Security & Risk
Trust model
What the contracts guarantee, mechanically, and the exact list of what remains.
BasketToken is a single-contract, non-upgradeable, in-kind mint/redeem
vault. The design goal is an attack surface as close to zero as possible,
with radical explicitness about what remains.
What the contract guarantees
| Property | Mechanism |
|---|---|
| Full backing | Mint pulls ceil(amount × units / 1e18) per constituent and verifies the actual balance delta; redeem pays floor(...). All rounding favors the vault. Proven by the invariant suite. |
| Redeem can never be blocked by the protocol | redeem has no pause, no cap, no guardian gate; verified by a dedicated test that redeems while minting is paused and the cap is below supply. |
| No admin control over funds | The guardian can only pause minting, move the supply cap (≤ immutable ceiling) and change the fee recipient. There is no withdraw, sweep, upgrade, delegatecall or selfdestruct path. |
| Reentrancy safety | nonReentrant on mint/redeem; attack mocks cover all four re-entry combinations. |
| Non-standard token rejection | The balance-delta check rejects fee-on-transfer / lying constituents at mint time. |
What you still have to trust
Being honest about the residual list is the point:
- The issuer of the constituents (stock baskets): the dominant risk, detailed in Risks.
- Unaudited code: small (~160 nSLOC core) and heavily tested, but no professional audit yet. Deposit caps are the mitigation; Phase 3 of the roadmap requires a published audit.
- The chain: a single Robinhood-operated sequencer (standard Orbit trust assumptions; finality is hard only on Ethereum).
- The guardian Safe for its three bounded powers: the worst a compromised guardian can do is pause new mints, lower/raise the cap within the ceiling, and redirect future fees. It cannot touch the vault or your redemption.
Platform contracts
The curator platform (not yet live, being finalized around the burn-to-publish model) wraps the unchanged core with the same principles:
- No privileged function anywhere in the platform after deployment.
- Curated baskets get
guardian = protocol Safe: curators hold no power over their baskets or their holders' funds. - Publishing burns $VIM; no privileged party collects anything.
Test posture: 100% line/statement/branch/function coverage across all contracts in the repository (107 tests), plus fuzz suites bounding rounding, invariant suites for backing, and mainnet-fork suites against the real Stock Token contracts and live Uniswap v4 pools. See Audits & analysis.