PROFI Protocol
Whitepaper.

Profi is a proposed onchain marketplace for fully collateralized agreements between asset holders seeking conditional downside protection and stablecoin holders willing to accept that downside in exchange for premium income. Every market defines its deposits, payment conditions, observation schedule and settlement assets before participants commit capital.

Profi Earn supplies settlement capital. Profi Protect supplies the underlying tokens and prepays the maximum premium obligation. If a market finishes below its maturity barrier, Earn receives the deposited underlying and Protect receives the agreed stablecoin principal. Otherwise, each side receives its original principal asset. Eligible observations transfer premiums from Protect to Earn, after the disclosed protocol fee.

The initial product uses fixed terms, matched lots, isolated escrow and direct claims. It has no lending, leverage or dependence on token emissions to fund premiums. The initial platform includes allocation vaults and a constrained market creation interface, with their accounting and permissions reviewed alongside the core engine.

Profi's commercial objective is to make conditional risk transfer understandable and verifiable. Its technical objective is to settle every obligation from assets already held by the corresponding market.

Asset holders may want to retain their holdings while transferring a defined part of severe downside risk. Stablecoin holders may accept that risk when compensation and settlement terms are clear. Profi connects these objectives through prefunded contracts rather than promising income from unspecified investment activity.

The initial commercial audience is eligible, experienced digital asset holders and counterparties who understand lockups, conditional payouts and physical token settlement. Treasury use is possible only within an organization's mandate. This product is not positioned as a savings account or comprehensive insurance.

Product family

Product commitments

Participants see both sides of the agreement, the maximum protection cost, net premium amounts, lockup dates and every terminal outcome before deposit. A scenario simulator shows losses as well as income. The portfolio separates claimable amounts from locked collateral and distinguishes successful settlement from failure recovery.

Profi's intended differentiation is its implementation discipline: a limited initial asset set, clear maturity-only barrier behavior, isolated custody and no obligation to purchase PROFI to enter a market. These are design choices, not claims that competing protocols lack the same features.

Scope of the initial release

Launch all four products with one approved underlying, one settlement token and short dated series. Use fixed-rate templates, account-based positions, controlled Studio access and epoch-based Earn allocation vaults. Exclude cross-chain collateral, secondary trading, lending against positions, pooled reserve support and public permissionless creation. A protocol liquidity facility is optional future work and provides no assumed backstop.

The first underlying must have lawful acquisition and transfer pathways, a qualified price source and predictable token behavior. If any requirement fails, use clearly identified mock assets on testnet and postpone real capital deployment.

Each market pairs the same number of Earn and Protect lots. A lot contains a fixed quantity q of underlying and fixed stablecoin principal n. The initial strike P0 is denominated in settlement-token units per underlying token. Subject to disclosed integer rounding, n = q × P0.

For a participant holding L matched lots:

N is principal, Q is underlying quantity, B is the maturity and coupon barrier, and A is the optional early termination level. The approved template requires 0 < b < 1 and a >= 1. P0, q, n, b and a are fixed for the series.

Deposits and funding

Earn deposits N settlement tokens. Protect deposits Q underlying tokens plus premium reserve R. With m scheduled observations and gross coupon c per observation, the required reserve is R = m × N × c, computed from the sum of rounded per-lot coupon obligations. No assumed external investment return contributes to this reserve.

Protect pays premiums; it does not receive them. Earn's premiums compensate it for accepting the possibility of receiving Q tokens instead of N stablecoins. The protocol fee is a fraction of an earned premium, not an additional draw on Earn principal.

Conditional protection

When the final qualifying price is below B, Protect exchanges Q tokens for N settlement tokens. The conversion strike is P0, not B and not the final market price. The value of that exchange is reduced by premiums paid and depends on the settlement token retaining value.

A loss above the final barrier receives no protection payment. Protection stops at an early termination event. A temporary breach during the term does not create a permanent claim. Protect therefore offers a contingent contractual exchange, not a continuously protected price floor.

Capital efficiency and tradeoffs

Full prefunding eliminates margin calls within this design, provided tokens behave as specified. It also locks substantial capital on both sides. Protect needs stablecoins in addition to underlying, and Earn bears the underlying's losses below the maturity barrier. Oracle errors, contract failures, issuer restrictions and recovery events can still defeat the intended economic outcome.

Series creation

An authorized Studio creator creates a series from a registry-approved template using a fresh approved price to establish P0. A short subscription period follows. Both sides subscribe at this disclosed strike; they do not receive a later undisclosed strike. The series records a maximum activation price deviation and an activation deadline to constrain exposure to stale terms.

The series commits the chain ID, token addresses and decimals, lot amounts, coupon amount, barrier, early termination setting, schedule, oracle adapter version, fees, caps, recovery rules and permission policy in a public terms hash. Users can independently reconstruct this hash.

Subscription and activation

Deposits are integer lots. Protect must fund both components atomically. No borrowing from another participant's reserve is permitted. Subscribers may cancel before subscription closes; cancellations after that point are limited to the predefined refund paths.

Let LE and LP be fully funded lot counts on each side and LC the market cap. Matched lots equal min(LE, LP, LC). The minimum activation size must also be satisfied. Fixed lot sizes remove fractional exposure mismatches; subscription queues allocate fills in contract-recorded order. Wallet splitting and transaction ordering can influence allocation, which must be disclosed rather than described as equitable price discovery.

Activation requires a valid fresh price within the committed deviation from P0, qualified collateral transfers and sufficient reserves. If the checks cannot pass by the activation deadline, the entire series cancels and all deposited assets become refundable. A short window and deviation limit reduce, but do not eliminate, adverse selection around the fixed strike.

Partial fills and refunds

Each subscription has a queue interval. Its matched quantity is the overlap between that interval and the matched lot count. Claims compute this overlap without iterating over all wallets. Unmatched Earn principal, unmatched Protect underlying and the corresponding unused reserves become refundable immediately after activation.

The initial protocol uses fixed coupons selected through documented risk analysis and counterparty consultation. A subscription imbalance is not proof that the price is fair. Competitive quotes or a bid-based clearing mechanism require a later design with explicit willingness-to-pay limits, manipulation analysis and a separate audit. They are not part of v1.

The market has m ordered observation timestamps after activation. It uses non-memory coupons: a missed coupon does not accrue for later payment. Only qualified scheduled observations affect payouts. Intraday prices, screenshots and ordinary exchange quotes are not settlement evidence.

Order of execution

For observation i, validate its canonical price Pi. If Pi >= B, accrue the scheduled gross coupon. Apply the committed fee and credit the net amount to Earn. Then evaluate early termination for an eligible intermediate observation. At maturity, evaluate final settlement. Every observation can execute only once, in increasing order.

The early termination rows apply only when the template enables autocall. A series may disable it. Equality at B qualifies for the coupon and normal settlement; equality at A qualifies for autocall. The final observation uses the maturity rule directly.

Terminal claims

At a normal or early close, Protect also receives its unused premium reserve. At downside maturity, Protect receives N plus unused reserve; Earn receives Q plus previously accrued net premiums. Each participant claims its own balances. Settlement credits entitlements without requiring every wallet to receive a transfer in the same transaction.

Barrier discontinuity

The settlement change at B is deliberate and material. Immediately below B, Earn absorbs the full fall from P0 through underlying delivery. At B or above, Earn receives stablecoin principal. Protect can consequently receive very different outcomes for two nearby final prices. The app must show both outcomes side by side and explain why a 65% barrier does not mean a maximum 35% loss for Earn.

Let G be the sum of earned gross coupons through termination and f the premium fee fraction. Earn receives net coupons C = (1 - f) × G. Protect bears the gross cost G. All formulas below exclude gas and assume settlement tokens equal one US dollar only for illustration.

In normal or early settlement, Earn receives N + C, while Protect receives Q tokens and R - G reserve. At downside maturity, Earn receives Q tokens + C, while Protect receives N + R - G. At final price PT, Earn's illustrative profit is Q × PT + C - N in the downside case. Protect's benefit relative to simply holding Q is N - Q × PT - G.

Illustrative terms

P0 = $100; N = $10,000; Q = 100 tokens; B = $65; A = $100. Four weekly observations. Gross coupon c = 0.50% per observation; reserve R = $200; fee f = 5% of earned coupons. Each qualifying observation creates a $50 gross payment, $47.50 net to Earn and $2.50 fee. These terms are examples, not quoted returns or launch prices.

In the downside scenario, Earn loses $4,505 relative to its deposit. Protect finishes with $10,100 after committing tokens initially worth $10,000 and a $200 reserve: a $100 economic loss relative to that initial total. Against holding tokens worth $5,400 plus the original $200 cash, the protection benefit is $4,500.

For normal maturity, Earn's realized return is 1.90% over the term. Annualizing that short outcome is not an expected APY. Protect still holds tokens worth $8,000 and has paid $200; this is an example of a substantial decline that does not activate protection.

Qualified reference data

The oracle adapter must quote the deposited token in settlement-token units. If feeds quote US dollars, derive P = underlyingUSD / settlementTokenUSD using qualified, temporally aligned observations. A missing settlement-token feed is not permission to silently assume a permanent dollar peg. Feed addresses, decimal scaling, heartbeat limits and timestamp policies are committed in the template. [2]

The initial observation rule selects the latest complete qualified round at or before each scheduled timestamp, within the committed maximum age. The adapter must verify the round and the first subsequent round to prove the submitted price is canonical; users cannot choose whichever historical round creates a better payout. The subsequent round must be available by the committed submission deadline. Proxy phase changes and missing history need explicit adapter support.

This is a scheduled feed snapshot, not necessarily an official exchange closing price. A stock product marketed around an official close requires a source that attests that close and a separately verified market calendar. A generic latest price call does not establish an official close.

Reject nonpositive values, incomplete rounds, future timestamps, stale observations, incompatible sources, relevant token oracle pauses and sequencer outages or recovery grace periods. Historical validation must establish source validity at the observation time, not merely at claim time. If this evidence cannot be obtained, the asset cannot be admitted to v1.

Missing data and exceptional unwind

Each timestamp has a hard submission deadline. Before that deadline, a missing canonical observation suspends advancement and later observations cannot execute. Once the deadline passes, anyone may invoke the precommitted exceptional unwind; overdue observations are no longer accepted. This prevents choosing between historical settlement and recovery after both are known.

Exceptional unwind returns Earn's unexchanged principal, Protect's underlying and remaining reserve, and preserves coupons and fees already validly accrued. It cancels all future coupons and the contingent protection exchange. It does not approximate a missing price or refund prior premiums. Protect can remain exposed to severe losses under this fallback; fault-triggered unwind is a material limitation, not equivalent protection.

Transfer freezes can prevent even an entitled refund from being paid. Such balances remain claimable; no administrator may replace a failed transfer with invented collateral. Deadline behavior during chain outages and the evidence needed for historical rounds must be tested before launch.

Each series holds its own underlying, Earn principal and Protect reserves. Collateral remains idle except for authorized coupon claims, refunds, fees and terminal distributions. There is no rehypothecation, bridge movement or treasury borrowing from active markets.

Positions and claims

V1 records account positions directly in each market. It does not issue freely transferable position tokens. Accrued coupons use a cumulative amount per matched lot and each subscription's claimed checkpoint. Settlement and refund entitlements are similarly calculated by lot count. These rules avoid unbounded user loops and ambiguity about who owns coupons after transfers.

A later transferable implementation must separately specify record dates, accrued coupon ownership, fractional rounding and eligibility controls. Transferability would not guarantee a buyer or an early exit at principal value.

Accounting invariants

For each series, actual settlement-token balance must be at least the sum of locked Earn principal, unspent Protect reserves, accrued unclaimed coupons, refunds, terminal cash claims and unwithdrawn earned fees. Actual underlying balance must cover locked underlying, refunds and terminal token claims. Each asset belongs to exactly one accounting bucket at any instant.

Balance inequalities allow unsolicited token donations; donations create no participant rights and do not increase payout obligations. Conservation tests also track every legitimate deposit and withdrawal. Rounded per-lot coupons are fixed before deposit, reserve funding covers every scheduled coupon, and fee rounding is downward with the remainder allocated to Earn.

Use checked full precision arithmetic, validated decimal conversions and safe token transfers. Reject transfer-tax, rebasing and unexpected balance behavior at onboarding. No rescue function may sweep assets needed for any outstanding claim. Auditors must confirm isolation at the actual contract level, including permissions and external calls.

User journey

Connect a supported wallet, confirm the network and complete any required eligibility checks. Select Earn or Protect and inspect the terms and payoff simulator. Approve the exact required assets, deposit lots and monitor subscription status. After activation, the portfolio shows locked assets, next observations, accrued coupons and any claimable refunds. On closure, the user claims the asset specified by the recorded outcome. Vault depositors instead hold epoch shares and redeem through the vault after its markets close. Studio creators preview and submit template-bounded terms; subscriptions still determine activation.

Every market screen shows its source token, quote token, strike, barrier, autocall setting, gross and net coupon, maximum premium cost, expiry, price source, observation deadlines and exceptional unwind policy. It displays the exact received asset in each scenario. A Protect screen must state that ordinary losses above the final barrier remain unprotected.

Backend requirements

Profi needs operating infrastructure even though custody and settlement are onchain. Production services include reliable RPC connections with failover, an event indexer, a read database, keepers, monitoring, notifications and an incident response process. Where required, eligibility services maintain compliance records separately from public wallet data.

The database improves search and portfolio performance; it is not the authority for balances. Rebuild it from chain events and state. Protect against reorgs, duplicate event ingestion and stale caches. Label stale displays and disable deposit flows when the app cannot reliably read committed terms.

Keepers submit transactions; contracts do not run on a schedule by themselves. Independent operators should execute observations, and users must be able to execute valid calls directly. Use a separately funded operating wallet for gas. V1 keeper expenses are paid from the operating budget, not silently deducted from user reserves.

Monitoring and incident response

Track approaching observation deadlines, invalid data, feed changes, sequencer health, escrow coverage, failed transfers and unusual privileged calls. Notify users of a suspended market before its recovery deadline where possible. Publish an incident timeline and affected balances after a material failure. A frontend outage does not authorize staff to settle by spreadsheet.

Integrations

Publish contract ABIs, verified addresses, terms hashes and event definitions. Suggested events include MarketCreated, Subscribed, SubscriptionCancelled, Activated, CouponAccrued, Settled, RecoveryFinalized and Claimed. A transaction simulator verifies amounts before signing. Only deployed and verified features may be shown as available; demonstration balances must be explicitly labeled.

Proposed initial fee policy

The proposed v1 fee is 5% of a successfully earned gross coupon. There is no initial deposit fee, principal fee or exceptional unwind fee. Gas is paid separately by transaction submitters. The per-series fee is immutable after creation and visible before subscription. This percentage is a proposed commercial setting and must be validated against user demand and operating costs before launch.

Example: a $50 earned gross coupon creates $47.50 for Earn and $2.50 protocol revenue. Protect's total cost is $50, already funded in its reserve. No qualifying coupon means no premium fee for that observation. Normal and downside settlement do not create a new fee merely for returning or exchanging principal.

Source of revenue

Revenue comes from executed premium transactions between paying protection demand and risk-bearing capital. PROFI trading may generate separately accounted creator receipts under its launch settings. These receipts are not Earn or Protect premium revenue. Total value locked is not revenue, and coupon volume is not net protocol profit.

With $1 million matched notional, four earned coupons at 0.50% each and a 5% fee, one illustrative full-term cycle produces $20,000 gross premium and $1,000 fee revenue before expenses. Early termination or skipped coupons reduces that amount. At those terms, a team needs recurring volume or separate runway to cover engineering, audits, legal work and operations.

Treasury policy

Earned fees move to a disclosed treasury, separate from escrow. Proposed priorities are security, operations and product maintenance. Publish treasury balances, spending reports and any approved liquidity exposures. Treasury assets are not a redemption reserve for PROFI and cannot be advertised as a token price floor.

Receipts from the additional 3% creator tax fund a separate Profi buyback-and-burn program. Standard creator-fee receipts are accounted for separately. Development requires independent runway and available product-fee revenue. Pons built-in buybacks remain disabled under this policy. User collateral cannot fund purchases, and burns do not guarantee appreciation.

Commercial validation

Before raising caps, measure repeat participation on both sides, fill ratios, net premium volume, actual fee income, keeper costs, acquisition costs and refund rates. Subsidized demand should be reported separately. A functioning protocol needs both willing protection buyers and counterparties; a popular token alone does not validate the market.

PROFI is a proposed ecosystem token distinct from market principal, premium reserves and underlying collateral. Core Earn and Protect settlement must continue without a PROFI price feed or token incentive distribution. Holding PROFI does not create rights to user assets, principal redemption or treasury income.

Intended utility

The first intended use is governance signaling on future market templates, protocol budgets and approved incentive programs. Binding execution remains with documented administrative roles until a separate governance contract and security process are implemented. Subsequent governance must preserve the immutability of active market agreements.

Fee discounts and Studio access require separately implemented utility. V1 excludes token staking, automatic revenue distributions, rebasing rewards and a guaranteed reserve floor.

Supply and launch distribution

PROFI is planned to launch through Pons v2 and graduate into Uniswap v4. Target fixed supply is 1,000,000,000 tokens, subject to the selected configuration. No additional minting is planned. The full initial supply enters the curve; reserved tokens and collected quote assets fund graduation liquidity. The resulting full-range position is permanently locked. [6, 7]

Profi has no separate preminted allocation for the team, treasury, community or strategic partners. Future rewards require acquired tokens and a funded distribution budget. Any team or treasury purchase must disclose the wallet, funding source, quantity and terms; opening purchases and applicable tax exemptions must also be disclosed. A paid opening purchase is not a premint, but it can create concentration and timing advantages.

Circulation reporting must distinguish user-held tokens from reserved liquidity and locked inventory. Publish actual launch balances; the full supply is not sold to the public.

Proposed launch settings

The proposed launch sets an additional 3% creator tax, with all receipts from that tax allocated to Profi buybacks and burns. Pons built-in buybacks remain disabled; base trading fees still apply. Direct creator receipts to a disclosed multisig or verified execution contract, separating tax receipts from the standard creator-fee share. Prefer an approved stablecoin quote asset; otherwise use native ETH. Confirm the configuration before launch. The quote choice does not change Earn or Protect settlement.

Pons snapshots launch economics. Fees are quote-denominated and its shared hook governs graduated trading. Optional buybacks lock tokens for five-year release rather than burning them, with creator and protocol entitlements. The holder keeps the same token at graduation. [6, 7]

Revenue and operating budget

Keep creator receipts separate from Profi premium fees. Deduct launch-mechanism charges before recognizing amounts available to the treasury. Report receipts in their actual asset and disclose conversion costs. Budget engineering, audits, legal work, keepers and monitoring from committed runway; uncertain token volume is supplemental funding.

Community grants and rewards use actual acquired inventory, with wallet reporting and program limits. Any contributor compensation in PROFI needs an individual vesting agreement and funded token inventory. The removal of premints does not create a promise that the team can obtain tokens later at an affordable price.

Buyback and burn execution

Claim and reconcile the 3% tax receipts, then purchase PROFI periodically with minimum output and price-impact limits. Burn purchased tokens through a verified supply-reducing function. Verify support in the deployed token before activating this process; sending tokens to an inaccessible address must not be reported as a reduction of total supply.

Publish receipts, costs, purchases, burned amounts and transaction records. Unspent tax receipts remain earmarked when liquidity or execution limits prevent a purchase. Disclose gas and other execution costs separately. The program needs funded operation and monitoring; describe it as automatic only after verified deployment. It creates no guaranteed price floor or holder redemption right.

Deployment requirements

Before signing, publish the exact factory version, supply, quote asset, graduation reserve, thresholds, base fee, creator tax, buyback setting, recipients and opening purchases. Read current configuration and pin expected economics. Check launch permission, quote approval and security review status. Graduation liquidity belongs to trading infrastructure and must never be budgeted as development cash or market collateral.

The whitepaper does not establish these settings as deployed facts. A launch announcement must link the verified token and resulting pool and distinguish token trading from the operational status of Earn and Protect.

Initial administration

Use a proposed 3-of-5 multisignature with independent signers for template approval, operating budgets and future market configuration. Critical actions use a proposed 72 hour timelock. Publish signer roles, thresholds, timelock addresses and privileges before real deposits. These settings are implementation requirements to validate, not existing controls.

A narrowly scoped guardian can halt new subscriptions and activations immediately. It cannot replace historical observations, change a strike, seize principal or rewrite a terminal outcome. V1 pause authority must not block correctly accrued claims, objectively valid observation processing or deadline-driven recovery. Publish limitations: this restricted pause cannot stop every exploit in a flawed contract.

Versioning and upgrades

Prefer immutable per-series escrows and immutable versioned oracle adapters. Fixes apply to newly created series through a new approved version. Active series retain their committed terms, permissions and recovery rules. A proxy that silently upgrades an active payout engine would undermine this promise and is excluded from the initial design.

The registry may disable creation through a defective version. It cannot migrate existing collateral without participant authorization or a previously disclosed recovery mechanism. External token and oracle upgrades remain dependencies outside Profi's control; monitoring and asset admission must account for them.

Parameters for future markets

Governance may alter future asset lists, market caps, coupons, observation policies, eligibility requirements, fee schedules and incentive budgets within published bounds. It may not retroactively improve one side's payoff at the expense of the other.

Treasury exposure

If the treasury later participates in Earn or Protect, show its wallet and obligations like any other counterparty. Cap exposure by underlying, tenor and aggregate amount. Participation must come from treasury-owned assets with no privileged fills or preferential settlement. Public Earn allocation vaults are separate from treasury liquidity activity and follow the epoch accounting and withdrawal design in Vaults Studio and market development.

Governance maturity

Move to binding token governance only after publishing proposal rules, quorum, delegation, timelock execution and manipulation safeguards. Token ownership can concentrate control; a vote does not replace security review or the duties of an operating entity. Voting power never grants access to balances owed to market participants.

Security requirements

Build a reference payoff model independent of the Solidity implementation. Compare every transition against it. Unit and integration suites cover partial fills, refunds, coupons, early termination, maturity, deadline races and claims. Stateful fuzzing tests arbitrary user actions, repeated calls, rounding, extreme prices and external token failures.

Required invariants include asset coverage, reserve isolation, matched lot conservation, single observation execution, settlement finality and no unauthorized outflow. Test canonical historical price selection across oracle phases, token and feed decimals, sequencer recovery and stale-data conditions. Simulate malicious tokens, reentrancy, role compromise and frontend loss. Test vault share conservation, deposit cutoff races, allocation limits, cash and in-kind redemption, valuation failures and inventory conversion. Test Studio parameter bounds, creator eligibility and rejection of unsupported templates.

Before mainnet activation, obtain an independent audit of the exact deployment version, remediate material findings and publish the report and contract verification. Fund a bug bounty and incident readiness. No audit or formal verification is represented as complete in this document.

Material risks

Earn can lose almost all principal if delivered tokens become nearly worthless. Protect pays premiums even when protection never triggers, retains ordinary downside above the final barrier and loses future coverage at early termination or exceptional unwind. Neither side has a v1 early exit from matched positions. Vault shares remain exposed to the same losses, and queued redemption does not unlock active market collateral. Studio creation does not imply adequate subscriptions or a fair premium rate.

Incorrect oracle data can produce an economically wrong but fully funded settlement. Missing data can terminate protection. Market price and oracle price may differ, especially near a barrier. The settlement token can depeg or be frozen; protection denominated in it may lose real purchasing power.

The underlying issuer can freeze transfers, alter terms or become insolvent. Network, bridge, sequencer and wallet failures may impede deposits or claims. Bugs, privileged-key compromise or integration mistakes can lead to total losses despite prefunding. The barrier creates a discontinuous payoff that can magnify the effect of a small final price difference.

Token and governance risk

PROFI may be illiquid and can lose all market value. Buyback vesting releases, acquired team holdings and concentrated ownership may affect trading and voting. Incentives can attract participants who leave when rewards end. Treasury losses do not become a right to recover from user escrow.

Profi must present these risks alongside its benefits. Fully collateralized describes contractual funding; it does not mean risk free, legally insured or protected against every failure.

Profi should release working markets before adding complex token mechanisms. Milestones are acceptance gates, not guaranteed launch dates. Funding, engineering and external reviews determine the schedule.

Phase one Specification and feasibility

Finalize the economic reference model, lot sizes, observation timing, recovery policy, vault epoch accounting, Studio permissions and deployment architecture. Select the operating entity and intended eligible market. Verify token behavior, actual contract addresses, price histories, settlement-token quoting and transfer eligibility. Obtain qualified legal analysis of the structured product and token plans. Exit when each admitted asset can support the committed payoff and oracle rules.

Phase two Working testnet product

Deploy Factory, Escrow, AccountPositions, OracleAdapter, StudioGuard and EpochVault with clear fixture labels where needed. Deliver all four product interfaces. Demonstrate Studio creation, direct subscriptions, vault allocation, unmatched refunds, observations, claims and vault redemption. Run complete normal, early close, downside and recovery cycles. Exit when the reference model and contracts agree and accounting invariants hold under adversarial tests.

Phase three Independent review and operational readiness

Audit the core engine, vault accounting and Studio permissions together; remediate material findings; verify the exact release source and bytecode. Rehearse failed observations, keeper outages and token freezes. Fund gas wallets and monitor deadlines. Complete the product terms, privacy policy and required eligibility controls. Exit when deployment, incident response and legal gates are satisfied.

Phase four Capped real capital pilot

Proposed limits: $10,000 matched principal per market and $50,000 aggregate matched principal, including vault-funded positions, with one underlying and one quote token. Launch one capped vault strategy and controlled Studio access alongside Earn and Protect. Cap each vault epoch deposit total at $10,000; enforce aggregate market exposure without counting the same vault capital twice. These caps limit exposure, not loss severity, and may be reduced following review. No automatic increase is permitted. Monitor the first settled series and distinguish real user demand from sponsored participation.

Phase five Controlled expansion

Require at least ten successfully completed pilot series, no unresolved material accounting or security incident, independently checked reconciliation and evidence of repeat demand on both sides. Only then assess higher caps and a second underlying. Passing ten series is necessary under this policy, not proof of safety.

Phase six Product expansion

Expand vault strategies and Studio creator access only after evidence from the initial four-product pilot. Competitive rate discovery and transferable positions require separate reviews. A PROFI issuance may proceed independently only with clear disclosures; it must not be presented as proof that the financial products are operational.

Vaults and Studio are part of the initial platform, not deferred products. Both use the same approved market engine and inherit its collateral, price and eligibility requirements.

Profi Vaults

Profi Vaults pool settlement tokens and allocate them to approved Earn positions. Depositors receive shares representing proportional exposure to a specific vault epoch. Returns are variable and losses from underlying delivery pass through to shareholders. Vault capital does not guarantee the obligations of unrelated markets.

Initial epoch model

The first vault uses closed cohorts. Each epoch has a deposit window, allocation deadline, approved strategy and latest permitted market maturity. Accept only settlement-token deposits and mint epoch shares against the amount actually received at a disclosed initial one-to-one unit rate. Shares are account-based and nontransferable initially. Users may cancel and burn shares before the deposit window closes.

After the cutoff, no new deposits or share issuance enter that epoch. Assets remain locked until its positions settle or follow their recovery rules. A later deposit window opens a separate epoch with isolated accounting; it does not dilute an active cohort. Accrued coupons remain in the same epoch and are not automatically rolled into longer markets.

Allocation and permissions

Publish permitted assets, templates, maximum per-market allocation, total capital cap, cash buffer and maturity limits before subscriptions. A permissioned allocator selects only eligible Earn markets within those bounds. It cannot change the epoch mandate, transfer funds to arbitrary addresses or subscribe on the Protect side. Market activation still requires funded Protect counterparties.

Unused or unmatched allocation returns to the same epoch. If no qualifying allocation occurs by the deadline, close the epoch and make all remaining cash redeemable. Treasury funds and other epochs cannot absorb losses silently. The first vault imposes no additional management or performance fee; underlying market premium fees still apply. Any future vault fee applies only to newly opened epochs and must be disclosed before deposits.

Valuation and withdrawals

Track idle cash, locked market positions, accrued claims and delivered underlying inventory separately. Do not value a risk-bearing Earn position automatically at its original principal. Portfolio displays may use a disclosed model for indicative NAV, with assumptions and timestamps. The app must mark unavailable or stale estimates; these estimates do not authorize new subscriptions into an active epoch or promise a cash redemption value.

Redemptions become claimable after all epoch markets finalize and claims are collected. Share balances determine proportional entitlement to the remaining assets. Queuing a withdrawal does not accelerate settlement. Do not advertise instant or principal-guaranteed withdrawals.

For underlying delivered after a downside outcome, the initial policy permits bounded conversion to the settlement token during a committed conversion window. Enforce approved routes, minimum output, maximum trade size, price-impact limits and a conversion deadline. Costs and realized proceeds belong to the affected epoch. If conversion cannot complete, distribute remaining inventory and cash pro rata in kind rather than indefinitely forcing a sale. Asset restrictions may still block transfers; unpaid entitlements remain recorded.

Only a depositor eligible to receive every permitted terminal asset may enter the vault. Publish cash and in-kind redemption possibilities before deposit. Final settlement accounting, rather than an indicative NAV, determines actual redemption proceeds. Proportional claims use deterministic rounding and per-share accounting without unbounded wallet loops.

Contract and integration requirements

Implement VaultFactory, epoch share accounting, allocation policy enforcement, market adapters, conversion controls and redemption claims. Invariants cover asset conservation, no cross-epoch subsidy, no unauthorized allocation, no double redemption and consistent cost attribution. Allow administrative pauses of new subscriptions and allocations without rewriting matured entitlements.

Do not claim ERC-4626 compliance for the account-based epoch implementation. ERC-4626 describes a standardized tokenized single-asset vault interface; any later adapter must satisfy the standard and explicitly address locked assets and asynchronous withdrawals. [5]

Profi Studio

Studio is a market creation interface backed by approved templates and onchain validation. Initial access is limited to authorized creators. It is not an unrestricted contract editor or a mechanism to deploy arbitrary payout logic.

Creators select a supported underlying and quote token, lot size, coupon, barrier, tenor, observation schedule, optional autocall and subscription cap within the template's allowed bounds. Studio displays required collateral, maximum Protect premium cost, Earn net premiums, all settlement outcomes and the missing-data fallback before creation.

StudioGuard checks creator eligibility, token and oracle approval, parameter ranges, schedule validity, fee policy and market caps. Oracle rules and exceptional recovery cannot be bypassed through user input. The factory commits the validated terms hash and emits an auditable creation event. Users can compare these terms with the transaction preview and onchain record.

Market creation neither guarantees a fill nor starts financial exposure. Both sides must subscribe, matching must succeed and all activation checks must pass. Unmatched deposits and unsuccessful launches follow the core refund rules. Creators cannot revise terms after subscriptions open, extract collateral or alter payout outcomes. To change terms, cancel the unactivated series under its committed cancellation policy and create a new series.

The initial Studio has no additional creation fee beyond network gas. Any later fee requires explicit funding and accounting rules for new markets. Creating a market confers no privileged fill or automatic share of participant premiums.

Distribution and liquidity development

Validate demand through eligible pilot participants and disclosed counterparties. Publish outcomes including missed coupons, downside deliveries, vault redemption delays and in-kind distributions. Distributors must explain the product terms and meet applicable obligations; coupon rates are not guaranteed yields.

Track repeat participation, matched principal, realized fee income, settlement reliability, vault redemption outcomes and Studio market fill ratios. Separate treasury fills, incentive-driven deposits and unaffiliated demand. Report vault assets and their underlying market exposure without counting the same capital twice.

Long term scope

Competitive coupon discovery, transferable positions, additional assets, more vault mandates and broader Studio access are possible extensions. Each requires its own specification and review. Cross-chain markets and lending against positions remain outside the initial roadmap.

Profi's initial legal feasibility must be evaluated for the actual operating entity, distribution model, target users and payoff. The agreement transfers price risk and may receive derivatives, structured product or other regulated treatment. A blockchain deployment does not itself authorize distribution. Qualified counsel must determine licensing, disclosure, onboarding and marketing requirements before capital activation.

Stock token considerations

Robinhood describes its Stock Tokens as tokenized debt securities providing economic exposure rather than ownership rights in the referenced shares. Its documentation sets restrictions for US persons and additional jurisdictions. An Earn recipient must be eligible to receive the underlying on downside settlement, not just eligible to deposit a stablecoin. [1]

The relevant token feed reflects per-token value, including its corporate action multiplier. Profi must compare the same economic unit at strike and observation; applying the multiplier twice would misprice the agreement. Validate pause behavior, issuer controls and entitlement changes before admission. Any cash entitlement not incorporated into token value requires an explicit allocation rule or asset exclusion. [2]

Access controls

Before launch, determine whether the supported asset and legal model require enforced address eligibility. If so, both positions, claims and any later transfers must use a verified policy module. Interface geoblocking alone may be insufficient. Status changes while capital is locked need a lawful, documented claims process that does not confiscate balances or bypass token restrictions.

V1 positions are nontransferable partly to reduce uncontrolled redistribution. This does not solve all compliance duties. Public statements must distinguish the proposed protocol, a testnet demonstration, an operational token and audited real capital markets.

Disclosure and user understanding

Publish product terms, contract addresses, administrative controls, fees, model assumptions, recovery conditions and asset-specific restrictions. Explain that protection is conditional and stablecoin denominated. Avoid presenting token holdings as equity in an operating company or a right to fee revenue unless a separately authorized structure explicitly provides those rights.

This whitepaper is a protocol design document, not an offer of securities or a token sale agreement. Digital assets and these agreements can result in partial or total loss. No section promises returns, token appreciation, continuously available liquidity or protection under every technical or market event.

Public technical references

1. Robinhood Chain, Stock Tokens
2. Robinhood Chain, Oracles and Price Feeds
3. Robinhood Chain, About Robinhood Chain
4. Robinhood Chain, Connecting to Robinhood Chain
5. Ethereum Improvement Proposals, ERC-4626 Tokenized Vaults
6. Pons, v2 documentation
7. Pons Labs, Launchpad contracts repository

Robinhood's documentation identifies an EVM-compatible network and lists chain IDs 4663 for mainnet and 46630 for testnet. Profi must independently verify current deployment settings before use. [3, 4]

Required evidence before public activation

Publish the versioned economic specification, vault epoch rules, Studio parameter bounds, deployed addresses, verified source, audit and remediation record, invariant test results, token and feed qualification records, admin permissions, eligibility terms and funded operating plan. The website must provide these records alongside the market terms. Only then can a market be described as available for real capital.

Profi's intended outcome is a usable market whose deposits, premiums, risks and settlement assets can be checked before entry and reconciled after exit.