A reserve, and the contract says so
This vault accumulates WETH against a Robinhood Chain validator bond that we are not currently permitted to post. Until the allowlist opens, deposits sit idle, one share is worth one deposit unit, and nothing is earned. That is not a phase we are describing in a blog post — it is the mode the contract is in, and it is enforced by code rather than by a disclaimer.
The Bond Vault is not deployed. There is no address, no share supply and no total assets, so this page shows none of those things. A vault page carrying a plausible TVL number before the contract exists is the exact failure this project was built to make visible.
What changes the day it activates
The two-mode design exists so that the difference between a reserve and a staking product is a state variable a depositor can read, rather than a sentence in our documentation that we could quietly rewrite.
| Reserve — today | Active — not yet reached | |
|---|---|---|
| mode() | Mode.Reserve — current | Mode.Active — never entered |
| where the assets are | Idle in the vault. deployedAssets is zero. | Some or all out with the bond operator. |
| totalAssets() | Exactly the WETH this contract holds. | Idle balance plus deployedAssets. |
| share price | Pinned 1:1. sharePriceRay cannot move. | Moves with reported income and reported loss. |
| withdrawals | Unconstrained. Every share is redeemable now. | Limited to the idle buffer. |
| maxWithdraw() | Your full share value. | min(your share value, idleAssets) — surfaced honestly. |
| yield | None generated. None reported. None promised. | Real, and reported by the operator via reportIncome. |
| slashing risk | None. There is no bond at risk. | Real. A slashed bond is booked through reportLoss. |
In Active mode the deployed portion is genuinely not withdrawable until the operator returns it. ERC-4626 requires maxWithdraw to report what can actually be withdrawn right now, so the vault takes the minimum of your share value and the idle buffer.
Reporting the full share value instead would make the standard’s most-quoted view function a lie, and would break every integrator that trusts it. The number being smaller than a depositor hoped is the point: the constraint is real, and the interface is where it should show up.
reportLoss(amount) reduces deployedAssets and emits LossReported. It is callable only by the operator and cannot exceed the deployed principal.
Losses must be booked explicitly because the alternative is worse than the loss. If a bond is slashed and nobody writes it down, totalAssets keeps counting capital that no longer exists, the share price stays high, and the next depositor buys shares backed by nothing — paying full price for the previous depositors’ hole. An unbooked loss is not a smaller loss; it is a loss that has been transferred to whoever arrives next.
Six gates, and the first one is not ours to open
Activation is not a switch we can flip. It requires an explicit proposal, a timelock and an auditPassed flag — and none of that matters while the chain itself will not accept another validator.
- 01blocked
Robinhood Chain opens the validator allowlist
Outside our control entirely. Until this happens there is no bond for the vault to post, so activation would be theatre. This step has no date and we will not invent one.
- 02blocked
Audit report published, then setAuditPassed(true)
The deployment script itself refuses to run without VERD_BONDVAULT_AUDITED=1, and the revert string is the commitment: "BondVault holds depositor WETH and does not ship unaudited."
- 03blocked
Seed deposit against the inflation attack
The vault carries a 6-decimal virtual-share offset, which raises the cost of moving the share price by a factor of a million. A real first deposit is still in the runbook; the offset is the belt that does not depend on remembering it.
- 04blocked
proposeActivation(operator) filed on-chain
Reverts with AuditRequired if the audit flag is false, and with AlreadyActive if the vault is already live. Emits ActivationProposed with the eta.
- 05blocked
Timelock elapses
timelockDelay defaults to 7 days and is bounded at MIN_TIMELOCK 2 days and MAX_TIMELOCK 30 days. cancelActivation() is available for the whole window, to us and to nobody else.
- 06blocked
executeActivation()
Re-checks auditPassed and the eta at execution time, not just at proposal time. Only then does mode() change.
validatorWhitelistDisabled() returns false on the rollup, so the challenge manager rejects every caller outside the allowlist. 2 addresses may propose or challenge state roots, of which 1 is active. We cannot stake, cannot post a rival assertion and cannot open a challenge.
Whether that changes is Robinhood’s decision and not ours, so we have no schedule to publish and will not manufacture one. Every roadmap date we could put here would be a guess about someone else’s governance dressed up as a commitment. The full list of what we cannot do →
| Read from the rollup on Ethereum | Value |
|---|---|
| rollup | 0x23A19d23e8…e4272D94 |
| stakeToken | 0xC02aaA39b2…3C756Cc2 |
| validatorWhitelistDisabled() | false |
| confirmPeriodBlocks | 45,818 |
| challenge window | 6.36days |
A reserve is not a yield product, and we will not label it as one.
The honest description of the Bond Vault today is a WETH deposit that returns exactly what you put in, minus nothing and plus nothing, redeemable whenever you like. Nobody should deposit into it expecting a return, and the contract is structured so that we cannot generate one by accident: in Reserve mode deployedAssets is zero, so sharePriceRay is arithmetically pinned to 1e18.
What it is for: being ready. If the allowlist opens, the capital to post a bond has to already exist, already be audited and already be governed — assembling it afterwards takes months, and the window to become a useful validator is not months wide. VERD holders vote on activation, and the vault holds WETH rather than VERD because a bond has to be denominated in something the protocol already values.