The MerryVault protocol.

MerryVault is a bond-backed liquidity infrastructure for on-chain markets, deployed natively on Robinhood Chain. It replaces mercenary emissions with a capital-efficient, insurance-first design where every unit of routed depth is collateralised by the project consuming it.

Three roles interact with the protocol:

• Liquidity Providers (LPs) deposit USDC or ETH into the Core Liquidity Vault (CLV) and mint rLP, a receipt token that appreciates as strategies earn.
• Projects post a bond (native token + stables) in exchange for durable depth on their trading pair, priced against real depth SLAs.
• Governance sets exposure caps, bond ratios, epoch windows and insurance-fund routing under a 48-hour timelock.

Yield comes from real economic activity — trading fees, bond premiums and strategy PnL — never from printed tokens. When depth SLAs break, the bond is slashed and proceeds flow first to LPs, then to the insurance fund.

Traditional on-chain liquidity is rented: projects emit their own tokens to attract farmers, farmers dump those tokens, depth evaporates the moment emissions stop. The model is expensive, cyclical and structurally unaligned.

MerryVault flips the incentive:

• Projects pay only for the depth they actually consume — a variable fee tied to volume and SLA.
• LPs earn from that fee plus strategy PnL, protected by a bond that is slashed before their principal is touched.
• Markets get depth that stays thick under stress, because breaking the SLA is more expensive than honouring it.

Liquidity becomes a productive, insured asset class rather than a cost center.

The CLV is the single point of entry for LPs. It holds pooled base assets, mints rLP against deposits, tracks accrued yield and enforces cooldown and epoch commitments.

Modes:

• Flexible — deposits are freely withdrawable after a 24-hour cooldown. Best for LPs prioritising optionality.
• Committed — capital is locked for 1–365 days. Longer commitments receive proportional yield boosts and priority in bond-premium distribution.

rLP mechanics. rLP is an ERC-20 receipt token minted against the vault's share price at deposit. As strategies earn, totalAssets grows while totalSupply stays flat, so rLP appreciates against the underlying. It is fully composable — hold it, use it as collateral, or pair it in secondary markets.

Inflation protection. The vault is seeded with dead shares at deployment to close the classic first-depositor share-price manipulation vector identified during the internal v1 audit.

Deposit. The LP calls deposit(amount, mode, commitDays) on the CLV. Base assets are transferred in, rLP is minted at the current share price, and the LP's mode / commitment record is stored on-chain. The app runs a confirmation dialog that simulates the call and estimates gas before broadcasting.

Withdraw — Flexible. The LP first calls startCooldown(shares), which escrows the specified rLP amount and records readyAt = block.timestamp + cooldownPeriod. Once readyAt passes, withdraw() burns the escrowed shares and returns base assets at the then-current share price. cancelCooldown() releases escrow back to the LP wallet without withdrawing.

Withdraw — Committed. After commitLockUntil, the LP can switch to Flexible or withdraw through the same cooldown path. Early exits are impossible by contract, not by convention.

All four actions surface live on-chain state in the app: current cooldown start, remaining duration, exact withdrawable timestamp, available withdraw amount, and a persistent transaction history with explorer links.

Every project consuming MerryVault liquidity posts a bond in the Bond Vault contract. Bonds are denominated in a mix of the project's native token and stablecoins, sized against the notional depth requested and the epoch length.

Bond sizing (indicative):

bondSize = notionalDepth × riskFactor × epochLengthFactor
riskFactor        ∈ [0.05, 0.35]   // token volatility class
epochLengthFactor ∈ [1.0, 2.0]    // 30d → 180d

Slashing lifecycle. When the Risk Engine detects a persistent SLA breach:

1. A slash proposal is emitted on-chain with the breach evidence.
2. A 3-day delay begins, allowing the project to cure or governance to veto.
3. If the breach persists, the bond is executed: proceeds first top up rLP share price, remainder flows to the insurance fund.

Slashing is deterministic. The Bond Vault owner cannot slash arbitrarily — the delay window and evidence commit are enforced by the contract itself, closing the rug-risk finding from the v1 self-audit.

The LAE is the router. It observes the state of every whitelisted Strategy Module — utilisation, exposure, realised PnL, SLA compliance — and computes a target allocation vector each epoch.

Constraints enforced by the contract:

• No single strategy can exceed its governance-set exposure cap.
• No single rebalance tick can rotate more than ΔMax of vault TVL (default 10%).
• A strategy must maintain SLA for a rolling window before its cap can be increased.
• Underperforming strategies are drained on a schedule, not seized.

All allocations are logged on-chain; anyone can reproduce the allocation vector from public state.

Strategy Modules are the deployment surface. Each module wraps a specific venue or strategy family: concentrated AMM pairs, orderbook market-making, perp funding capture, delta-neutral basis, and stable-lending backstops.

Every module implements the same interface — deposit(), withdraw(), report(), pause(). Fund flow is one-way through the LAE: modules cannot pull from the vault; the LAE pushes based on policy.

New modules are added by whitelist, never by upgrading existing logic. Existing modules are immutable once deployed.

The Risk Engine is a passive, always-on contract. It ingests price and depth data from redundant oracles and evaluates:

• Oracle health — staleness, divergence between sources, TWAP anomalies.
• Depth SLA compliance — realised depth at ±1% and ±2% versus the committed target.
• Exposure drift — cumulative exposure to any single asset, module or venue.
• Circuit-breaker triggers — depth collapse, oracle failure, sudden withdrawal surge.

A single breach can freeze allocations at the module level. Multiple simultaneous breaches trigger a global pause that only governance can lift after review.

Time on MerryVault moves in epochs — fixed windows that snapshot vault accounting, roll strategy allocations, and unlock any expiring commitments.

Standard epoch lengths: 30, 90 and 180 days. A committed LP selects an epoch at deposit; the choice sets their lock, boost tier and priority in bond-premium distribution.

At epoch close the manager runs a deterministic sequence: (1) settle strategies, (2) update rLP share price, (3) release expiring commitments to Flexible mode, (4) advance the LAE to the new allocation vector.

Governance controls parameters, not code. Every mutating action passes through a 48-hour timelock, and the Governance contract is self-timelocked — it cannot bypass its own delay.

What governance can change:

• Exposure caps, bond ratios, epoch lengths, cooldown periods.
• Insurance-fund routing.
• Strategy whitelist additions and pauses.
• Risk Engine thresholds.

What governance cannot do: mint rLP, seize LP funds, upgrade core contracts, or override an active slash without evidence. Core contracts use Ownable2Step so no ownership transfer completes without explicit acceptance.

MerryVault has no native emission token. rLP is a share, not a reward. Fees are charged in the vault's base asset and flow as follows:

bond premium + strategy PnL + trading fees
   → 92%   LPs (rLP price appreciation)
   →  6%   Insurance fund
   →  2%   Protocol treasury (audits, ops)

The insurance fund is a segregated reserve that absorbs residual losses after bond slashes are exhausted. It is capitalised over time from the 6% cut and is never touched for operational spend.

The current deployment is the v2 audited build. The following findings were addressed before mainnet activation:

• Inflation attack — mitigated with a seed-share deposit at deployment.
• Slashing rug risk — replaced with a 3-day slash proposal + veto window.
• Accounting-only LAE — replaced with real fund flow between CLV and Strategy Modules.
• Cooldown escrow — rLP is escrowed by the contract during cooldown, not just marked.
• Ownership — Ownable2Step, ReentrancyGuard and self-timelocked Governance across the whole system.

All source is verified on the Robinhood Chain explorer. Contract ABIs ship with the app under src/contracts/.

MerryVault is live on Robinhood Chain (chain id 4663).

Wallet connection uses RainbowKit + wagmi with native Robinhood Chain support. On first connect, MerryVault issues a Sign-In with Ethereum (SIWE) challenge — a signed message proving control of the address without revealing keys.

The signed statement, timestamp and address are stored server-side. There is no email, no password, and no custody of user funds at any point.

A project onboards to MerryVault in five steps:

1. Submit the pair, target depth and epoch preference through the Bond Desk.
2. Risk review — token volatility class, oracle setup, distribution profile.
3. Bond terms proposed and approved by the project's governance.
4. Bond posted on-chain; LAE allocates matching vault depth on epoch start.
5. Weekly SLA reports on-chain; premium settled at epoch close.

Do LPs bear impermanent loss?

Strategy modules are designed to hedge or absorb IL structurally, and bond premiums are sized to compensate for expected residual IL. If a module realises losses beyond that envelope, the bond and then the insurance fund absorb the shortfall before LP principal.

Can I lose my deposit?

The design goal is that LP principal is the last-loss tranche. Realistic worst cases — simultaneous SLA break on multiple large bonds combined with insurance fund exhaustion — are non-zero. Committed mode does not change this ordering.

Why Robinhood Chain?

Native settlement on the same chain as the venues MerryVault provides depth for means one execution surface, one gas token, and no bridge risk between the vault and the strategies it funds.

Is the code upgradeable?

Core contracts (CLV, Bond Vault, Risk Engine, Governance, EpochManager) are non-upgradeable. New strategies are added by whitelist. Governance can pause, but cannot mutate logic in place.

What happens if the app goes offline?

MerryVault is contracts, not a frontend. Every deposit, cooldown and withdraw can be executed directly against the CLV using its ABI. The app is a convenience layer.

rLP

Receipt token minted by the Core Liquidity Vault. Represents your share of vault assets and accrued yield.

Bond Vault

Contract holding project bonds. Enforces the 3-day slash delay and routes slashed proceeds to LPs and the insurance fund.

Bond

Collateral posted by a project to secure a liquidity commitment. Slashed on SLA violation.

Slashing

Deterministic execution of a bond after a persistent SLA breach and the 3-day delay window.

Epoch Manager

Contract that snapshots vault accounting, rolls strategy allocations, and unlocks expiring commitments at fixed intervals.

Epoch

A fixed commitment window (30, 90 or 180 days) during which committed liquidity is locked.

SLA

Service-level agreement — the enforceable depth target a project commits to maintaining.

LAE

Liquidity Allocation Engine. Routes vault capital across strategy modules under bounded rebalance.

Core Liquidity Vault

Primary contract holding LP capital and issuing rLP. Enforces cooldown and epoch commitments.

CLV

Core Liquidity Vault. The primary contract holding LP capital and issuing rLP.

ΔMax

The maximum share of TVL that can be rotated in a single rebalance tick.

Insurance fund

Segregated reserve absorbing residual losses after bond slashes.

Cooldown

24-hour on-chain waiting period between startCooldown and withdraw.

SIWE

Sign-In with Ethereum — signed-message authentication used at first connect.

Risk Engine

Passive on-chain contract that ingests oracle data and evaluates SLA compliance, exposure drift, and circuit-breaker triggers.

Strategy Module

Immutable wrapper around a specific venue or strategy. Receives allocations from the LAE and reports back.

Robinhood Chain

The EVM chain (id 4663) where MerryVault contracts are deployed.