Stax: permissionless ETFs, onchain.

Abstract

An exchange-traded fund is three separable machines: a formula that decides what it holds, custody that holds the assets and guarantees backing, and access that lets people in and out at fair value. In traditional finance the third machine is the bottleneck: only a handful of institutions are Authorized Participants permitted to create and redeem shares. Onchain, that privilege becomes universal: anyone can mint by depositing the underlying tokens pro-rata, or redeem by burning shares for those tokens. Stax implements this on Robinhood Chain over its tokenized-stock tokens. Shares are always fully backed by construction, mint and redeem use exact integer arithmetic with no price feed, and the vault contract is the only custodian. This paper documents the shipped protocol, its trust boundaries, and a staged path toward richer formulas that never spends more trust than an exit window and a bounded step can protect.

1The idea

Tokenized equities put real-stock exposure onchain. What they lack is composition: a way to hold a curated set of them as one position, created and dismantled permissionlessly. That is exactly what an ETF is, and the onchain version is strictly better on the axis that matters most for price integrity. Because everyone is an Authorized Participant, a secondary-market price cannot drift far from net asset value:

Stax ships this creation/redemption machine and the tooling around it: permissionless launch, an onchain registry the frontend reads directly (no indexer), and day-by-day performance computed from real token prices. The demand it serves is concrete: 24/7, one-token, brokerage-free equity diversification for anyone with chain access.

2Architecture

Stax is a factory that deploys minimal-proxy (EIP-1167) clones of a single audited-pattern vault contract, and an onchain registry of every basket ever created. Each basket is an ordinary ERC-20 whose supply is backed by a fixed set of underlying tokens held in the clone.

The registry is enumerable onchain (getBasketsCount / getBasketAt / getAllBaskets), so the interface reads the whole board straight from the chain with no backend. Basket creation is validated at the contract: 2–10 unique assets from an owner-managed allowlist, weights summing to exactly 100%, creator fee capped at 1%.

3Vault mechanics

Weights are unit weights, fixed at launch. A 40/30/30 basket means one share is backed by 0.4 / 0.3 / 0.3 tokens of each underlying, forever, not "40% of value forever." This is the deliberate simplification that lets the vault promise exactness with no oracle: mint and redeem are pure integer arithmetic against live balances.

• mintdeposit the underlyings pro-rata (rounded up, favoring the vault), receive shares minus the fee skim. The exact amounts are shown before you sign, read from the contract's own previewMint.
• redeemburn shares, receive the underlyings pro-rata (rounded down, favoring the vault). Exit is free. No fee on the way out.

Rounding always favors the vault, which makes per-share backing monotone: it can never degrade. This is proven by an invariant test suite that fuzzes arbitrary sequences of mints, redeems, donations, fee claims, transfers, token freezes and emergency exits: the vault always holds at least the pro-rata backing for live supply, plus every reserved claim. Fee-on-transfer tokens are rejected outright. The full contract suite is 68 tests (unit, fuzz, invariant, reentrancy, integration), verified locally and against a fork of the live chain with the real stock tokens.

A second entry path, Router Mode, lets a basket be entered and exited with ETH by swapping through a UniswapV2-compatible router (value-proportional split, slippage and deadline guards). It is implemented and unit-tested; the default and fully-exercised path is in-kind Vault Mode, which depends on nothing external.

4Fees

Two fees, both disclosed on the basket page and immutable after launch. A creator fee (≤ 1%, set by the launcher) and a fixed 0.3% protocol fee are skimmed from shares at mint only; redeem is free. Fee shares are minted to the basket contract and pull-claimed via claimFees, so total supply stays fully backed and nobody's exit is ever blocked by a pending fee. Changing a fee means launching a new basket. The number you see is the number that is enforced.

5Trust model & the fire escape

The product is not the features; it is the list of things a creator can never do. These are contract-enforced invariants, not promises: the creator has no withdrawal power over vault assets; the basket policy (assets, weights, fees) is immutable; and in-kind redemption is always callable by anyone.

The underlyings are Robinhood's tokenized stocks, upgradeable proxies that Robinhood can pause or blocklist. A naive vault that transfers every leg in one atomic redemption would brick the entire basket the moment a single underlying is frozen. Stax closes this with a per-leg emergency exit: emergencyRedeem pays out every transferable leg immediately and books any frozen leg as a claimable IOU (claimOwed), reserved in the vault and excluded from all pro-rata math so it can never be spent by later minters. One frozen token can no longer trap holders in the whole basket.

6Performance & transparency

Every basket page shows a day-by-day performance panel: net asset value per share, priced from real token prices (DefiLlama), with the 30-day change and a daily breakdown. It is labeled a gross index on launch weights: an un-fakeable track record computed entirely from public prices, never self-reported. When a price source is unavailable (for example the mock tokens in local mode), the panel says so plainly rather than inventing numbers. Honesty is a hard rule throughout: the interface never renders a value that does not trace to a real onchain or priced source, and the network it names is always the network it is actually on.

7The formula ladder

Each rung buys expressive power with a measured amount of trust, and a basket's rung is chosen at launch, immutable, and loudly labeled.

8Rebalancing

Moving beyond fixed baskets means answering: at what price does the vault trade, and who executes? An adversarial review of an earlier draft killed a naive decaying-auction design: on assets with market closures and earnings gaps it hands fillers a free option, and creator-set price bounds are a self-dealing channel. The redesign keeps trust minimal:

• Policy bounds are expressed in per-asset unit terms ("sell at most 20% of each asset's per-share units this epoch"): pure vault arithmetic that provably bounds value turnover with no oracle in the gate.
• Rebalances are announced, timelocked, and carry a guaranteed exit window, with a hard vault-favorable price floor committed at announcement, so holders can veto the exact worst price, not just the target.
• Auctioned inventory never leaves the redeemable set until it swaps, and per-share deltas are re-derived from live balances at every fill, so mint/redeem stay exact mid-rebalance.
• If the arbitrageur ecosystem to fill auctions does not yet exist, L1 stays unavailable rather than unsafe. A feature that cannot run safely does not run.

9Risks

Stated plainly, because a design that hides its failure modes has not handled them:

• Issuer power. Robinhood controls the underlyings and the chain and can pause or blocklist tokens, mitigated per-leg by the emergency exit, never eliminated. A partnership posture is the strategic goal; freeze resilience is the posture until then.
• No audit. An extensive test suite and adversarial review are not a third-party audit. Treat the live deployment accordingly.
• Regulation is structural. Wrapping tokenized securities into index products, especially with recurring fees, is securities-law-adjacent in most jurisdictions. Any public, fee-bearing launch is gated on legal structure. This document is engineering, not legal advice.
• Thin liquidity. Secondary-market pools and rebalancing fills depend on liquidity a young chain may lack; the roadmap assigns this an explicit owner rather than assuming it.

10Roadmap

11Live deployment

Stax is deployed and Blockscout-verified on Robinhood Chain. Addresses are read from the build's generated artifacts, not hand-typed.

Disclaimer

Stax is experimental, unaudited software. Nothing here is investment advice. Baskets are created permissionlessly by anyone. Always verify contract addresses onchain before depositing. Tokenized stocks carry the trust and regulatory characteristics of their issuer; holding a basket is not the same as holding the underlying securities. Use at your own risk.