Contracts

Robinhood Chain testnet, chain ID 46630. Mainnet is not deployed.

The testnet deployment settles in a mintable test token, not real USDG. Testnet balances are valueless.

Upgradeability

Non-upgradeable. No proxy, no delegatecall, no admin key that can change contract logic after deployment. Ownership is Ownable2Step, so a transfer must be accepted by the incoming owner; production deploys hand ownership to a Safe.

The owner can configure market parameters within hard caps, pause draws, set royalties up to 10%, and rotate the treasury. The owner cannot mint tokens without a signed voucher, alter a settled position, change a committed draw sequence, or move a user's balance.

Oracle

Prices are posted by an N-of-M signer quorum. Each post carries a market id, price and timestamp, signed EIP-712 by each signer. The contract requires signatures from distinct signers in sorted order so the same key cannot be counted twice, rejects a price deviating from the previous one by more than the market's deviation cap, rejects posts closer together than the market's minimum interval measured on wall-clock time, and rejects timestamps more than 60 seconds in the future.

A single compromised signer cannot move a price. A quorum can, within the deviation cap and rate limit.

Audit

Not independently audited. The contracts carry a unit, fuzz and invariant test suite and an adversarial review was run against them, but no third-party audit has been performed.