Fees buy the basket. You hold the receipt.
A token launches on Pons v2. Its creator fees arrive in the pool's quote asset and land in a router that splits them three ways: a slice to the creator, a slice to the protocol, and a slice held for conversion.
Anyone can then crank a keeper, which buys the basket at target weights and deposits it into a vault. The vault mints receipt shares. Those shares are distributed to the launch token's holders each epoch, by Merkle root, weighted by how long they held rather than by who happened to be holding at a snapshot.
A share redeems for a pro-rata slice of every leg in the basket, in kind. No swap, no fee, no allowlist, and no price read — redemption works when every oracle in the basket is stale, paused, or out of band.
There is no owner anywhere in the system. Nothing here can be paused, upgraded, or pointed somewhere else after deployment. That is not a promise about intent; it is the absence of the functions that would be needed.
Four contracts.
ArrearsVault
Not deployed yet.
Can
- Hold a fixed basket of stock tokens and mint receipt shares against deposits
- Redeem shares for a pro-rata slice of every leg, in kind, permissionlessly
- Retire a leg whose Chainlink feed has gone quiet, after a 96-hour timelock
Cannot
- Change its weights, tokens, feeds or price bands — all set at construction
- Be paused, upgraded, or have an owner. There is no admin function of any kind
- Stop you redeeming. Redemption reads no price and cannot be blocked by a bad oracle
ArrearsRouter
Not deployed yet.
Can
- Receive creator fees in the launch's quote asset and split them three ways
- Let the creator withdraw their share and the keeper pull the yield share
- Push the protocol share to another ArrearsRouter — the same code, no special path
Cannot
- Swap anything, or call the vault. It holds and splits, nothing else
- Be swept, rescued, or drained. There is no owner and no escape hatch
- Take more than 5% for the protocol — the factory caps it at 500 bps
ArrearsKeeper
Not deployed yet.
Can
- Be cranked by anyone, at any time, for any router it serves
- Convert yield into basket assets and deposit them, forwarding every share on
- Route through Uniswap v4 — including from native ETH where a route is configured
Cannot
- Execute outside the oracle band. Every swap must clear a Chainlink-derived floor
- Convert more than one slice per crank, or crank the same router twice in an interval
- Hold shares or native ETH between transactions — both are asserted zero at the end
ArrearsDistributor
Not deployed yet.
Can
- Open an epoch against a Merkle root, funded from pending shares first
- Let anyone claim on behalf of an address — the shares always go to that address
- Roll unclaimed shares forward into the pending pool once an epoch expires
Cannot
- Pay out more than an epoch was funded with. Epochs are accounted independently
- Return anything to the publisher. There is no path back, ever
- Edit, reopen or cancel an epoch once it is open
What we could still get wrong.
The indexer decides allocations. The contract verifies a Merkle proof; it cannot verify that the root was computed honestly. Every epoch publishes its block range and exclusion set so the root is reproducible — check it if it matters to you.
A permanently paused oracle stalls a leg. A paused oracle is never grounds for retirement, which is right for a corporate action and wrong if an issuer never unpauses. Redemption still works throughout.
Price bands are immutable. If a stock leaves its band the vault cannot price it and deposits stop. Redemption does not, which is the whole reason immutable bands are acceptable.