How Vellum works

Vellum is a public sandbox on Robinhood Chain Testnet (46630): Test USDG has no value, nothing is deployed on mainnet, and there is no Vellum token.

Vellum is deployed as a sandbox on Robinhood Chain Testnet (chainId 46630) only. The quote asset is Test USDG, a sandbox token with no value and a public rate-limited faucet. The fee source is a prototype that simulates accrual: series on this sandbox realize the fees the operator sets for the demo, not fees from a live Uniswap v4 pool. The contracts are unaudited.

The addresses below are the only genuine ones; they come from deployments/46630.json.

Explorer links open the contract tab on Blockscout, never a token page. Source verification on the explorer is pending; the addresses above are still the only genuine ones.

Add the network to a wallet

Testnet ETH for gas: the official faucet is https://faucet.testnet.chain.robinhood.com/ (browser only, limits unpublished); nothing else is endorsed. Test USDG comes from the faucet on the Mint and More faces.

Third-party contracts present on this chain at the mainnet addresses, recorded for information and never called by the sandbox (the site reads through Multicall3 only): PoolManager 0x8366a39CC670B4001A1121B8F6A443A643e40951, StateView 0xF3334192D15450CdD385c8B70e03f9A6bD9E673b, PositionManager 0x58daec3116aae6D93017bAAea7749052E8a04fA7, Permit2 0x000000000022D473030F116dDEE9F6B43aC78BA3, Multicall3 0xcA11bde05977b3631167028862bE2a173976CA11.

1. A depositor (an LP or a protocol) locks a fee-accruing position for a fixed tenor T = 30 days (1 hour on the sandbox).
2. The contract projects fee accrual over T (based on trailing on-chain fee growth) and sets a fixed claim F, haircut below projection so the bond is likely covered.
3. Depositor mints RB (face value F) and UT (residual above F).
4. Depositor sells whichever leg they do not want. Treasury sells UT, keeps RB. Speculator buys UT, ignores RB.
5. At maturity, accrued fees are distributed in order of seniority: RB holders receive up to F; UT holders receive the remainder; if fees fall short of F, RB is impaired pro-rata and UT receives zero.

RB and UT are claims on fees, not on the underlying LP principal. The position principal returns to the depositor, never to RB/UT holders. That keeps the vault non-custodial of principal and makes RB impairment bounded: worst case is fees = 0, RB worth 0, but the depositor always gets their principal back.

Revenue Bond (RB), the fixed leg

Supply equals F in USDG units. Redeems pro-rata for min(realized fees, F): exactly 1.0 USDG per RB when covered, less when impaired. Behaves like a zero-coupon bond: bought at a discount, the discount less the 0.3% redeem fee is the buyer's return.

Upside Token (UT), the floating leg

Supply equals P − F, the projected residual. Redeems pro-rata for max(realized fees − F, 0): 1.0 USDG per UT when fees land exactly on projection, more in the up case, zero in the flat and down cases. UT is uncapped but junior.

No off-chain oracle. A contract cannot read historical state, so trailing-30-day fee growth is sampled forward: a permissionless checkpoint() stores the pool's global fee growth and price into a 256-slot ring buffer at least 6 hours apart. project(liquidity) takes the newest checkpoint and a reference checkpoint at least 30 days older (or the oldest available, with a 7-day minimum window), computes the position's window fees as liquidity × Δ fee growth, converts the non-USDG leg at the latest pool price and scales linearly to 30 days.

The projection is used only to set F at mint time, never to settle. The newest checkpoint must be at most 1 day old at deposit, otherwise the deposit reverts and the app offers a "Refresh projection" button.

Launch trust assumption. The owner may seed one bootstrap checkpoint read off-chain from an archive node so day-one deposits get a true 30-day window. Nothing on-chain proves that value; the app shows a "bootstrapped projection" badge while the bootstrap is the reference checkpoint. On the sandbox the fee growth itself is simulated by the fee source, so the badge reads “seeded projection” and the figures are illustrative.

RB and UT each get their own constant-product pool against USDG (x · y = k), 0.3% LP fee on input, kept in the pool. LP shares are internal balances; the first provider locks 1,000 shares. Pools are created permissionlessly, once per strip token. Because both tokens are USDG-denominated, prices read directly as cents on the dollar and the RB discount to 1.0 is its yield to maturity.

• After maturity, any caller triggers settle(seriesId). Before maturity it reverts; on an already-settled series it returns silently.
• The fee source collects all fees accrued since lock, swaps the non-USDG leg (e.g. ETH) into USDG through the same v4 pool within a slippage bound (default 1% beyond the LP fee, measured against a 6-24h-old checkpoint price), and transfers the USDG to the vault. Whatever cannot be filled within the bound is held and converted by later settle calls in liquidity-sized chunks; 30 days after maturity the remainder converts at any price.
• The vault books rbPool = min(realized, F) and utPool = realized − rbPool, snapshots both token supplies, and marks the series settled. When the series is covered by the backstop and fees fall short of F, the backstop pays up to the series' cover limit in the same call, so RB receives min(F, realized + paid); UT is unchanged.
• The LP NFT returns to the depositor and only the depositor on the first settle call, with a non-blockable transfer and independent of the fee conversion. If fee collection itself keeps reverting, anyone can trigger an emergency return of the NFT 7 days after maturity; the series then settles with zero fees.
• Holders redeem by burning RB or UT: gross = amount × pool / supplyAtSettle, a 0.3% fee goes to the treasury, the rest is paid in USDG. Ratios are fixed forever at settlement.
• Settle and redeem are never pausable, and the result is identical regardless of who triggers. The owner can change a series' maturity and the redeem fee at once, with no delay (see Owner powers).

The full specification, including the fee-source adapter's v4 calldata, is in docs/SETTLEMENT-SPEC.md and docs/ARCHITECTURE.md in the repository.

v1 protocol fee: 0.3% on mint and 0.3% on redeem, plus a 0.3% LP fee in the AMM. The mint fee is taken in kind (0.3% of RB and UT supply minted to the treasury); the redeem fee is 0.3% of each redemption's USDG proceeds. No governance token; the product is fee-based.

With the backstop, a covered series also pays an underwriting premium in kind (a slice of its RB and UT, 0.5% by default) to the backstop; of the harvested premium a creator cut (10% by default) goes to the owner, a keeper share to the keeper reward reserve, and the rest to stakers. Every one of these rates is owner-set; the live values are listed under Owner powers below.

$VELLUM is the first-loss token of the Vellum backstop. It has not launched: no $VELLUM exists on Robinhood Chain mainnet or anywhere else, and nothing on this site sells, lists or pre-sells it. The contracts take its address later, through an owner setter, and every VELLUM path stays idle until then.

• The backstop insures the fixed leg. Stakers deposit quote (USDG, or Test USDG on the sandbox) into the quote tranche. When a series is minted, the backstop locks part of that quote as cover for its RB holders and the series pays an underwriting premium in kind (a slice of its RB and UT). At settlement, if realized fees fall short of F, RB receives min(F, realized + cover) and the cover is paid from the locked quote.
• Without $VELLUM the backstop still runs, but every series gets only the base depth (10% of F by default). In the PRD Down case that lifts RB from 66.7% to 76.7% of face.
• $VELLUM adds depth. Staked in the VELLUM tranche it takes first loss on the deep part of each cover (up to 30% of F by default), valued at a frozen reference price with a haircut. In the same Down case RB recovers 96.7% of face, and a shortfall of 148 on F = 1,148 is covered in full. VELLUM never pays a cover and the protocol never sells it: cover is always paid from locked quote, and a slashed VELLUM stake moves to the quote stakers in kind.
• Stakers earn the premium. After harvest, the premium is redeemed and streamed to stakers over the vesting period: a creator cut and a keeper share first, then a share to VELLUM stakers whose stake backed the series, the rest to quote stakers.
• Keepers bond quote and, once it exists, VELLUM to earn a reward for each projector checkpoint they relay; a VELLUM bond earns 1.5x. Stakers' weight (quote principal plus VELLUM at an owner-set rate) votes on advisory proposals in the signal, which the owner marks executed or rejected.

On the testnet sandbox the VELLUM paths run with tVELLUM, a valueless stand-in from a rate-limited faucet, so the depth, slash and premium share can be seen working before $VELLUM exists.

tVELLUM is a valueless test token on Robinhood Chain testnet. It is not $VELLUM. $VELLUM has not launched.

The backstop, keeper registry and signal are deployed on this chain; their addresses are in the table above. Stake on the Stake face. The full design is in docs/TOKEN-UTILITY.md in the repository.

Owner powers. One owner address controls Vellum's contracts. Each of these takes effect immediately, with no delay, vote or cap: change the tenor and the maturity of any open series (earlier or later); change the fixed-claim share, the mint and redeem fee (up to 100%, applying to future redeems of settled series too), the underwriting premium, coverage depths and the cover basis, set the realised-fee rate the cover basis reads for a vault, per-series and per-epoch coverage limits (0 means no limit), epoch length, the VELLUM reference price, haircut, first-loss share and token address, the premium vesting period, the cover retry window, the backstop gas limits, keeper bond sizes, rewards and unbond delay, and every projector timing; reset the projector history; lower, cancel or drop the cover of any open series; release any staker's queued withdrawal early; slash keeper bonds; point the backstop at a different vault; pause new deposits, new cover, keeper rewards and the signal (settle, redeem, cover payment, cover retry and withdrawal claims are never paused); and withdraw 100% of accumulated creator and protocol fees at any time in one call.

What these powers can do to you

Moving a maturity earlier, or (on the testnet sandbox) setting the accrued fees of an owner series, lets the owner create a shortfall on that series, which the backstop then pays from stakers' quote to RB holders, including RB the owner holds. Moving a maturity later, or a series whose settlement is deferred, freezes every queued staker withdrawal behind it, because a withdrawal waits until every cover granted before it has settled; the owner's early release is then the only way out. Changing the backstop's vault or the VELLUM token while series are open re-routes new cover and capacity: open covers still settle against the vault and token they were granted with, but new capacity counts only the new token. Setting the premium vesting period to 0 lets a deposit placed just before a harvest take a share of that premium at once. Setting a first-loss share of 0 while a VELLUM token is set grants deep cover backed only by stakers' quote. Setting the realised-fee rate of a vault by hand sizes the cover of its next series in the realised-fee basis (mode 1) without any settled history behind it. Setting the projector's checkpoint interval below its tenor divided by 256 lets anyone shrink the projection window with spam checkpoints. Setting the backstop gas limit to 0 turns cover off for new series and records settling covers as failed until it is raised again.

Current limits the owner has not removed

Each is listed for the owner to decide: the live testnet test dollar keeps its faucet-cap bound until it is redeployed; the mainnet position source can be wired to a vault only once, because it holds LP principal; the sandbox fee knobs apply only to the owner's own series unless the owner widens their scope; ownership transfer takes two steps (the new owner must accept). Staker capital, RB/UT payout pools and LP principal are not fees and cannot be withdrawn by the owner. The current owner is 0xA864D52c6a30c9e9bEe0299892c91260B451e192.

• Volume wash to inflate UT (High). Realized-fee-only settlement; 30d tenor raises cost. Live, unsolved.
• Fees fall below F, RB impaired (Medium). F haircut at 70% of projection; seniority; bounded (fees-only). Mitigated.
• No liquidity at launch (High). Seed both pools from the project; single-pool focus. Planned.
• LP position out of range (Low). v1 restricts to full-range positions. Mitigated by scope.
• Regulatory/tax treatment of RB as a debt security (Medium). RB is a claim on realized fees, not a promise to pay; but this is unresolved and must go to counsel before mainnet. Open, do not fake a solution.
• Depositor never redeems (no loss) (Low). Principal always returns to depositor; settlement is permissionless. Mitigated.

The two open items, volume-wash manipulation and the legal treatment of RB, are the honest unknowns. Neither blocks an MVP on testnet; both must be resolved before meaningful TVL.

Copy on this site is drawn from PRD.md (v0.1, pre-build):

• §1 Problem and market: overview
• §2 Product definition and worked example: calculator
• §3 MVP scope: one pool, one fee source, one tenor (30 days), F = 70% of projection
• §4 Mechanism design: deposit/mint, AMM, fees, maturity and settlement
• §5 The demand wave: real-yield treasury demand; speculative volume spikes
• §6 Oracle and settlement: no off-chain oracle, fees measured on-chain
• §7 Tokenomics: no governance token in v1
• §8 Risks and mitigations: table
• §9 Rollout plan: Phase 0 (pool selection) through Phase 4
• §10 Success metrics: RB discount stability within 2–6%, organic UT volume, settlement correctness