Bullions

The gold exchange that never closes, on Robinhood Chain

Version 1.0, September 2026. Every number in this paper is read from the contracts in contracts/src; where a parameter is owner-adjustable, the default is given and the bounds are stated.

In one page

You do	You get
Bet Bull or Bear on gold, 15 minutes at a time	The losers' stakes, split by size, minus a 3% rake
Long or short gold, up to 5x, or 25x overclocked	Profit from the house pool, in GLD
Own one of 777 Bullion bars	80% of every fee the desk collects, streamed by weight
Hold the BULLIONS coin	Gold dropped on you every hour, out of the coin's own trading fees

Everything is paid in GLD, nothing expires, and every payout is a claim you pull from a contract yourself. The market never closes; the only fixed point in the week is the Sunday 18:00 ET close, where the week round settles and the jackpot draws.

Abstract

Gold is the only major market that still switches itself off. Spot gold trades around the clock on weekdays and shuts on Friday at 17:00 ET; London, Dubai, COMEX, every ETF and every broker go dark until Sunday 18:00 ET. Bullions never shuts. It is a gold market open every hour of every day, including the 49 hours a week when the metal has nowhere else to trade and the price here is one of the few that still moves. It is settled in GLD, Robinhood's tokenized SPDR Gold Shares, on Robinhood Chain, and priced by signed 24/7 gold feeds (RedStone's PAXG/USD and XAUT/USD, with Pyth's accepted alongside) that the Bullions keeper is the first to push on the chain. Bettors take Bull or Bear on gold in 15-minute, 1-hour and week-long rounds, or trade gold perps against a house pool. One moment on the calendar still matters: the session closes every Sunday at 18:00 ET and re-bells in the same breath, and that close is when the week-long round settles and the jackpot draws. The house is owned by 777 Bullion bars, ERC-721 tokens poured one at a time and drawn from a fixed deck, whose share of every gram of rake is set by their karat, and karat is raised only by burning the BULLIONS coin. The coin has four sinks and no faucet, and half of what it earns in fees comes back to it, as a buyback that burns and a gold drop its holders claim.

1. The clock

Pyth's own schedule metadata for Metal.XAU/USD reads: Monday to Thursday 00:00 to 17:00 and 18:00 to 24:00, Friday 00:00 to 17:00, Saturday closed, Sunday 18:00 to 24:00, Eastern Time. Equity.US.GLD/USD trades 09:30 to 16:00 on weekdays. The only gold prices that exist on a Saturday are the crypto-tokenized gold pairs, Crypto.PAXG/USD and Crypto.XAUT/USD, which Pyth publishes seven days a week.

Bullions prices itself off those two pairs, which is why it never has to close. Rounds open, perps fill and the vault takes its cut in every hour of every day, weekends and public holidays included; there is no window in the week when a bet cannot be placed.

What the calendar still decides is the settlement moment. The session runs a week: it closes each Sunday at 18:00 ET, the minute spot gold reopens in New York, and the bell rings again in the same breath. That close is where the week-long round settles, where open perps are flattened at one price, and where the jackpot draws. Trading does not stop for it.

The 49 hours from Friday 17:00 ET to Sunday 18:00 ET are where the difference is easiest to see. In those hours there is no spot gold price anywhere on Earth, and Bullions is still open on the same signed feeds it uses on a Tuesday morning.

2. Architecture

Fourteen contracts, one keeper, one web app.

Contract	Role
GoldOracle	Median of PAXG/USD and XAUT/USD. Each leg arrives by either of two signed paths, RedStone packages verified in the contract (ecrecover, 3 of 5 signers) or Pyth updates verified by the Pyth contract on 4663, and the fresher one wins; a leg is dropped when older than 120 s or, on Pyth, wider than 50 bps of confidence; `push()` takes both kinds
Session	The bell and the close, one week apart and back to back. Keeper-only, with hard floors: at least 4 days between bells, at least 40 hours per session. Records the anchor and closing gold price
RoundsEngine	Binary rounds, pool to peer
PerpEngine	Gold perps against a dedicated house pool
SessionDesk	Session keys: deposit once, swipe all week
FoundryVault	Receives every gram, splits it, streams the bars' share by weight
Bullion	The bars, ERC-721
Referrals	Broker binding, once per bettor, forever
Jackpot	Weekly draw, commit-reveal-draw
SeizedGoldAuction	Dutch auction of seized gold for BULLIONS, burned
FoundryToken	BULLIONS, ERC-20, fixed supply
GldFeeSplitter	The coin's creator-fee recipient on Pons: the fee arrives in GLD and every harvest is cut four ways, team / burn / holders / vault
CoinBuyback	Spends the burn leg on BULLIONS on the coin's own pool and destroys it. Permissionless, with the house's own time-weighted price as the floor
GoldDrop	The coin holders' leg: one cumulative Merkle root every hour, claimed in GLD, never expiring
PoolPairQuote	The coin's time-weighted price in GLD, read off its GLD pool, as the oracle for upgrades and auctions
Addresses	Verified chain constants

The keeper pushes prices, rings the bell and the close, opens and settles rounds, executes perp orders at the next tick, runs the jackpot commit, reveal and draw, and posts the closing gold price to X. Everything it does is either permissionless or bounded by the contracts; a compromised keeper can delay, it cannot steal.

3. The price

Three pull oracles are deployed on Robinhood Chain: Pyth (core-compatible contract, Pyth Pro emitter only), Stork, and Chainlink Data Streams. As of September 2026 none of them had ever received a gold price, and since Pyth's Core upgrade of 26 August 2026 its hosted feeds sit behind a paid key. The GoldOracle therefore verifies prices itself: the keeper fetches signed PAXG/USD and XAUT/USD packages from RedStone's public gateways every 15 seconds during the session and pushes them; the contract recovers every package's signer with ecrecover, accepts a feed only with 3 of the 5 primary-prod signers in one round, takes the median across signers, and then the median of the two feeds. Pyth updates are accepted on the same push and the fresher valid leg wins, so a paid Pyth key or the keyless relay below only ever add freshness. A single valid leg is used alone; two stale legs revert, and everything downstream refuses to settle on a stale price.

Every bettor's transaction can carry a fresh update as well, so the price on chain is never older than the last trade that cared.

A keyless Pyth path also exists: the keeper harvests Pyth-signed payloads from other chains where third parties already push them (Arbitrum for XAUT, Optimism for PAXG, Monad for XAU), repacks them to the single feed needed, and replays them into the 4663 contract. Pyth updates are chain-agnostic: a payload that verifies on one upgraded Pyth contract verifies on every other that trusts the same emitter. Measured on 4 September 2026 those pushes land every 7 to 15 minutes, which is why RedStone carries the session and this path is the fallback.

4. Engine A: binary rounds

Pool to peer. The house holds no capital in a round.

Kinds: 15 minutes (lockout 3 minutes before the close), 1 hour (lockout 10 minutes), and one week-long round from the bell to bell plus weekendLength (lockout 2 hours). One live round per kind. The long kind is still Kind.Weekend in the contracts, from when the session was 49 hours; the app labels it Week.
Strike: the oracle price at open, not older than 90 seconds.
Wager: GLD, minimum 0.01, on Bull or Bear. A bettor may hold both sides.
Settlement: the first oracle tick at or after the close. If the latest tick is older than the close, settlement waits for the next push. Equal to the strike: everyone is refunded. One side empty: the other side is refunded, no rake.
Payout: winners split the losing pot pro rata and take their stake back. Rake is 3% of the losing pot: 2% to the house, 1% to the loser's broker, or to the house when the loser has none.
Claims are pull-based per user, so a bettor the GLD issuer has blocklisted only blocks their own claim, never a round.
A round that cannot settle for 7 days can be abandoned by anyone: full refunds, no rake.

Rake and broker percentages are owner-adjustable, capped at 20% and at the rake respectively, and snapshotted per round at open.

5. Engine B: gold perps

Long or short gold with GLD as margin, against a house pool that lives inside PerpEngine and is separate from the bars' locked principal. Bars never fund losses; the pool does.

Leverage: 5x base. Burning 500 BULLIONS overclocks an account to 25x for the current session week.
Two-step execution: submit pulls margin; execute (anyone, usually the keeper) fills at the next oracle tick published after the submit second, plus price impact. Closes are two-step the same way. Nobody picks their own price.
Price impact: 5 bps x notional x 100 / housePool, capped at 1,000 bps.
Open interest per side is capped at 20% of the house pool.
Fees: 0.1% of notional on open and on close, to the vault.
Liquidation: when the loss reaches 90% of margin, anyone may liquidate; 1% of the remaining margin goes to the liquidator.
Losses: 10% of every realised loss goes to the seized-gold auction; the rest stays in the pool. Profits are paid from the pool and capped by what it holds.
After the close, settleAll force-closes every open position at one settlement price fixed by the first call after the close, so longs and shorts cannot be settled on different ticks.
The owner may withdraw from the pool only above max(reserveTarget, open notional).

Said plainly: on a bad week the house pool can lose. The pool is seeded by the treasury and grows from losses and fees.

6. Swipe mode: session keys

A bettor opens a desk on SessionDesk: deposits GLD, binds a key that lives in their browser, sets a per-wager cap, a budget for the whole session and an expiry (at most 7 days, in practice the coming Sunday close), names the broker to credit, and forwards a little ETH to the key for gas. From then on every swipe is a transaction signed by the key with no wallet prompt. The desk places bets on RoundsEngine through wagerFor, crediting the user, not the desk: positions, referral binding, jackpot tickets and claims all belong to the user. Balances are per user, never pooled, withdrawable any time, the key revocable any time. SessionDesk has no owner and no admin function.

The key is a private key in a browser, so the design assumes it will sometimes be stolen and bounds what that costs. A stolen key can spend at most the session budget, which is set when the desk is opened and which deposit never raises: topping the desk up mid-session hands a key already in the wild nothing. It cannot withdraw, cannot claim, cannot change the cap, the budget or the expiry, and cannot choose the broker, which matters because a referral binding is permanent and would outlive any revoke. withdrawAll empties the desk without racing a stale balance. The audit is docs/audit/session-desk.md.

7. The house: Bullion bars

A bar is a share of the house. Every gram that reaches the vault is split 80% to bars by weight, 10% to the Sunday jackpot, 10% to operations. The split is a ratchet: the bars' share can only go up, the operations share can only go down.

There are 777 bars and there will never be more. They are poured one at a time, and the deck they are drawn from is fixed at deployment:

Purity	Bars	Weight
Doré	388	1x
8K	194	2x
14K	116	4.5x
18K	58	10x
24K	21	25x

Pour: pay the pour price. All of it is the house's: pourLockBps is 0, so a bar carries no principal and a smelt returns only the yield already earned. The bar arrives sealed: no tier, no weight, no yield.
Reveal: the tier is drawn with the hash of the L1 block after the pour, against whatever is left in the deck. Nobody, the deployer included, can pick a tier or see one coming: the hash does not exist when the pour is paid for. Anyone may reveal a sealed bar inside the window, every pour reveals up to three older bars on its way through, and after the window only the revealer can, so a bar poured in a quiet hour is never stuck.
Upgrade: burn BULLIONS priced in gold at the coin's 30-minute time-weighted price (0.25, 0.5, 1 and 2 GLD-equivalent for the four steps). Upgrades stop at 18K. 24K comes out of the deck only, and there are 21 of them. Pending yield settles at upgrade: half is locked into the bar, half is paid out. A maxTokenIn guard refuses a burn above what the bettor accepted.
Refine: every 14 days, burning 1 BULLIONS. A bar left alone starts to decay after 14 days, linearly over another 14 days, down to a floor of 25% of its weight. Anyone may poke a dormant bar to apply the decay and collect a 0.01 GLD bounty from operations, once per decay cycle.
Transfer resets the dormancy clock; a transferred bar keeps its decay until refined.
Smelt: burn the bar, receive its locked GLD plus everything it earned.

Principal never leaks. No sequence of actions by anyone else can reduce a bar's locked GLD. This is enforced in the contracts and asserted by fuzz tests, not promised in a document.

Weight ignores how much GLD is locked; only karat counts. Every bar costs the same to pour and every bar is drawn from the same deck, so buying the house in small pieces buys nothing extra: there are 777 shares in total and the supply cannot be diluted by anyone, including us. Up to 21 bars can be set aside for the team with reserve, at the same lock and out of the same deck.

8. The coin: BULLIONS

ERC-20, 1,000,000,000 BULLIONS, minted once to the deployer, never again.
Launched on the Pons launchpad and traded there against GLD, so the fee on every swap is paid in gold, into the launchpad's escrow, credited to the coin's fee recipient: the GldFeeSplitter. Nothing is swapped and nothing is priced on the way in, so the harvest is permissionless and every destination is fixed at deploy.

The trading fee, four ways. Out of everything the splitter receives:

Leg	Share	Where it goes
Team	1/3	the team wallet, immutable
Buy and burn	1/3	the CoinBuyback: it buys BULLIONS on the coin's own pool and destroys it
Coin holders	1/6	the GoldDrop, paid every hour in GLD
The house	1/6	the FoundryVault, where the 80 / 10 / 10 split takes over

Half of every fee the coin generates goes back to the coin. The vault leg is the remainder of the four, so the legs always sum to exactly what arrived and rounding dust can never strand in the splitter.

The gold drop. Every hour the keeper closes a period and publishes one Merkle root; holders claim GLD whenever they like, and the roots are cumulative, so a holder who ignores fifty periods still needs one transaction. Three rules decide what a wallet earns, and all three are checkable by anyone reading the coin's own transfer history:

The minimum, not the closing balance. A wallet is paid on the lowest balance it held across the period. Buying in late earns nothing until the next one; selling any part drops the wallet to that lower number for the whole of this one. A snapshot would be farmed by buying an hour before it and selling an hour after; a minimum cannot be.
Every holder, pro-rata, no floor and no ceiling. Hold one BULLIONS and you are in the tree; hold a tenth of the float and you take a tenth of the drop. There is no minimum to qualify and no maximum a wallet can earn on. A ceiling was considered and rejected: it never actually stops a large holder, who simply spreads across wallets, so all it does is tax the one who cannot be bothered, while making every buyer's arithmetic depend on somebody else's balance. Straight pro-rata is the only rule a holder can check for themselves before they buy.
Exclusions. The pool, the launchpad escrow, the splitter, the buyback, the drop itself, the team wallet and the burn address earn nothing. Gold allocated to a contract that cannot claim is gold destroyed.

An hour is short enough that nobody has to be awake for the cut, wherever they are. It is also cheap: a root is one small transaction on a chain where gas is negligible, and because the roots are cumulative, 24 a day still means one claim whenever a holder feels like it.

The contract enforces what matters even if the keeper misbehaves: a root can never promise more GLD than the drop already holds, can never lower what an account has already been promised, and can never send a claim anywhere but to the account named in the leaf. Each root is published with the hash of the holder file it was built from, so the arithmetic is reproducible from the chain.

The burn. The buyback is permissionless because the caller decides nothing: the pool, the coin and the destination are immutable, each call spends at most a fixed amount and no sooner than its cooldown, and the price floor is the same 30-minute time-weighted average the upgrade price uses, less a tolerance. A caller may raise that floor, never lower it. If the keeper is down, anyone can fire it and the fees still burn.

Four sinks, no faucet: upgrade burns, overclock burns, the seized-gold auction, and now the buyback. A pour fee in BULLIONS is a fifth, switched off at launch (mintFeeToken is zero until the coin trades). Nothing prints the coin.

Every upgrade by anyone raises total weight and dilutes everyone who sits still. The defence is to burn. That is the whole game.

9. Sunday jackpot

10% of the vault's inflow. Tickets are weighted by the GLD a bettor wagered during the week (counted once the total reaches 0.01 GLD); every 24K bar adds one flat ticket for its holder. Contracts get no tickets; EIP-7702 delegated accounts are people and do.

The draw is commit-reveal-draw. At the bell the keeper commits keccak256(secret) with the scheduled close. After the close it reveals the secret, which freezes the week and arms a draw for the next block. Anyone may then call draw, which seeds from that block's hash: the keeper cannot see the outcome when it reveals, and cannot re-roll by waiting. If the keeper never reveals within 24 hours of the close, anyone may forfeit the week and its tickets carry into the next. A winner the GLD issuer has blocklisted is escrowed in the vault and pulls the prize later; the draw itself never blocks.

Chain note: block.prevrandao is a constant on Arbitrum-family chains, which is why the design does not use it.

10. Brokers

A holder of a 14K bar or better mints a referral link. A bettor arriving through it is bound on their first wager, permanently. 1% of every losing wager by a referred bettor accrues to the broker, paid from the rake, so the bettor's odds do not change. Self-referral is negative expected value: it saves 1% and pays 2% to the house.

11. Where the gold goes

Rake and perp fees, in GLD
        |
        v
   FoundryVault ---- 80% bars, by weight, claimable any time
        |----------- 10% Sunday jackpot
        '----------- 10% operations

Coin trading fee, in GLD
        |
        v
   GldFeeSplitter -- 1/3 team wallet
        |----------- 1/3 CoinBuyback ---- buys BULLIONS on its own pool ---- burned
        |----------- 1/6 GoldDrop ------- claimed by coin holders every hour
        '----------- 1/6 FoundryVault --- 80 / 10 / 10 as above

Seized gold (10% of perp losses) ---- Dutch auction for BULLIONS ---- burned

Ratchet on the vault split. Seized lots start at 150% of the pool quote and decay to 80% over 24 hours; a relisted lot cannot start below its previous floor.

12. Security

Three adversarial reviews were run over the contracts with a rule: no finding without a failing test that demonstrates it, no fix without the test passing. Reports are in docs/audit/. Findings included a seeding router that let anyone remove the pool's liquidity, a poke bounty that could drain operations, a perp fill that could be chosen from before the order, a jackpot the keeper could grind, and a blocked winner that could freeze the draw. All fixed.
409 unit tests, 23 fork tests against Robinhood Chain, and a full dress rehearsal of contracts, keeper and web on a fork with the real GLD token.
Every external transfer follows checks-effects-interactions behind a reentrancy guard. Claims are per user and pull-based.
Owner powers are bounded: the vault split is a ratchet; perp parameters are capped; the house pool cannot be withdrawn under open exposure; SessionDesk has no owner at all.

Risks, said once:

GLD on chain is Robinhood's token with an issuer blocklist and a pause. Every gram in the system is subject to that.
Oracle liveness. Pushes are permissionless and every payload is signed by RedStone's or Pyth's signer set, so the keeper cannot fake a price, only delay one. Engines refuse stale prices and rounds refund when they cannot settle. The RedStone signer list is owner-rotatable behind a 2-day timelock, because the engines hold the oracle's address as immutable.
The house pool can lose. Open-interest caps, next-tick fills and price impact bound it; they do not remove it.
The coin's time-weighted price can be pushed. PoolPairQuote averages spot observations of the coin's GLD pool that anyone may record, at most one every 30 seconds, over 30 minutes; a moved price has to be held against arbitrage for a good part of that window to move the average, and a single block's spot counts for one observation. The quote falls back to the longest history it has, never below 4 minutes, and refuses to answer when the newest observation is older than 15 minutes.
Jurisdiction. The app blocks the United States, United Kingdom, Switzerland and Canada at the edge from day one.

13. Parameters at launch

Parameter	Value
Session	A week, Sunday 18:00 ET to Sunday 18:00 ET, closing and re-belling back to back; contract floors of 4 days between bells and 40 hours per session
Rake / broker	3% of the losing pot / 1% of it
Minimum wager	0.01 GLD
Oracle max age	90 s (engines), 120 s per leg (oracle), 50 bps confidence cap
Vault split	80 / 10 / 10, ratchet
Bars	777, fixed; deck 388 Doré / 194 8K / 116 14K / 58 18K / 21 24K
Karat ladder	1 / 2 / 4.5 / 10 / 25
Pour	one bar per call, price in GLD, half locked in the bar; tier drawn at the reveal
Upgrade prices	0.25, 0.5, 1, 2 GLD-equivalent at the 30-minute TWAP, stopping at 18K
Refine	every 14 days, 1 BULLIONS; decay to 25% over the following 14 days; poke bounty 0.01 GLD
Perps	5x base, 25x overclocked for 500 BULLIONS, 0.1% open and close, OI cap 20% of pool, liquidation at 90%, 1% to the liquidator, 10% of losses seized, minimum margin 0.05 GLD
Coin fees	The Pons creator fee, paid in GLD, split 1/3 team, 1/3 burned, 1/6 coin holders, 1/6 vault; no swap on the way in
Gold drop	Every hour, in GLD; every holder pro-rata on their minimum balance for the period, no floor and no ceiling; cumulative roots, claims never expire
Buyback	Permissionless, capped per call with a cooldown, floor from the 30-minute time-weighted price less a tolerance
Jackpot	10% of inflow, tickets from 0.01 GLD, one ticket per 24K bar, reveal window 24 h
Auction	150% start, 80% floor, 24 h decay
BULLIONS supply	1,000,000,000, fixed

14. Contracts

Robinhood Chain, chain id 4663.

Contract	Address
Bullion	`0x38c3619C9302dF61EB5De5134DCBfa3e875149d6`
FoundryVault	`0xC905FC4c16Ce7013e1FFc759879E657bD57E16eA`
BullionMetadata (library)	`0x91350c61E6f50EE024Df9CC702dBbD30F1C5acea`
SeaDropConfig (library)	`0x3632F0146Ca19fB35b08379bB89587ee39AB1810`

The bars were sold first, so the engines above are not deployed yet and their addresses land here when they are. Until then contracts/script/DeployAll.s.sol is the reference for the wiring.

The bars are also sold before the coin exists, so Bullion.token starts at zero and is named once, later, with setToken. Until that call every path that would burn reverts CoinNotSet rather than half-working, and the setter refuses a token with no code and refuses the settlement token, which cannot burn at all. That guard exists because an earlier deployment, 0x7282cc8b50e3e5a6618a896ad5f3636a687094df, was built when the field was immutable and was given the settlement token: its ladder can never run, so it was retired before it ever sold a bar and is listed here only so the address is not mistaken for a live one.

Bullions is code, and the code is public. Nothing in this paper is financial advice.