Dark pools, hidden liquidity, and the soldier economy
What dark pools are in traditional markets, the mathematics of trading without being seen, and how s1337 rebuilds the structure on Robinhood Chain — with a fee stream that pays back out to holders on a permissionless trigger.
Contents
00Abstract
Dark pools are trading venues that execute orders without displaying them. They exist because showing a large order to the market moves the price against the order before it fills. Roughly 40% of US equity volume now executes away from public exchanges. The venues doing it sell invisibility.
s1337 adapts that structure on Robinhood Chain. 7331 fully on-chain soldiers mint alongside the $1337 token in a single 24-hour window. They then trade in a two-leg venue: the token leg is fixed at 333,333 $1337 and never moves, with a 33,333 spread either side of it that is burned rather than collected, and the ETH leg is a flat 0.01 ETH per trade, split half to a treasury vault and half to the reward pot.
Two reward streams run off that venue, and they are not the same asset. A staking layer (the Garrison) emits 9,000,000 $1337 per day from a finite reserve. Separately, the ETH half accrues inside an ownerless pot; once the balance crosses a threshold, any wallet can call slayDragon(), which swaps the entire pot into ETH across every soldier activated at that instant, in the same transaction. One ticker, hardcoded, no allocation decision for anyone to make. This paper describes the venue, both streams, and the math.
01What a dark pool is
A dark pool is a private trading venue — in US regulation, an Alternative Trading System (ATS) — that matches buy and sell orders without publishing its order book. Orders rest hidden. Fills print to the tape only after they happen. Nobody outside the venue sees size, side, or intent beforehand.
The lineage runs from ITG's POSIT (1987), which crossed institutional orders at scheduled times, through Liquidnet (2001), which built a network where over a thousand asset managers cross blocks directly with each other, to the broker-dealer pools of the 2000s — Credit Suisse Crossfinder, Goldman Sigma X, UBS ATS — and the independent venues of today. The SEC's Regulation ATS (1998) formalised the category; FINRA now publishes weekly ATS volume. As of 2025 there are over 50 registered ATS venues in US equities.
In 2025, total off-exchange execution ran at roughly 40–44% of consolidated US equity volume. ATS dark pools proper account for about 15–18% of that, the rest being wholesaler internalisation. Dark execution set records in early 2026.
02How dark pools execute
Midpoint pricing
Dark pools borrow their prices from the lit exchanges, referencing the National Best Bid and Offer (NBBO). The canonical dark execution is the midpoint cross:
A buyer and a seller matched at Pmid each save half the spread versus crossing the lit book, and neither order ever appeared on a screen.
Matching styles
- Continuous crossing — orders match the moment a contra arrives (most broker-dealer pools).
- Periodic crosses — orders accumulate and match at scheduled or randomised times (the original POSIT model), which blunts timing games.
- Negotiated blocks — the venue alerts two naturals to each other and lets them negotiate size (Liquidnet).
Anti-gaming controls
Fills reveal information after the fact, so venues deploy minimum execution sizes, counterparty scoring and randomised matching against traders who ping pools to detect hidden blocks.
03The cost of being visible
Execution has a cost beyond commissions, and that cost is a function of visibility. Three standard results:
Market impact — the square-root law
Across venues, instruments and decades, the price concession paid by a metaorder of size Q is empirically well described by:
Impact grows with the square root of size: 4× the size costs 2× the concession per share. At institutional size this dwarfs commissions, which is what makes hiding the order worth paying for.
Kyle's lambda
Kyle (1985) models a market maker who can't tell informed flow from noise and therefore moves price linearly in net order flow q:
λ measures how much information the market reads out of each unit of flow. A dark pool lowers the λ your own trading faces by keeping the flow unobserved.
Implementation shortfall
Perold (1988) defines the true cost of execution as the difference between the paper portfolio (filled instantly at the decision price P0) and the real one:
Almgren–Chriss (2000) then split impact into a temporary component (paid per slice, decays) and a permanent component (moves the price for everyone after you), and derive execution schedules that trade impact against timing risk. Dark pools attack the same cost earlier, at the point of disclosure.
04Taking the structure on-chain
A public blockchain is the most lit venue ever built. Every order hits a public mempool before it executes, and MEV searchers are the same predatory flow dark pools were built against. You can't hide an on-chain order book, so we split the trade into two legs and treat them differently.
Two legs
The token leg is the cross. The desk exchanges a constant P = 333,333 $1337 regardless of size or direction: ΔP = 0 for all Q, so the fill carries no impact and no information. What the trader pays sits a fixed 33,333 either side of that cross and is burned, not collected — see §5. The ETH leg is the toll: a flat 0.01 ETH that does not vary with size, direction or the collection's value. Eq (1) prices a midpoint cross by importing a number from a lit book rather than discovering one; here the imported number is the $1337/ETH price on Uniswap, and the fixed token leg is what it prices.
The fixed-ratio NFT/token vault is established design on Robinhood Chain. Clutch Markets' Anvil AMM v2 is the reference implementation and StonkBrokers the reference market; the fixed cross and the soft-staking layer both originate there. We run our own contracts and diverge in two places: activation is a single flat burn rather than a tiered ladder (§6), and the fee stream settles into a single RWA rather than a menu (§8).
Fixing the token leg removes impact from the fill, not from the system. It relocates it one hop, into the $1337/ETH Uniswap position, where it is fully lit and behaves normally under eq (2).
That's the cost of the design. A buyer needs $1337 first and a seller wants ETH after, and both go through a public AMM to get it — paying an ordinary concession that scales with √Q. What the pool removes is impact on the soldier, not in aggregate.
What this venue does not hide
A traditional pool hides the order. This one hides nothing about selection: the buyer names the token id, and the pool's inventory is readable by anyone. An earlier design filled blind and charged a premium to name a target, on the reasoning that naming one leaks which pieces you value. It does — but the leak is worth nothing when the whole inventory is public and the price is fixed, so the premium only charged the people who bothered to read the contract. What survives from §1–3 is the fixed cross, not the concealment.
Robinhood Chain has no Chainlink VRF on the production path, and the pool needs none — nothing about a trade is random. The mint does need one, hits the same missing primitive, and answers it in §4.1.
Distribution: one window, two lanes
The collection is 7331 soldiers, distributed in a single 24-hour window that opens when the $1337 position goes live.
- Whitelist lane — a merkle snapshot of holders of the listed Robinhood Chain collections, plus a hand-added list of early Robinhood Chain wallets by volume, mints one soldier per wallet, free. The snapshot is taken at a block, so acquiring or moving one of those NFTs afterwards cannot produce a claim. The two halves are not equally checkable: the collection snapshot is reproducible from chain by anyone, the hand-added list is not, and they are published separately for that reason. The free lane is capped at 3064 claims — a ceiling on the lane, not on the collection, and adjustable by the owner against the 7331 supply. Nothing is held in reserve for it: both lanes draw on the same supply and the free lane is first-come, so paid buyers can take soldiers that whitelisted wallets have not claimed yet. The snapshot names more wallets than there are free claims, so a whitelist spot is permission to try, not a reservation.
- Public lane — 0.02 ETH per soldier, up to 20 per transaction and no per-wallet cap, open to anyone. Both lanes open in the same block. Mint proceeds transfer to the launch wallet as each mint lands and fund the launch itself: the Uniswap position, the pool's token side and the Garrison reserve. They sit outside the rewards stream in §8, which is fed by trading and activation fees. That wallet and the three allocation tranches are published with their addresses on the front page, so the split can be checked rather than taken on trust.
Wallets holding several of the snapshotted collections still get a single free claim. The per-transaction cap on the paid lane is a throughput limit: it stops one transaction clearing the book in a single block, while leaving buyers free to send as many as they want.
When the window expires, the remainder Nrest = 7331 − Nminted is swept into the AMM pool by a permissionless sweepToPool() call and becomes NFT-side liquidity at the fixed price. Demand during the window therefore sets the pool's depth.
4.1 The reveal: deferred entropy
The mint hits the same missing primitive, and can't answer it the same way. A deterministic fill can still be fair; a deterministic trait roll can't. If the roll is computable inside the mint transaction, a contract mints, reads the result and reverts when it isn't rare, repeating until it is. It costs gas and wins the top tier.
The usual defence — requiring tx.origin == msg.sender — doesn't work here, so we don't use it. An EIP-7702 delegated EOA satisfies it while still executing code, so the conditional revert survives; and this chain ships native ERC-4337, so the check locks out legitimate smart wallets too. There is no such check in EliteSoldiers.
Instead the mint separates commitment from resolution. Minting assigns a sequential id i and records the current L2 block b, read from ArbSys.arbBlockNumber() rather than block.number, which on an Orbit chain reports an L1 estimate. Traits resolve against a block δ ahead:
H(b + δ) doesn't exist when the mint is submitted, so there's nothing to inspect and nothing to revert on. Settling is a permissionless revealBatch(): we run a keeper, anyone can call it, and the result is byte-identical whoever sends it. Batches settle in id order, so the cap in §4.2 applies by token id rather than by who reveals first.
Expiry. arbBlockHash() serves only the last 256 L2 blocks — about 25 seconds here. A batch left past that window is re-committed to a fresh block δ ahead and settles on the next call. Expiry delays a reveal; it can't prevent one, and nobody chooses a seed at any point.
A block hash is not a VRF. The party best placed to influence si is whoever produces block b + δ, who could in principle grind that block's contents to steer a roll. Two things bound it: the ids being steered were fixed δ blocks earlier and can't be added to, and steering one id's roll scrambles every other id in the same batch. We'd rather have a VRF; this chain doesn't have one. What it does remove is the minter's own ability to see a roll and throw it away, which is the attack that actually threatens a 0.2% tier.
4.2 Rarity
Every soldier rolls independently against fixed thresholds. No count runs down, so mint #1 and mint #7331 have identical odds. That closes a second attack, separate from the one above: with exactly 13 Lava in a known collection, anyone can work out that 7,000 minted and 2 left has tripled the odds, and bots sit out the window to mint the tail. Deferred entropy does not fix that, because nothing needs reverting — only waiting. Independent rolls do.
Thresholds are cumulative and checked in order, so the branches nest: Lava, else Wizard, else Wood, else Standard. Parts per million, because basis points are too coarse for the Lava rate.
| Skin | Rate | Threshold | Expected at 7331 | 90% interval |
|---|---|---|---|---|
| Lava | 0.2% | r < 2,000 | 14.7 | 9 – 21, capped at 18 |
| Wizard | 0.7% | r < 9,000 | 51.3 | 40 – 63 |
| Wood | 1.5% | r < 24,000 | 110.0 | 93 – 127 |
| Standard | 97.6% | r ≥ 24,000 | 7,155 | — |
These are rates. The counts beside them are what the rates imply, not promises — a binomial draw at n = 7331 has real spread, and the intervals are 90% central, so one collection in ten lands outside its own column. The front page quotes rates only. No mechanism produces the expected count, so printing it would just invite someone to hold us to it.
The Lava cap. Lava, and only Lava, is capped at 18. A roll below 2,000 once the cap is reached becomes a Wizard rather than a re-roll, since re-rolling would leak that the cap had bound. It binds with probability 0.157, taking the expected count from 14.7 to 14.2. A cap of 14 would bind most of the time and re-create the "Lava is gone" signal; 18 trims the tail and otherwise stays out of the way.
There's no floor. A cap rewards minting early; a floor would reward minting late, which is the behaviour this design exists to remove.
Traits
Below the skin, every trait is rolled from an independent 32-bit slice of the same seed against weights published in Renderer1337, per mille, each table summing to 1000. Rare skins override fatigues, and every Wizard wears the hat, so on those soldiers the fatigues and headgear are not independent rolls.
| Trait | Values, rarest first |
|---|---|
| Background | Static 6% · Terminal 8% · Deep Pool 10% · Crimson Dusk 11% · Jungle Night 13% · Midnight Ops 15% · Smoke 17% · Blackout 20% |
| Fatigues | Ghost White 6% · Forest 8% · Maroon Beret Corps 10% · Navy Ops 11% · Urban Grey 13% · Desert Tan 15% · OD Green 17% · Shadow Black 20% |
| Eyes | Leet Green 4% · White Out 8% · Violet 9% · Blood 11% · Gold 14% · Ice 16% · Toxic 18% · Ember 20% |
| Headgear | Night Vision 12% · Comms Headset 20% · Maroon Beret 22% · None 46% |
| Eye Style | Visor 40% · Round 60% |
| Unit Patch | Yes 22% · No 78% |
The thresholds, the cap and every weight in these tables are constants in the deployed contracts, published before the window opened.
05The soldier pool
Contract: DarkPool1337, listed as the AMM pool in the contracts section of the front page. It isn't a dark pool in the §1 sense and isn't called one there: it's a fixed-price NFT/token vault, and what it borrows from the first three sections is the fixed cross, not the venue type. The trading dark pools proper are the venue being built at pools.s1337.cash. One fixed token price, two operations, and a flat ETH fee.
P is what the desk exchanges, not what the trader pays. A spread sits either side of it and is burned rather than collected:
The symmetry is the point. An asymmetric spread would make one leg the profitable one to farm; equal burns on both make a round trip cost 66,666 whichever way it starts, and leave the desk's reserve exactly where it was. Nobody collects it — supply falls instead.
Buy, snipe and sell
buy() takes whichever soldier is next out of the desk at Pbuy; nextUp() says which one that will be, so it is a queue rather than a lottery. snipe(tokenId) names the soldier and pays 440,000, 20% over the blind price, and the entire 106,667 premium is burned — choosing costs supply, not the desk's balance sheet. sell(tokenId) returns one for Psell. ΔP = 0 for all Q in every direction: no curve, no slippage, no impact on the fill.
Sizing the pool
The token side sets how many soldiers can be sold in before it empties. For a token reserve R:
That is 16.4% of the collection, not the whole of it. Depth is two-way — each buy returns P to the token side and each sell takes it out — so a matched round trip leaves Nbid exactly where it started. Net flow is a different matter. That neutrality is a statement about round trips, not about direction: sustained one-directional selling drains the reserve at P per soldier with no offset, and when it reaches zero the fixed price stops being quotable on the bid. Roughly 1,203 consecutive sells with no intervening buy is all it takes. This is the venue's most likely failure mode.
The NFT side has the opposite problem: it may never clear. Each buy locks 333,333 $1337 into the pool's bid side, recoverable only if someone sells a soldier back. Against a total supply of 1,337,000,000 the absolute ceiling is 1,337,000,000 / 333,333 ≈ 4,011 soldiers, and that assumes every token in existence is available to buy with. Realistic float — the 534,800,000 Uniswap and operations tranche plus Garrison emission net of activation burns — supports closer to 1,500–2,500.
The pool's standing offer caps a soldier at 366,666 $1337 while inventory remains — 440,000 for a named one — so no soldier prices above that in tokens: the collection appreciates in ETH terms only, never in token terms.
Fees
The ETH leg is flat and does not move with the collection:
Garrison activation pays the same 0.01 ETH on the same split. Half of every ETH fee the protocol charges reaches the vault; the other half reaches the pot in §8 and comes back as ETH. Nothing accrues in the pool itself and none of it is claimable later. A forward that fails does not revert the trade — a broken sink must not be able to halt trading — so the ETH waits in the pool and flushFees(), which anyone can call, pushes it on.
A flat fee decays in real terms as the collection appreciates. That is the accepted cost of not running a price oracle: the earlier design charged a percentage of a posted OpenSea mark, and a posted value is a trust assumption that has to be defended forever. 0.01 ETH is a number nobody has to trust.
Royalties and the owner
A pool trade pays no ERC-2981 royalty and never will. The pool is an allowlisted operator moving its own inventory, which is not a marketplace settlement, and the flat ETH fee is the revenue on this venue instead. The 10% royalty in §7 applies to secondary sales elsewhere.
Both sides of the pool are owner-withdrawable at any time, through withdrawNfts() and withdrawTokens(). This is dev-seeded liquidity and the project rule is that nothing is stuck anywhere; the corollary is that pool depth is dev-controlled and should be read that way. Separately, ETH stranded by a broken fee sink can be swept by the owner after 30 days with no trade — every trade resets that clock, so it cannot open while the desk is in use.
06Garrison emission math
Contract: Garrison. Soft staking — soldiers stay in the holder's wallet. Activating soldier i burns a fixed 33,333 $1337 and costs 0.01 ETH, once and permanently. Weight is the amount burned, so every activation carries the same weight and a holder's share of both streams is their activated count over everyone's.
There are no ranks, no upgrades and no skin multiplier. Activation burns leave supply permanently, and the burn, the fee and the emission rate are immutable.
The drip
The Garrison emits at a fixed rate E = 9,000,000 $1337/day while at least one soldier is active and the reserve is positive. It uses a standard accumulator: with total active weight W(t), the per-weight index A advances as
and the claimable balance of soldier i with weight wi activated when the index stood at Ai is
Equivalently: each soldier's share of any day's 9M is wi/W.
The clock stops at W = 0. With nothing activated there is no denominator, so rather than emit against nobody the contract slides its end date forward by however long it sat empty. Without that, tokens accrue in the gap between funding and the first activation and are allocated to no one and withdrawable by no one. The practical effect is that the 44.6-day runway is 44.6 days of actual paying, not of wall clock.
Voiding and discharge
Selling or transferring an activated soldier voids its activation and forfeits its pending. The NFT contract calls the Garrison on transfer, so the common path is automatic. For any case where a soldier's registered weight outlives its activation, discharge(tokenId) is permissionless: anyone may call it against a soldier whose activating wallet no longer holds it, clearing its weight from W(t). Without that anyone can leave stale weight in the denominator, diluting every honest holder until someone happens to touch it.
Forfeited $1337 is re-emitted rather than destroyed: the reserve's end date extends by the amount handed back, so it returns to the stream for everyone still activated. Forfeited ETH returns to the undistributed pot and lands in the next drop.
Reserve and runway
The reserve starts at R0 = 401,100,000 $1337 (30% of supply). Runway at full emission:
The only inflow is fund(), which is permissionless and one-way — anyone may add to the reserve and nobody, including the owner, can take it back out while a single soldier is activated. Activation burns are burned in full and contribute nothing. The $1337 drip is finite: at full rate the reserve is empty in about a month and a half. It is a launch subsidy, not a yield. Steady-state yield is the ETH stream in §8, which is funded by fees rather than by a fixed reserve and does not run out.
Claims
One claim() pays both streams together for a flat 0.0015 ETH, to the wallet that activated the soldier and still holds it. The fee is owner-adjustable against a hard ceiling of 0.5 ETH, because a number hardcoded in ETH drifts from its dollar target as ETH moves. Activation charges its own 0.01 ETH at entry, half to the vault and half to the pot in §8.
07$1337 launch parameters
Fixed supply, no mint function, no owner:
$1337 trades against ETH in a one-sided Uniswap v3 position on Robinhood Chain, seeded with tokens only and live from the moment the mint window opens. The position sits in the range [p0, pmax], where p0 is the opening price in ETH. For a token-side deposit of Δx its liquidity is
Buyers walking the price up convert the token side into ETH along the curve, so the position capitalises itself through trading rather than from a matched ETH deposit.
Allocation
| allocation | $1337 | share |
|---|---|---|
| Garrison reserve (emission) | 401,100,000 | 30% |
| AMM pool token liquidity | 401,100,000 | 30% |
| Uniswap v3 one-sided position + operations | 534,800,000 | 40% |
Each tranche's wallet is published on the front page, so the split is checkable rather than asserted. The 40% tranche is the only one not held by a contract: what is not seeded into the Uniswap position stays under the deployer's control.
Royalties and the vault
The collection declares a 10% ERC-2981 royalty. ERC-2981 is a view function — it tells a marketplace what to pay and compels nothing, so what a secondary sale actually pays depends on the venue, not on this contract. The collection also carries the ERC-721C surface that would let a validator enforce it, but no validator is wired at launch (transferValidator is the zero address) because the chain has no live validator deployment to point at. Nothing here should be read as royalties being enforced. Pool trades pay 0% by construction, as described in §5.
The royalty receiver is a RoyaltySplitter: it holds what arrives and anyone may call release(), which sends half to the vault and half into the Dungeon — where it becomes holder rewards on the next slay rather than income for anyone running the project. It has no owner and no setter, and both destinations are immutable. The same 50/50 rule applies to every ETH fee the protocol charges. The vault is a plain wallet, held for liquidity, sweeps and whatever holders later vote it into; it is not a contract and carries no on-chain governance today.
08The Dungeon: fees and the slay
Half of every ETH fee the protocol charges — trades and Garrison activations — accrues inside a contract with no owner and no admin. The mechanism below is the only exit, other than a narrow sweep that opens only after the contract has been unusable for two months (§9).
Slaying the dragon
Above 0.1 ETH, slayDragon() splits the pot across every soldier activated at that instant, in ETH, for any wallet willing to pay the gas. The caller keeps 0.5% — enough that pulling the trigger is never a loss, small enough that it is not the reason to — and pays a 0.001 ETH toll from their own wallet to the dragon-slayer pot. The threshold is an immutable constructor argument and the cut is a constant.
Below the threshold the call does not revert. The toll is still paid, nothing is distributed, and nothing is credited: no cut, no leaderboard total, no slay counted. An early swing is a donation to the weekly prizes rather than a wasted transaction, and since the leaderboard moves only on ETH actually released, swinging at an empty dungeon can never buy a place on it.
The toll is charged to the slayer rather than taken from the loot, and it is excluded from the pot, so a caller cannot top the pot over the threshold with their own toll and take it straight back out.
There is no operator, no manual conversion and no off-chain step anywhere in this. The trigger is permissionless, the swap target is hardcoded, and the accounting is the same accumulator the drip uses. A drop of size G credits soldier i:
It lands in full, in that transaction. Nothing vests and nothing is scheduled: whoever is activated at the instant of the slay takes the whole drop, and whoever activates a block later takes none of it. One accumulator write credits the entire book, so the cost of a slay is the same at five activated wallets as at five thousand — nothing is pushed to holders, and each claims when they choose.
A drop that lands while nothing at all is activated is not lost. It is held as undistributed and folded into the next slay, so the first activated cohort after a quiet period collects it.
The leaderboard
Slayers are ranked by total ETH converted, not by number of slays. Ranking by count would pay people to swing at the smallest eligible pot as often as possible, which costs every holder a tip and a swap for nothing; ranking by size makes waiting for the pot to grow the better play. Weekly prizes are bought from the dragon-slayer pot and range with whatever has accumulated in it.
Why ETH, and not a tokenised stock
An earlier design converted the pot into a tokenised equity and paid holders in that. It was dropped, and the reasons are worth stating rather than quietly deleting:
- The payout token had to be hardcoded in the Dungeon's constructor with no setter. On this chain dozens of contracts answer to the same ticker, several of them byte-identical clones of one template. Getting it wrong pays holders in a stranger's token, permanently.
- Tokenised-equity rails carry their own eligibility rules, so some holders could never have received that reward at all. ETH has no such gate — nothing in this protocol restricts who can hold, mint, trade or claim.
- A swap needs a router, two price feeds and a pool with real depth. Each can be retired, halted or drained, and each needed its own escape hatch.
Fees are charged in ETH. Paying them out in ETH removes every one of those, and removes the conversion loss and the slippage with them. Real-world assets and NFTs are still handed out — bought and awarded by hand from the vault and the slayer pot, which is honest about being a manual process rather than dressing it up as automation.
Two streams, two characters
The protocol pays in two assets from two sources. They are independent and neither inherits the other's durability:
| stream | source | character |
|---|---|---|
| $1337 drip | Garrison reserve | finite — ~44.6 days at full rate (§6) |
| ETH | trading and activation fees, via slayDragon() | perpetual, volume-dependent |
Both share the same weighting rule. Over T days with average distributable value F̄ per day and average total active weight W̄:
Live trading operations, if they are stood up, would report into the same contract on the same terms; nothing in this paper depends on them.
Read it twice, once per stream: with F̄ = E = 9,000,000 $1337/day it describes the drip (eq 8–9) until the reserve empties; with F̄ equal to average daily fee flow it describes the ETH stream, which does not empty. Since every activation carries identical weight, wi/W̄ is just your activated count over the total activated count, and doubling the time held doubles the take. The fee is flat in ETH per trade rather than proportional to the collection's value, so this stream scales with volume and not with price.
09Risk disclosures
- Smart contract risk. Contracts can contain bugs. These are open source and small; read them.
- The ETH stream is fee income, not a yield. It is whatever the protocol actually charges. A week with no trading and no activations pays nothing, and nothing guarantees any particular volume.
- Relocated impact. Fixing the token leg doesn't remove price impact, it pushes it into the $1337/ETH Uniswap position, where it behaves per eq (2).
- One-directional flow drains the bid. The token reserve bids for ~1,203 soldiers, 16.4% of the collection. A fixed price isn't a guaranteed fill — when the reserve empties there's no bid at any price.
- Finite emission. The $1337 reserve runs to zero in about 44.6 days of paying. Nothing but a voluntary fund() adds to it.
- Dev-controlled pool depth. Both sides of the AMM pool are owner-withdrawable at any time. The bid that backs a soldier at 333,333 $1337 can be removed without notice.
- Owner keys exist. The collection, the pool and the Garrison have an owner. The Dungeon does not. After 30 days of no use, each ETH-holding contract opens a narrow owner-only sweep, and the Garrison's token reserve opens only if no soldier at all is activated. Every ordinary use resets those clocks.
- The reveal seed is a block hash, not a VRF. Robinhood Chain has no VRF on the production path. Traits resolve from the hash of a block produced after the mint (§4.1), which the sequencer producing that block could in principle grind. The design removes the minter's ability to inspect and revert a roll; it does not make the seed unmanipulable by the party that builds the block.
- Reveals can be delayed. A batch whose seed block ages out of the chain's 256-block hash window rolls forward to a fresh block. Traits always settle and nobody ever selects a seed, but a soldier can sit unrevealed for longer than the usual second.
- Rare skins are rates, not counts. Every mint rolls independently, so the final population is a binomial draw. One collection in ten lands outside the 90% intervals in §4.2, and no count — including a non-zero Lava count — is guaranteed by any mechanism.
- Timing decides the drop. ETH lands in full on whoever is activated at the instant of a slay. Activate a block later and you get none of that drop; transfer an activated soldier and you forfeit whatever it has not claimed.
- $1337 carries no claim on equity, no redemption right and no guaranteed value. Drops are protocol rewards paid by an ownerless contract, not dividends, and carry no claim on GameStop Corp. or any issuer.
- The mint window is 24 hours and does not reopen. Public-lane mints are paid and non-refundable, and a soldier bought at 0.02 ETH may be worth less afterwards.
- Nothing in this paper is investment advice.
10References
- Kyle, A. S. (1985). Continuous Auctions and Insider Trading. Econometrica 53(6).
- Perold, A. F. (1988). The Implementation Shortfall: Paper versus Reality. Journal of Portfolio Management 14(3).
- Almgren, R. & Chriss, N. (2000). Optimal Execution of Portfolio Transactions. Journal of Risk 3(2).
- US Securities and Exchange Commission. Regulation ATS, 17 CFR §§ 242.300–304 (1998).
- FINRA. ATS Transparency Data — weekly ATS and OTC volume reporting.
- Bartlett, R. P. & McCrary, J. (2017). Dark Trading at the Midpoint: Does SEC Enforcement Policy Encourage Crossing Networks to Undercut Exchange Liquidity? American Law and Economics Review 19(2).
- Ethereum Improvement Proposals. ERC-8056 — tokenised equity with an on-chain share multiplier for corporate actions.
- Design antecedent: Clutch Markets, Anvil AMM v2 — fixed-ratio NFT/token vault on Robinhood Chain, and the StonkBrokers market built on it.