Tilt

⚠️ Unaudited. This is a real, live MVP on Robinhood Chain mainnet, not a finished, audited product. Use, fork, or deploy at your own risk; do your own review before trusting it with real funds.

An ERC-4626 index vault on Robinhood Chain, holding a basket of tokenized Robinhood stocks priced against a USDG numeraire. Deposits/withdrawals mint and burn a single fungible share token — a standard ERC-20, so anything that can pair against USDG or ETH can pair against it the same way. Rallo (a Doppler-based launchpad) is the first real integration that does this, pairing new token launches against the share token as numeraire — but Tilt itself has no dependency on Rallo, Doppler, or any specific launchpad; it's launchpad-agnostic infrastructure that happens to have one real, live integrator so far, not an exclusive pairing.

Built with Foundry.

Contracts

src/ is split into v1/ (frozen — the original, currently-deployed version, kept unchanged as a reference and for any instance still running against it) and v2/ (active development — permissionless-rebalance option, fast bootstrap seeding, TWAP oracle fallback on top of the same core design). Both share the same overall shape:

• IndexVault.sol — the core ERC-4626 vault. Tracks basket composition, rebalancing, performance/swing fees, and a permanent write-off/emergency-redemption path for a basket asset that becomes unpriceable or delisted.
• PriceOracleAdapter.sol — governed per-asset Chainlink price registry (with L2 sequencer-uptime gating, and in v2, a Uniswap v3 TWAP fallback) that IndexVault reads from.
• WrittenOffPayoutLib.sol — external library (delegatecall) holding the written-off-asset payout subsystem, extracted from IndexVault.sol to keep its deployed bytecode under the EIP-170 limit. Present in both v1 and v2.
• TiltLens.sol — a read-only peripheral contract aggregating vault
  • basket-asset metadata for off-chain consumers (dashboards, any integrating frontend) without needing multiple RPC round-trips. Deliberately outside the audited core — holds no state, no privileged access, redeployable any time.

v2 additionally splits several more large internal code paths into external libraries (FeeAccrualLib.sol, EmergencyRedeemLib.sol, RebalanceExecutionLib.sol, same EIP-170 reasoning) and adds TickMath.sol (vendored from Uniswap v3-core, used by the TWAP oracle fallback's tick-to-price math).

Documentation

Full architecture, operations, deployment, and integration docs live in docs/:

• docs/ARCHITECTURE.md — how the system works: roles, pricing, NAV, fees, rebalancing, the written-off-asset lifecycle.
• docs/RUNBOOK.md — day-to-day and emergency operations: adding a stock ticker, rebalancing, pausing, write-offs.
• docs/DEPLOYMENT.md — deploying LEAN (test) and TILT (production).
• docs/INTEGRATION.md — for third-party developers: deposit/withdraw, TiltLens, error handling, swap-routing notes.
• docs/ROBINHOOD_CHAIN_ADDRESSES.md — known infra addresses (Doppler, Uniswap, stock tokens/feeds).

Usage

Build

forge build

Test

forge test --no-match-path "test/v*/fork/**"

test/v1/ and test/v2/ mirror the src/ split above. The fork suites under test/v1/fork/ and test/v2/fork/ need a real Robinhood Chain RPC endpoint (see foundry.toml's robinhood_mainnet RPC endpoint alias, or set ROBINHOOD_MAINNET_RPC in .env) and are excluded from the default run.

Invariant/fuzz coverage lives in test/v1/IndexVault.invariant.t.sol and test/v2/IndexVault.invariant.t.sol (similarly for .fuzz.t.sol), each driven by the handler in its own version's handlers/IndexVaultHandler.sol.

Format

forge fmt

Deploy

script/DeployV1.s.sol and script/DeployV2.s.sol each deploy PriceOracleAdapter + IndexVault together for their respective version. The same script deploys both the "LEAN" test instance and the "TILT" production instance — only the .env values and signing key differ, never the code. See each script's own doc comment for the full list of required and optional environment variables (TOKEN_NAME, TOKEN_SYMBOL, ADMIN_ADDRESS, TREASURY_ADDRESS, ASSET_ADDRESS, and more).

forge script script/DeployV2.s.sol:DeployV2 --rpc-url <your_rpc_url> --account <your_keystore_name> --broadcast

Anvil / Cast

anvil
cast <subcommand>