Protect your money. Keep the upside.
Savings on tokenized US stocks with a floor under them, on BSC mainnet. An agent rebalances around the clock to defend it.
Tokenized stocks trade all night and all weekend. A saver who wants the upside of a stock but cannot stomach losing the savings has had one answer so far: stay out. Banks sell this product to millions of people as a capital protected note. Plinth is that product on BSC, enforced by a contract instead of a bank desk, with one thing a desk cannot do: act at 3am on a Sunday.
You deposit USDT, pick a stock and a floor (up to 100% of what you put in, at 12 months). Part of the money rides the stock. The rest earns interest on Venus or Aave. When the stock falls, an agent moves money toward safety by itself. You can leave at any time at today's value. The floor is defended by rules, not guaranteed, and the page says so next to the deposit button.
A real vault on mainnet. Every number is read from the chain, and every action links to its transaction.
| Demo video (3:30) | https://youtu.be/tCO9HDtvVmQ |
| Live site | https://plinth-savings.vercel.app |
| A real vault, real money | https://plinth-savings.vercel.app/demo |
| Proof: backtests, fork replays, off hours data | https://plinth-savings.vercel.app/proof |
| The keeper agent, live state and uptime | https://plinth-relay.vercel.app/agent/keeper |
| Contracts (v3, verified) | docs/DEPLOYMENTS.md |
| Two reviews and every fix | docs/AUDITS.md |
| Security model and how to report | SECURITY.md |
| Agentic Wallet skill: "protect $50 in Nvidia" | skills/plinth/SKILL.md |
| Raw developer experience log | docs/DX_LOG.md |
Five minutes, no keys, no wallet.
- Open /demo. This is a real vault with real money. Value, floor, the single drop that would touch the floor, the exit estimate on the vault's own pool, and every action with a BscScan link.
- Open the front page and move the sliders. The rates, caps and limits are read from Venus and the factory as you move them.
- Open /proof. Ten years of every stock, real contracts replayed through Nvidia's worst gap next to two bank desks, and three months of real bStock prices from while New York was shut.
- Read the agent's own counters:
curl https://plinth-relay.vercel.app/agent/keeper(passes, longest gap, gaps over five minutes). Ask it about a vault in plain words:curl "https://plinth-relay.vercel.app/api/plan?action=status&vault=0xF0FB407210944A577949eA7Cc3031B542740B5B2". - Run the tests yourself (commands below). Every audit fix has a regression that runs on a fork of BSC mainnet.
- With a wallet: connect, approve, open. Or use the Agentic Wallet skill and say it in words.
| Part | Status |
|---|---|
| Contracts | Live on BSC mainnet, verified on Sourcify (exact match). Three versions shipped, each fixing a review. No third party audit. |
| Demo vault | Real USDT. Opened, partly withdrawn and migrated between versions from a Binance Agentic Wallet with Developer Mode contract calls, each previewed first. |
| Keeper agent | Live. Passes every minute on a container host. ERC-8004 identity #363619. One ERC-8183 job negotiated, funded and delivered on mainnet (job 56898). |
| Keeper acting on an event | On mainnet, on the earlier vault: it cut the multiplier from 5.7 to 4.2 before the US jobs report on 2 October (cut, restore). No scheduled event falls before the submission deadline. The next is US CPI on 14 October at 12:30 UTC, during judging: the agent will cut the demo vault's multiplier from 00:30 UTC that day and raise it back one step every four hours after 13:30 UTC, all on the vault page. |
| Crash response | Measured on a fork of mainnet, not on mainnet: a 10% fall in one block is sold within about a minute. The tests are in the repo. |
| Off hours study | Real bStock prices from the Binance Web3 API, three months. Hourly bars stand in for the contract's minute scale rule, and the page says so. |
| Backtest | Daily prices, ten years, every possible 12 month period for the 19 listed stocks with enough history: at the risk levels now on chain, none of 37,417 periods ends below the floor (worst: $999.55 per $1,000). At the levels first chosen, 14 did; those five levels were lowered on chain on 20 October. The levels are fitted to this same history, and no agent cuts are modelled. |
| x402 | Hosting was paid once over x402 from the agent's wallet. That host never started, so the agent runs elsewhere. The paid report rail is not switched on: it needs a Binance Onchain Pay merchant account. The ERC-8183 report is priced at $0.01 USDT and works. |
12 October 2026. The proof page and this README first said that no 12 month period in ten years ended below the
floor. That was true only of the periods tested, which started every 5 trading days, and each stock's multiplier was
picked as the highest with no miss in that sample. Testing every starting day
(packages/core/scripts/backtest-every-day.ts, data/backtest-every-day-2026-10-12.json) found 14 misses in 37,429
periods across the 19 listed stocks: Tesla 7, Strategy 4, Nvidia 1, Netflix 1, GameStop 1. Thirteen ended within half a
percent of the floor; GameStop's ended 2.8% short.
20 October 2026. The multipliers for those five stocks were lowered on chain (PlinthFactory.setCap, from the owner
wallet): Nvidia 5.7 to 5.1, Tesla 5.1 to 4.7, Netflix 3.5 to 3.3, Strategy 3.2 to 3.1, GameStop 1.7 to 1.6. Each is the
highest level with no miss on any starting day. Rerun at the deployed levels
(data/backtest-every-day-2026-10-20.json), none of 37,417 periods ends below the floor. The levels are fitted to this
same history, so a fall worse than anything in it can still break a floor. The same data shows what the floor costs: a
fixed mix of the same starting stock share, bought once and held, ended below $1,000 in 12.8% of periods but ended ahead
of Plinth in 70% of them. No feature was added in either correction.
Main track: tokenized stock products and agents. bStocks are the stock leg: 20 of them, each with its own pool, fee tier, multiplier and trade limits. Spot only. The agent is built for the track's scoring: fixed code signs, the model never touches money, every action is public.
Best use of Agentic Wallet. The wallet's AI layer is the front door for people who do not want a website. The Plinth skill turns "protect $50 in Nvidia at 95%" into exact contract calls. The wallet previews each one (the simulation, the balance change, the risk list), the saver confirms, the wallet executes. Proven end to end on mainnet: a withdrawal run through the skill.
Best use of BNB Agent Studio. The keeper is a Studio agent with an ERC-8004 identity, an A2A card and an ERC-8183 seller. It holds the factory's keeper role, so it is the thing that actually defends savers' vaults. It publishes its own uptime counters. What is not done: it does not yet sell reports over x402, and its first host (NodeOps) never started after four deployments in two modes (the log has the evidence).
| Module | Role in Plinth |
|---|---|
| RWA Data | Trading status and pause codes feed the agent's event policy. The bStock price and the underlying reference price sit on every vault page. |
| Market | Hourly candles for each held stock. When the last day of moves runs at twice its usual size, the agent cuts risk to 70% of the cap until it calms. Medians, so one bad print cannot trigger it. |
| Wallet | When a saver connects, the page shows what the wallet already holds: USDT, and any bStocks held outright with no floor under them. |
| DeFi | Ranks every USDT earn product on BSC on the front page. The vault's own health gate chooses between Venus and Aave onchain. |
| Trading | Aggregated quotes, shown as an indicative best price. The vault trades only on its fixed PancakeSwap or Uniswap pool (aggregator routes for stocks need a wallet signature a contract cannot give), so exit estimates quote that pool. |
| Transaction | Every keeper write is simulated here before it is sent. A FAIL blocks it. If the API is down, the onchain simulation stands and the action records that. |
All calls go through a small relay in Singapore (relay/), because the API refuses US addresses. The relay allows an exact list of read endpoints and simulations of Plinth's own contracts. It never signs or sends anything.
CPPI, the method banks have used for decades, enforced by a vault contract, one per saver.
- The floor. Today's floor is the promise discounted at today's lending rate. What sits above it is the cushion.
- The stock part. Only a multiple of the cushion goes into the stock:
target = min(total, multiplier x cushion). A stock's multiplier is the highest one with no miss in any 12 month period starting on any trading day of ten years of real prices, capped at 6 (see the correction below). - The safe part. The rest is lent on Venus core or Aave v3 behind a health gate: cash, utilization, pauses, the USDT feed. If a market fails the gate the vault leaves it. If a market will not pay out, the vault keeps tracking the position and only sells stock until it does.
- The agent. It rebalances drifting vaults, cuts risk before earnings and US macro releases, and pulls the safe part out of unhealthy markets. It can cut the multiplier at once and raise it back one step per four hours. It can never withdraw. Anyone can rebalance, so vaults stay defended if the agent is down.
- Around the clock. The vault values the stock at
min(slow reference, max(60 second average, live pool price)). A fall that lasts is sold within about a minute. A bad print that recovers is ignored. A spike is never chased.
When the floor fails: if the stock falls more than the break distance before anyone can trade, if the lending market fails faster than the gate, if USDT loses its peg, or if the contract has a bug. Rates float: if they fall, the floor rises and less stays in the stock. Leaving early returns today's value, not the promise.
bStocks trade through the night on deep BSC pools, and the lending markets that pay interest on the safe part live on the same chain, so one transaction splits a deposit between a stock and a loan and an agent can move it at any hour.
0.0001 BNB. That is the gas to open a protected position (1.44 million gas at 0.07 gwei, measured on mainnet). A withdrawal costs 0.00004 BNB. A risk cut by the agent costs 0.0000024 BNB. Watching a vault every minute costs nothing, because reading is free and the agent only pays when it acts.
| Agent | curl https://plinth-relay.vercel.app/agent/keeper shows its passes, its longest gap and any gaps over five minutes since its last start |
| Demo vault | https://plinth-savings.vercel.app/demo |
| Next scheduled cut | US CPI, 14 October 12:30 UTC. Watch the demo vault's multiplier drop from 00:30 UTC and come back after the release |
| Factory | 0x271cb3B5…DCe5 |
git clone --recurse-submodules https://github.com/jenzylove/plinth && cd plinth
# contracts: math tests, then the fork tests against BSC mainnet (any archive RPC)
cd contracts && forge test --match-contract FloorMathTest
BSC_ARCHIVE_RPC_URL=https://bsc-mainnet.public.blastapi.io forge test --no-match-contract ReplayLab
# keeper: policy and isolation tests, then one read only pass against mainnet
cd ../packages/keeper && npm ci && npm test
BSC_RPC_URL=https://bsc-dataseed1.defibit.io npx tsx src/cli.ts --once
# the site
cd ../../app && npm ci && npm run devThe fork tests need an archive RPC with a real rate limit (the free one above is enough on a laptop, but it answers 429 to shared CI runners, so CI runs them only on demand with your own key). The fast checks run on every push. The fork suite opens and closes all 20 stocks, sells into crashes, reduces risk in chunks, and runs every audit regression (contracts/test/AuditFixes.t.sol). The replay lab (contracts/test/ReplayLab.t.sol) replays real Nvidia paths against the real contracts next to two bank desks.
| Path | What |
|---|---|
| contracts/ | Vault, factory, CPPI math, safe leg and stock leg libraries, fork tests, deploy script |
| packages/core/ | CPPI math in TypeScript, calibration, backtests, the off hours studies |
| packages/keeper/ | The keeper pass: event policy, per vault isolation, simulation |
| agent/plinthkeeper/ | The Agent Studio project that runs the keeper |
| app/ | The site |
| relay/ | Web3 API relay, vault history, agent endpoint, RPC router, the planner behind the skill |
| skills/plinth/ | The Agentic Wallet skill |
| data/ | Every dataset behind a number on the site, with its source and date |
| docs/ | PRD, deployments, audits, research, developer experience log |
MIT licensed.