Clear boundaries. Inspectable state.
Understand how the interface, wallet, read API, selected chain, and status publisher work together.
The application system
Read state and review a bounded action.
Authorize an explicit transaction.
Validate and update owned balances.
Browser / Next.js application
├─ /api/config → sanitized market catalog
├─ /api/rpc → read-only chain access
│ ├─ eight stock / USDG factories
│ ├─ discovered pools and reserve balances
│ └─ configured price feeds and session adapters
└─ user wallet → exact approvals and transactions
Robinhood Chain mainnet (4663)
├─ configured stock tokens + USDG
├─ immutable pools + transferable LP balances
└─ price feeds + fresh market-session attestationThe browser uses viem for contract state. A read proxy keeps the provider's private endpoint on the server; signing stays with the user's wallet. No application database, custodial transaction API, or off-chain balance ledger is required. The pool contract is the source of truth for reserves and LP balances.
Explicit signing authority
| Path | Authorization | Boundary |
|---|---|---|
| Local development account | Explicit selection of an unlocked Anvil account, then eth_sendTransaction | Restricted to loopback access, local chain 31337, and matching deployment identity. |
| Injected EVM wallet | EIP-1193 account request and wallet transaction approval | Wallet holds signing authority; the app reads only the selected public account. |
A wallet connection is not a permission for future background trading. Each approval and pool action is visible as its own transaction. The local account is deliberately convenient for testing and must never be presented as a secure production key store.
State and freshness
Quotes depend on reserves and block time, so they can change after rendering. The interface refreshes contract state and reports transaction results. A mined receipt is authoritative for success; a pending UI state is not proof that a transaction will succeed.
Mainnet price feeds and the session publisher are separate from the website. A keeper that has not published a session, an unavailable source, or expired data leaves new risk disabled. Keeping a browser tab open cannot bypass that gate. The initial mainnet deployment contains eight configured markets and zero funded pools; pool discovery reads each factory for later user-funded creations.
Deployment identity
A deployment manifest binds the interface to a particular chain, genesis, build fingerprint, deployment block, and contract set. Mainnet identity is per market, including tokens, status adapter, factory, helper, and source feeds. Discovered pools are checked against their factory and immutable asset pair. Verification is repeated before writes. Local state and development credentials are excluded from the website container.
The transaction journal is account- and deployment-scoped browser storage. It preserves hashes and recovery state through reloads; it is neither an indexer nor an authoritative balance ledger. Replacing a deployment does not migrate balances or transaction history.
Read API boundaries
/api/config exposes only validated public network metadata and deployment fields. /api/rpc accepts an allowlist of read and simulation methods; all wallet sends, unlocked accounts, signing, debug, and administration methods are rejected. Calls and estimates are limited to configured contracts. Private provider errors are redacted while bounded hex revert data remains available for contract error decoding.
| Limit | Policy |
|---|---|
| Request / response | 32 KiB / 4 MiB |
| JSON-RPC batch | At most 8 calls |
| Concurrent HTTP requests | 8 per application process |
| Request budget | 600 per minute per reported client IP; 2,400 per process |
| Log range | At most 1,001 explicitly numbered blocks |
| Origin | Configured application origin; loopback preview only in development |
These process-local limits reduce provider abuse; they are not distributed authentication. A public edge must enforce its own trusted forwarding and rate policy. /api/health reports website liveness and configuration status, not proof that every pool is currently tradable.
Later architecture
Per-market factories, wallet-funded pool creation, and mainnet status adapters are implemented. The full specification additionally describes a router, separate lens, general reorg-aware account indexer, and funded VANTA fee-distribution pipeline. Those services are not silently running behind the interface.