book, the grants program, and the authorized-participant redemption facility are deployed but start after launch; their sizing and participants are set before they do. It is not an offer to sell securities, not investment advice, and not a promise of returns. Named constants (α, CAP, BAND, the scorer cap and windows, burn sizes, sleeve targets, index weights, thresholds) are current settings or design targets, changeable only through the timelocked process of §16, and some — grant sizing, sleeve targets, the variance penalty — are flagged for further modeling. The NAV floor is a design target, not a guarantee: it can fall when treasury assets lose value. Verified status is a manual badge set by Eden's adjudicators; it is never automatic and does not change a score. Tokenized equities are restricted assets subject to their own transfer and eligibility rules; only whitelisted authorized participants interact with the reserve directly. Holder payouts described herein are mechanical routings of protocol fee flows in the pairing asset, claimed per epoch — nothing in this document promises yield, dividends, or revenue share, and the protocol takes no cut of any project's business revenue. Positions can be volatile or lose all value; transactions may be irreversible. The protocol never takes custody.