Know your deployment.
A verified market catalog, independently funded pools, and signing authority that stays with each user.
One catalog. Independent markets.
A mainnet deployment contains eight configured stock / USDG markets. Each market binds a stock-token contract, USDG contract, status adapter, factory, deployer helper, upstream feeds, freshness settings, and runtime code identities. The catalog starts with factories; funded pools are discovered from those factories after user-authorized creation.
| Environment | Chain ID | Assets and authorization |
|---|---|---|
| Robinhood Chain mainnet | 4663 | Configured stock tokens and USDG; user wallet authorization. |
| Robinhood Chain Testnet | 46630 | Separate mock assets for development; user wallet authorization. |
| Local Anvil | 31337 | Private development with an explicitly selected local account or wallet. |
Verify the contract set
The application reads a sanitized deployment through /api/config and verifies the selected chain, genesis, build identity, and configured runtime code. Mainnet manifests include per-market factories, helpers, adapters, feed addresses, and token metadata. A market with no funded pools is valid; connection verification must use its configured factory instead of assuming a first pool exists.
Discovered pools are matched back to their originating factory and immutable stock / USDG assets. Their strike, volatility, expiry, and reserve state come from contracts. A stale or unavailable read does not create a fictional balance or imply that an unfunded market holds liquidity. The public catalog loads at most 12 newest pools per market on each page. Older pages remain accessible, and creating another pool does not invalidate earlier pools or require one unbounded catalog read.
Separate roles and authority
| Role | Authority |
|---|---|
| Deployment operator | Explicitly deploys the reviewed market contract set. |
| Status publisher | Attests the current market session and source observation using the adapter owner's authority. |
| Website server | Reads the selected network and serves public configuration; holds no user signing key. |
| User wallet | Approves bounded asset spending and authorizes its own pool creations, supplies, trades, and withdrawals. |
The website never seeds a pool from an operator wallet when a user selects a stock. Initial liquidity comes from the connected user's exact stock token and USDG. A preview is read-only. Only the explicit final wallet action submits creation.
Configure the hosted website
VANTA_NETWORK=mainnet
NEXT_PUBLIC_SITE_URL=https://your-reviewed-domain.example
VANTA_RPC_URL=https://your-private-provider.example/endpoint
VANTA_DEPLOYMENT_PATH=/run/config/vanta-mainnet.json
VANTA_REQUIRE_PROTOCOL=1Use the generated mainnet manifest as the deployment source. Keep provider credentials and deployment or keeper signing keys out of public files, browser variables, Docker build arguments, and source control. The browser receives validated public addresses and a read-proxy path; wallet signing remains independent.
The Dockerfile produces standalone Next.js output, runs as a non-root user, and uses the platform-injected PORT. On Railway, use Dockerfile autodetection and the configured application healthcheck. A website rollback does not reverse mined contract transactions.
Readiness is a live condition
- Verify token, factory, helper, adapter, and upstream feed identities against the configured deployment.
- Monitor the actual upstream price timestamps and separately fresh market-session attestations.
- Treat a closed session, stale feed, paused issuer, corporate-action flag, or reference disagreement as an interruption to new risk.
- Keep existing reserve balances and proportional withdrawal paths readable during interruptions.
- Inspect wallet rejection, expired review, account or network changes, and transaction recovery.
- Maintain a documented incident channel and publish operator powers and unresolved security limitations.
A healthcheck proves website liveness, not fresh prices or trade feasibility. A receipt proves the outcome of one transaction, not the safety of subsequent ones.