Docs

01What a container is

A container is one ERC-20 share token and one vault that holds its cargo. The manifest is the list of what is inside and at what weight. A shipper composes it; anyone can buy it; whoever holds it can redeem it for the cargo underneath. Containur is the factory and the yard — it never holds anyone's assets and there is no admin key that can move them.

02Yard, customs, shipped

In the yard. Contributions buy container tokens along a bonding curve, so early buyers get a better price. The USDC sits in escrow and no cargo is bought yet. Exit at any time for the lesser of the curve price and what you paid — nobody profits out of escrow before the vault holds anything, which is what makes the refund promise below true rather than aspirational.

Clearing customs. At $25,000 of escrow, in one batched transaction during market hours: 85% of the net buys the manifest at target weights with a per-leg slippage cap that reverts rather than fills badly, 15% seeds a Uniswap pool against USDC, and the vault goes live. The pool position is owned by the container and locked forever; only its fees are claimable.

Shipped. Mint and redeem are permissionless and priced off NAV. Arbitrage between the pool and the mint/redeem path keeps the market price near NAV.

If it never clears customs, escrow unlocks after 7 days and every contributor withdraws 100% of their USDC. Not 95%. No fee, no deadline on claiming it, and no key that can stop it.

03NAV, premium and drift

NAV per token = ( Σ balance_i × price_i × uiMultiplier_i + USDC ) ÷ ( totalSupply − vault-owned supply )

Prices come from the per-asset Chainlink feed on Robinhood Chain, checked against its heartbeat; cargo with no feed is priced by a 30-minute Uniswap TWAP, never spot. Multipliers come from ERC-8056, read from the token on every call. Nothing anywhere falls back to a multiplier of 1.0 — a container holding a freshly split asset would be mispriced by exactly the split ratio, so an unreadable multiplier reverts on chain and renders as a dash here.

Every container page shows the premium or discount to NAV, which real ETFs disclose daily and no crypto product does. It also shows drift: the weights today beside the weights at ship time. V1 never rebalances, because that is what an index does between reconstitutions, and because a rebalance is the exact operation a malicious shipper would want.

04Fees and freight

The streaming fee accrues continuously by minting tokens to the shipper — about 1.37 bps of dilution per day — and is claimable at any time. It is the reason freight is a stream rather than a launch-day pop, and the reason a shipper is still promoting a container six months later.

05The allowlist

• Robinhood Stock Tokens are always eligible.
• Other tokens need at least $250,000 of USDC-pair depth. Age is reported, not gated: cargo that first traded under 14 days ago is flagged as a new listing and can still ship.
• No single non-stock token above 30% of a manifest.
• No more than 40% of any manifest in non-stock cargo. Containur is an equities product with degen exposure attached, not the reverse.
• A token deployed by the shipper's own address is ineligible, full stop.
• Two to twelve cargo lines. No fee-on-transfer, rebasing or blacklisting tokens.

These are contract rules, not frontend preferences, and they are re-checked at customs and at every unsealed rebalance. The composer shows them live while you build, naming the rule and the fix.

06Sealed and unsealed

Sealed is the default: the manifest is immutable forever. Nobody can change it, including us, because there is no key that could.

Unsealed lets the shipper propose a change, subject to a 48-hour timelock, full allowlist revalidation at execution, a maximum of 20 percentage points of change per constituent per 30 days, and a banner on the container page from the moment it is proposed. Redemption stays open the entire time. The timelock is the rule; the open exit is the actual protection.

07Market hours

Stock tokens trade 24/7 and the equities behind them do not, so spreads widen when the underlying market is shut. Clearing customs is restricted to US market hours because it is the largest single trade a container will ever make. Mint and redeem stay open, with a live spread estimate and a slippage cap that reverts rather than fills badly.

08$CTNR

An access token: a lower protocol fee tier, priority for featured slots in the yard, unsealed-container privileges, composer features. No revenue share, no buyback, no yield, no value accrual. There is no token sale, no presale and no allocation page.

09Risk

Robinhood Stock Tokens are tokenized debt securities issued by Robinhood Assets (Jersey) Limited. They give economic exposure to a share price. They are not shares: no ownership, no voting rights, no claim on the underlying stock.

A container can lose value quickly. Backtests are historical simulations of a manifest — buy and hold, no fees, no spread, no slippage — and past performance is not a forecast. Containur gives no advice, manages nothing, holds nothing, and never ranks or recommends a container.

The full specification, including the graduation state machine and every value extraction attack we could find with the constraint that stops it, is in MECHANISM.md in the repository. Back to the composer.