Bullions

The only gold house that never closes, and 777 people own the vault

On Robinhood Chain. Version 1.0, September 2026. Every number in this paper is read from the contracts in contracts/src; where a parameter is owner-adjustable, the default is given and the bounds are stated. The bar collection is already deployed and its live settings are read off the chain in section 13, where they differ from the source.

---

In one page

Everything is paid in GLD, nothing expires, and every payout is a claim you pull from a contract yourself.

The door is open. Nobody needs a bar to trade. Everything a player can measure at the table is identical for everyone: the same strike, the same tick, the same rake, the same odds. Holders are favoured after the rake is taken, never inside the trade.

The venue never closes either. What changes with the calendar is not whether you can trade but what size costs. When spot gold is open the perp desk runs at full leverage, the full open-interest cap and the tightest price impact; when spot gold is shut all three move the other way. The weekend is not a gap in the week, it is the peak of it: the widest price impact, the biggest round on the board, and the Sunday draw at the end of it.

---

Abstract

Gold is the only major market that still switches itself off. Spot gold trades around the clock on weekdays and shuts on Friday at 17:00 ET; London, Dubai, COMEX, every ETF and every broker go dark until Sunday 18:00 ET. Bullions never shuts. It is a gold market open every hour of every day, including the 49 hours a week when the metal has nowhere else to trade and the price here is one of the few that still moves. It is settled in GLD, Robinhood's tokenized SPDR Gold Shares, on Robinhood Chain, and priced by signed 24/7 gold feeds (RedStone's PAXG/USD and XAUT/USD, with Pyth's accepted alongside) that the Bullions keeper is the first to push on the chain.

Anyone with a wallet and some GLD can trade here. There is no allowlist, no holding requirement and no separate room for owners. Bettors take Bull or Bear on gold in 15-minute, 1-hour and week-long rounds, or trade gold perps against a house pool, on the same terms whatever else they hold. What the calendar changes is the price of size, not the right to trade: when spot gold is open the perp desk runs at full leverage, the full open-interest cap and the tightest price impact, and when spot gold is shut those three move the other way. We are not closed on a Saturday; we are wider. That makes the weekend the busiest part of the week rather than the missing part of it, and it ends at the Sunday 18:00 ET close, where the week-long round settles, open perps are flattened at one price and the jackpot draws.

The house is owned by 777 Bullion bars, ERC-721 tokens poured one at a time and drawn from a fixed deck, whose share of every gram of rake is set by their karat, and karat is raised only by burning the BULLIONS coin. A bar buys economics, not access: 80% of every gram the desk rakes streams to the bars by karat weight, a 14K bar or better mints a referral link and takes the broker leg of the rake forever, and every 24K bar is a flat ticket in the Sunday draw. None of that touches the strike, the tick or the odds a bettor sees. The coin has four sinks and no faucet, and half of what it earns in fees comes back to it, as a buyback that burns and a gold drop its holders claim.

---

1. The clock

Pyth's own schedule metadata for Metal.XAU/USD reads: Monday to Thursday 00:00 to 17:00 and 18:00 to 24:00, Friday 00:00 to 17:00, Saturday closed, Sunday 18:00 to 24:00, Eastern Time. Equity.US.GLD/USD trades 09:30 to 16:00 on weekdays. The only gold prices that exist on a Saturday are the crypto-tokenized gold pairs, Crypto.PAXG/USD and Crypto.XAUT/USD, which Pyth publishes seven days a week.

Bullions prices itself off those two pairs, which is why it never has to close. Rounds open, perps fill and the vault takes its cut in every hour of every day, weekends and public holidays included. The one gap is mechanical rather than scheduled: the session closes and re-bells in two keeper transactions, and between them wager and submit revert SessionClosed. The keeper sends them back to back, so the gap is a block or two; the Session contract says the same thing in its own NatSpec.

What the calendar still decides is the settlement moment. The session runs a week: it closes each Sunday at 18:00 ET, the minute spot gold reopens in New York, and the bell rings again in the same breath. That close is where the week-long round settles, where open perps are flattened at one price, and where the jackpot draws. Trading does not stop for it.

Two regimes, one venue

The 49 hours from Friday 17:00 ET to Sunday 18:00 ET are where the difference is easiest to see. In those hours there is no spot gold price anywhere on Earth, and Bullions is still open on the same signed feeds it uses on a Tuesday morning. It is also when the price we publish is thinner: PAXG and XAUT carry it alone, and a thin book behind a quote is the house's risk, not the trader's.

So the venue does not close for the weekend, it re-prices for it. Three perp parameters move with the regime:

Nothing is switched off and no order is refused. The trader who wants the same size on a Saturday can still have it, and pays more for it than on a Tuesday. "We are closed" becomes "we are wider", which is the honest version of the same sentence.

These are the three owner calls setLeverage, setOiCapBps and setPriceImpactBps. Each is read at the moment an order fills, so a change binds the next fill and never a position already open: tightening for the weekend cannot liquidate somebody who opened on Friday afternoon. setOiCapBps is capped at 100% of the pool and setPriceImpactBps at MAX_IMPACT_BPS, which is 1,000 bps. setLeverage has no ceiling in the contract, only the requirement that the base is non-zero and the overclocked figure is not below it.

TODO: the shut-regime values are not in contracts/src yet. Fill in the weekend leverage, the weekend oiCapBps and the weekend priceImpactBps here and in section 13 once they are set.

The rounds engine does not change with the regime at all. A 15-minute round is pool to peer, the house holds no capital in it, and the rake is the same 3% at 03:00 on a Sunday as at noon on a Tuesday.

---

2. Architecture

Fifteen contracts and a constants library, one keeper, one web app.

The keeper pushes prices, rings the bell and the close, opens and settles rounds, executes perp orders at the next tick, runs the jackpot commit, reveal and draw, and posts the closing gold price to X. Everything it does is either permissionless or bounded by the contracts; a compromised keeper can delay, it cannot steal.

---

3. The price

Three pull oracles are deployed on Robinhood Chain: Pyth (core-compatible contract, Pyth Pro emitter only), Stork, and Chainlink Data Streams. As of September 2026 none of them had ever received a gold price, and since Pyth's Core upgrade of 26 August 2026 its hosted feeds sit behind a paid key. The GoldOracle therefore verifies prices itself: the keeper fetches signed PAXG/USD and XAUT/USD packages from RedStone's public gateways every 15 seconds during the session and pushes them; the contract recovers every package's signer with ecrecover, accepts a feed only with 3 of the 5 primary-prod signers in one round, takes the median across signers, and then the median of the two feeds. Pyth updates are accepted on the same push and the fresher valid leg wins, so a paid Pyth key or the keyless relay below only ever add freshness. A single valid leg is used alone; two stale legs revert, and everything downstream refuses to settle on a stale price.

Every bettor's transaction can carry a fresh update as well, so the price on chain is never older than the last trade that cared.

A keyless Pyth path also exists: the keeper harvests Pyth-signed payloads from other chains where third parties already push them (Arbitrum for XAUT, Optimism for PAXG, Monad for XAU), repacks them to the single feed needed, and replays them into the 4663 contract. Pyth updates are chain-agnostic: a payload that verifies on one upgraded Pyth contract verifies on every other that trusts the same emitter. Measured on 4 September 2026 those pushes land every 7 to 15 minutes, which is why RedStone carries the session and this path is the fallback.

---

4. Engine A: binary rounds

Pool to peer. The house holds no capital in a round.

• Who may play: anyone with a wallet on 4663 and GLD to stake. No bar, no allowlist, no minimum holding, no separate room. A bar changes what a person is paid out of the rake afterwards; it never changes the strike, the tick or the odds.
• Kinds: 15 minutes (lockout 3 minutes before the close), 1 hour (lockout 10 minutes), and one week-long round from the bell to bell plus weekendLength (lockout 2 hours). One live round per kind. The long kind is still Kind.Weekend in the contracts, from when the session was 49 hours; the app labels it Week. It is the biggest pot on the board and it is decided at the Sunday close, in the same minute as the draw.
• Strike: the oracle price at open, not older than 90 seconds.
• Wager: GLD, minimum 0.01, on Bull or Bear. A bettor may hold both sides.
• Settlement: the first oracle tick at or after the close. If the latest tick is older than the close, settlement waits for the next push. Equal to the strike: everyone is refunded. One side empty: the other side is refunded, no rake.
• Payout: winners split the losing pot pro rata and take their stake back. Rake is 3% of the losing pot: 2% to the house, 1% to the loser's broker, or to the house when the loser has none.
• Claims are pull-based per user, so a bettor the GLD issuer has blocklisted only blocks their own claim, never a round.
• A round that cannot settle for 7 days can be abandoned by anyone: full refunds, no rake.

Rake and broker percentages are owner-adjustable, capped at 20% and at the rake respectively, and snapshotted per round at open.

---

5. Engine B: gold perps

Long or short gold with GLD as margin, against a house pool that lives inside PerpEngine and is separate from the bars' locked principal. Bars never fund losses; the pool does.

• Who may trade: anyone. Margin is GLD and nothing else is asked for. Overclocking to 25x costs BULLIONS, not a bar.
• Leverage: 5x base. Burning 500 BULLIONS overclocks an account to 25x for the current session week.
• Two-step execution: submit pulls margin; execute (anyone, usually the keeper) fills at the next oracle tick published after the submit second, plus price impact. Closes are two-step the same way. Nobody picks their own price.
• Price impact: 5 bps x notional x 100 / housePool, capped at 1,000 bps.
• Open interest per side is capped at 20% of the house pool.
• Regime: leverage, the open-interest cap and the price-impact coefficient are the three numbers that move when spot gold shuts. Section 1 has the shape of it. All three are owner calls, all three are capped in the contract, and all three are read when an order fills, so a weekend tightening binds the next fill and never a position already open. The values above are the spot-open settings; the shut-regime settings are the TODO in section 1.
• Fees: 0.1% of notional on open and on close, to the vault.
• Liquidation: when the loss reaches 90% of margin, anyone may liquidate; 1% of the remaining margin goes to the liquidator.
• Losses: 10% of every realised loss goes to the seized-gold auction; the rest stays in the pool. Profits are paid from the pool and capped by what it holds.
• After the close, settleAll force-closes every open position at one settlement price fixed by the first call after the close, so longs and shorts cannot be settled on different ticks.
• The owner may withdraw from the pool only above max(reserveTarget, open notional).

Said plainly: on a bad week the house pool can lose. The pool is seeded by the treasury and grows from losses and fees.

---

6. Swipe mode: session keys

A bettor opens a desk on SessionDesk: deposits GLD, binds a key that lives in their browser, sets a per-wager cap, a budget for the whole session and an expiry (at most 7 days, in practice the coming Sunday close), names the broker to credit, and forwards a little ETH to the key for gas. From then on every swipe is a transaction signed by the key with no wallet prompt. The desk places bets on RoundsEngine through wagerFor, crediting the user, not the desk: positions, referral binding, jackpot tickets and claims all belong to the user. Balances are per user, never pooled, withdrawable any time, the key revocable any time. SessionDesk has no owner and no admin function.

The key is a private key in a browser, so the design assumes it will sometimes be stolen and bounds what that costs. A stolen key can spend at most the session budget, which is set when the desk is opened and which deposit never raises: topping the desk up mid-session hands a key already in the wild nothing. It cannot withdraw, cannot claim, cannot change the cap, the budget or the expiry, and cannot choose the broker, which matters because a referral binding is permanent and would outlive any revoke. withdrawAll empties the desk without racing a stale balance. The audit is docs/audit/session-desk.md.

---

7. The house: Bullion bars

A bar is a share of the house. Every gram that reaches the vault is split 80% to bars by weight, 10% to the Sunday jackpot, 10% to operations. The split is a ratchet: the bars' share can only go up, the operations share can only go down.

A bar is not a key. It opens no door, unlocks no room and moves no price. Everything it buys sits on the far side of the rake: a stream of what the desk has already collected, in proportion to karat; the right to mint a referral link at 14K and up; a flat ticket in the Sunday draw at 24K. A holder and a stranger who place the same wager in the same round win and lose the same amount. That is the whole of the deal, said once so nobody has to guess at it.

There are 777 bars and there will never be more. They are poured one at a time, and the deck they are drawn from is fixed at deployment:

• Pour: pay the pour price. All of it is the house's: pourLockBps is 0, so a bar carries no principal and a smelt returns only the yield already earned. The bar arrives sealed: no tier, no weight, no yield.
• Reveal: the tier is drawn with the hash of the L1 block after the pour, against whatever is left in the deck. Nobody, the deployer included, can pick a tier or see one coming: the hash does not exist when the pour is paid for. Anyone may reveal a sealed bar inside the window, every pour reveals up to three older bars on its way through, and after the window only the revealer can, so a bar poured in a quiet hour is never stuck.
• Upgrade: burn BULLIONS priced in gold at the coin's 30-minute time-weighted price (0.25, 0.5, 1 and 2 GLD-equivalent for the four steps). Upgrades stop at 18K. 24K comes out of the deck only, and there are 21 of them. Pending yield settles at upgrade: half is locked into the bar, half is paid out. A maxTokenIn guard refuses a burn above what the bettor accepted.
• Refine: every 14 days, burning 1 BULLIONS. A bar left alone starts to decay after 14 days, linearly over another 14 days, down to a floor of 25% of its weight. Anyone may poke a dormant bar to apply the decay and collect a bounty in GLD from operations, once per decay cycle. The bars are sold before the coin exists, so on the live collection refineFeeToken is set to zero for now: refine works with no coin at all, and the fee is restored with one setParams when the coin trades.
• Transfer resets the dormancy clock; a transferred bar keeps its decay until refined.
• Smelt: burn the bar, receive its locked GLD plus everything it earned.

Principal never leaks. No sequence of actions by anyone else can reduce a bar's locked GLD. This is enforced in the contracts and asserted by fuzz tests, not promised in a document.

Weight ignores how much GLD is locked; only karat counts. Every bar costs the same to pour and every bar is drawn from the same deck, so buying the house in small pieces buys nothing extra: there are 777 shares in total and the supply cannot be diluted by anyone, including us. Up to 21 bars can be set aside for the team with reserve, at the same lock and out of the same deck.

---

8. The coin: BULLIONS

• ERC-20, 1,000,000,000 BULLIONS, minted once to the deployer, never again. Live on Robinhood Chain at 0x108c647C2BA19d7F9D6a5B496a5adFb3C885c265, 18 decimals, burnable, and traded on its Pons pool. The contract answers Bullions to symbol(); this paper writes the ticker in capitals throughout.
• Launched on the Pons launchpad and traded there against GLD, so the fee on every swap is paid in gold, into the launchpad's escrow, credited to the coin's fee recipient: the GldFeeSplitter. Nothing is swapped and nothing is priced on the way in, so the harvest is permissionless and every destination is fixed at deploy.

The trading fee, four ways. Out of everything the splitter receives:

Half of every fee the coin generates goes back to the coin. The vault leg is the remainder of the four, so the legs always sum to exactly what arrived and rounding dust can never strand in the splitter.

The gold drop. Every hour the keeper closes a period and publishes one Merkle root; holders claim GLD whenever they like, and the roots are cumulative, so a holder who ignores fifty periods still needs one transaction. Three rules decide what a wallet earns, and all three are checkable by anyone reading the coin's own transfer history:

• The minimum, not the closing balance. A wallet is paid on the lowest balance it held across the period. Buying in late earns nothing until the next one; selling any part drops the wallet to that lower number for the whole of this one. A snapshot would be farmed by buying an hour before it and selling an hour after; a minimum cannot be.
• Every holder, pro-rata, no floor and no ceiling. Hold one BULLIONS and you are in the tree; hold a tenth of the float and you take a tenth of the drop. There is no minimum to qualify and no maximum a wallet can earn on. A ceiling was considered and rejected: it never actually stops a large holder, who simply spreads across wallets, so all it does is tax the one who cannot be bothered, while making every buyer's arithmetic depend on somebody else's balance. Straight pro-rata is the only rule a holder can check for themselves before they buy.
• Exclusions. The pool, the launchpad escrow, the splitter, the buyback, the drop itself, the team wallet and the burn address earn nothing. Gold allocated to a contract that cannot claim is gold destroyed.

An hour is short enough that nobody has to be awake for the cut, wherever they are. It is also cheap: a root is one small transaction on a chain where gas is negligible, and because the roots are cumulative, 24 a day still means one claim whenever a holder feels like it.

The contract enforces what matters even if the keeper misbehaves: a root can never promise more GLD than the drop already holds, can never lower what an account has already been promised, and can never send a claim anywhere but to the account named in the leaf. Each root is published with the hash of the holder file it was built from, so the arithmetic is reproducible from the chain.

The burn. The buyback is permissionless because the caller decides nothing: the pool, the coin and the destination are immutable, each call spends at most a fixed amount and no sooner than its cooldown, and the price floor is the same 30-minute time-weighted average the upgrade price uses, less a tolerance. A caller may raise that floor, never lower it. If the keeper is down, anyone can fire it and the fees still burn.

• Four sinks, no faucet: upgrade burns, overclock burns, the seized-gold auction, and now the buyback. A pour fee in BULLIONS is a fifth, switched off at launch (mintFeeToken is zero until the coin trades). Nothing prints the coin.

Every upgrade by anyone raises total weight and dilutes everyone who sits still. The defence is to burn. That is the whole game.

---

9. Sunday jackpot

10% of the vault's inflow, drawn at the close, which puts the loudest minute of the week at the end of the busiest part of it.

Tickets are weighted by the GLD a bettor wagered during the week (counted once the total reaches 0.01 GLD); every 24K bar adds one flat ticket for its holder. A bar is not a way in: every ticket a bettor holds was bought with a wager, on the same terms for everyone, and the 21 kilobars add 21 flat tickets on top of a pool measured in GLD wagered. Contracts get no tickets; EIP-7702 delegated accounts are people and do.

The draw is commit-reveal-draw. At the bell the keeper commits keccak256(secret) with the scheduled close. After the close it reveals the secret, which freezes the week and arms a draw for the next block. Anyone may then call draw, which seeds from that block's hash: the keeper cannot see the outcome when it reveals, and cannot re-roll by waiting. If the keeper never reveals within 24 hours of the close, anyone may forfeit the week and its tickets carry into the next. A winner the GLD issuer has blocklisted is escrowed in the vault and pulls the prize later; the draw itself never blocks.

Chain note: block.prevrandao is a constant on Arbitrum-family chains, which is why the design does not use it.

---

10. Brokers

A holder of a 14K bar or better mints a referral link. A bettor arriving through it is bound on their first wager, permanently. 1% of every losing wager by a referred bettor accrues to the broker, paid from the rake, so the bettor's odds do not change. Self-referral is negative expected value: it saves 1% and pays 2% to the house.

The 14K test is applied once, at the moment a bettor is bound. After that the binding and the broker leg are permanent: referrerOf is never rewritten, and the broker goes on being paid whatever happens to the bar afterwards.

This is the one thing at the table a bar actually buys, and it is bought outside the trade. The bettor stakes the same, wins the same and loses the same whether their broker holds a kilobar or nobody brought them at all; the only difference is which of the three percentage points of rake goes where after the round is decided. Anyone may bet, and no bar is needed to do it. A bar is needed to be paid for bringing someone who does.

---

11. Where the gold goes

Rake and perp fees, in GLD
        |
        v
   FoundryVault ---- 80% bars, by weight, claimable any time
        |----------- 10% Sunday jackpot
        '----------- 10% operations

Coin trading fee, in GLD
        |
        v
   GldFeeSplitter -- 1/3 team wallet
        |----------- 1/3 CoinBuyback ---- buys BULLIONS on its own pool ---- burned
        |----------- 1/6 GoldDrop ------- claimed by coin holders every hour
        '----------- 1/6 FoundryVault --- 80 / 10 / 10 as above

Seized gold (10% of perp losses) ---- Dutch auction for BULLIONS ---- burned

Ratchet on the vault split. Seized lots start at 150% of the pool quote and decay to 80% over 24 hours; a relisted lot cannot start below its previous floor.

---

12. Security

• Four adversarial reviews were run over the contracts with a rule: no finding without a failing test that demonstrates it, no fix without the test passing. The reports are the four files in docs/audit/. Findings included a seeding router that let anyone remove the pool's liquidity, a poke bounty that could drain operations, a perp fill that could be chosen from before the order, a jackpot the keeper could grind, and a blocked winner that could freeze the draw. All fixed.
• 533 unit tests, 36 fork tests against Robinhood Chain, and a full dress rehearsal of contracts, keeper and web on a fork with the real GLD token. Counted with forge test --list on 10 September 2026.
• Every external transfer follows checks-effects-interactions behind a reentrancy guard. Claims are per user and pull-based.
• Owner powers are bounded: the vault split is a ratchet; the house pool cannot be withdrawn under open exposure; SessionDesk has no owner at all. Most perp parameters are capped in the contract, the open-interest cap at 100% of the pool, price impact at 1,000 bps, each fee at 500 bps, the seized share at 100%. Leverage is the exception: setLeverage only requires a non-zero base, so an owner can raise it as well as lower it, and the weekend regime uses the same call in the other direction.

Risks, said once:

1. GLD on chain is Robinhood's token with an issuer blocklist and a pause. Every gram in the system is subject to that.
2. Oracle liveness. Pushes are permissionless and every payload is signed by RedStone's or Pyth's signer set, so the keeper cannot fake a price, only delay one. Engines refuse stale prices and rounds refund when they cannot settle. The RedStone signer list is owner-rotatable behind a 2-day timelock, because the engines hold the oracle's address as immutable.
3. The house pool can lose. Open-interest caps, next-tick fills and price impact bound it; they do not remove it.
4. The coin's time-weighted price can be pushed. PoolPairQuote averages spot observations of the coin's GLD pool that anyone may record, at most one every 30 seconds, over 30 minutes; a moved price has to be held against arbitrage for a good part of that window to move the average, and a single block's spot counts for one observation. The quote falls back to the longest history it has, never below 4 minutes, and refuses to answer when the newest observation is older than 15 minutes.
5. Jurisdiction. The app blocks the United States, United Kingdom, Switzerland and Canada at the edge from day one.

---

13. Parameters at launch

The table is the source in contracts/src. The bar collection is the one part of the system already deployed, and its owner has tuned three of those numbers since. Read from Bullion.getParams() at 0x38c3619C9302dF61EB5De5134DCBfa3e875149d6 on 10 September 2026: the four upgrade steps are 0.0055, 0.011, 0.022 and 0.044 GLD-equivalent, not the 0.25 / 0.5 / 1 / 2 of the source defaults; the poke bounty is 0.0002 GLD, not 0.01; and refineFeeToken is 0 until the coin exists. pourLockBps is 0, maxUpgradeKarat is 18K and the deck is 388 / 194 / 116 / 58 / 21, all as stated above. Where the chain and the source disagree, the chain is what a holder actually pays. The engines are not deployed, so their rows are the source and nothing else.

---

14. Contracts

Deployed on Robinhood Chain (4663) on 2026-09-10.

Bullions is code, and the code is public. Nothing in this paper is financial advice.