How mTOMB works

One mTOMB targets one raw SPY token. Not a dollar, not the gas token, and not a basket: the thing the protocol tries to trade at par with is the tokenized S&P 500 that already exists on this chain, at 0x117cc213…2B3B4C0C.

“Raw” is doing real work in that sentence. SPY keeps a display multiplier that re-rates what a token represents after a split or a distribution, but it never moves balanceOf. The protocol reads only the raw balance, so a re-rating leaves pool reserves, farm accounting and redemption arithmetic untouched.

The peg is a target, not a promise. Nothing here mints mTOMB against deposited collateral. It holds the way every seigniorage design holds: by expanding supply when the market pays above par and contracting it when the market pays below, with a redemption floor underneath once the treasury has something to redeem against.

mTOMB is the peg token. Deliberately plain: no transfer tax, no pause, no blocklist, no upgrade path, and no owner-only route into a holder’s balance. The only privileged action is minting, and it belongs to the Treasury alone.

mSHARE is the claim on seigniorage. Supply is capped at 70,000 by a compile-time constant, so no call from any caller can raise it. 59,500 are emitted by the Cemetery over twelve months, 5,500 go to the DAO, and 5,000 vest linearly to the dev over the same twelve months through a contract with no clawback and no way to accelerate it.

mBOND is the debt token. It is sold when mTOMB trades under peg and redeemed for mTOMB once it trades above the ceiling. Minting and burning are the Treasury’s alone.

Once per epoch, anyone may close the books. The Treasury reads the time-weighted price of mTOMB in SPY and acts on it. Above the ceiling it mints and hands the expansion to the Boardroom; at or below the peg it opens a budget for bonds instead.

The price is a TWAP taken from the Uniswap V3 pool itself. There is no spot fallback on any path: a single-block price never reaches the Treasury, whatever the state of the oracle. If the window cannot be served, the call reverts rather than answering with something stale.

An expansion is skipped, and the epoch still advances, when any of these hold:

• the pool holds less SPY than the depth floor, because a shallow book is a cheap oracle;
• the instantaneous price sits further than the divergence bound from the average, which is the signature of someone pushing the pool into the epoch boundary;
• the pool cannot store enough observations to be an oracle at all, which also catches a pool quietly replaced by a shallower one;
• nobody has staked, so there is no one for the expansion to belong to.

Epochs also advance at most one per period of wall-clock time, never in a burst. A schedule check on its own lets a protocol that has fallen behind be caught up several epochs inside a single block, each one minting against the very same price.

Provide liquidity to the mTOMB/SPY pool, stake the receipt, earn mSHARE at a flat rate across twelve months. At launch there is exactly one pool, and it is the pair the peg lives in, so every unit of yield deepens the book the oracle reads.

The market is the canonical Uniswap V3 pool at 0.3% fee, not a venue of our own. That matters for a reason worth stating plainly: there is no Uniswap V2 on Robinhood Chain, and a Tomb fork normally needs one, because its farm stakes a V2 pair’s ERC-20. Shipping our own V2 would have worked and would have put the market somewhere no aggregator indexes.

Instead, liquidity goes through LpWrapper, which holds one full-range V3 position and issues a fungible receipt against it. Full-range V3 liquidity is arithmetically the same constant product as a V2 pair, so a depositor faces exactly the risk the original design assumes, with no rebalancing and no band to be walked out of. There is no function to move the range, so no privileged party can strand everyone’s liquidity off-market.

Trading fees are folded back into the position rather than held as a claim, so a share is worth more over time instead of carrying a separate entitlement. That is what lets the farm stake these shares without knowing anything about fees, and it means there is no accumulated pot for a depositor arriving later to take a slice of.

Stake mSHARE, receive the expansion in mTOMB. Every expansion is written into a snapshot, so a stake earns from the epochs that follow it and from no others. Arriving one block before an expansion earns nothing from the ones before.

Two lockups sit on top of that. Staking arms a withdraw lockup of 6 epochs and a reward lockup of 3, so buy, stake, claim and sell cannot be executed inside one epoch at all. Claiming does not re-arm the withdraw timer: a staker who collects should not be punished for it.

There is no recovery function. A contract holding everyone’s stake with a “rescue arbitrary token to arbitrary address” hatch does not have a rescue hatch, it has a withdrawal, so that function does not exist here.

When mTOMB trades under peg, mBOND can be bought with mTOMB at a discount proportional to how far under it is. The mTOMB paid in is burned, and that burn is the contraction. How much can be retired in a single epoch is capped, so a manipulated discount cannot be scaled up with more capital.

When mTOMB trades over the ceiling, mBOND is redeemed for mTOMB, with a premium bounded by the parameters below. Redemptions are paid strictly out of seigniorage the protocol actually saved, never by minting, so a manipulated ceiling cannot mint its own payout into existence. Both sides of the trade quote the price they acted on and revert if it moved.

Burn mTOMB, receive SPY one for one, minus a fee. The fee is at once the protocol’s revenue and the width of the band the peg can slip inside: the exit is always open, and it is never free.

It is dormant until the treasury has actually accumulated SPY, and dormancy is a fact about the balance held rather than a switch someone flips, so the page cannot show a redemption facility with nothing behind it. Today it holds 0 SPY.

A redemption burns exactly as much mTOMB as it removes from the reserve, so the coverage ratio is unchanged by any redemption of any size. Redeeming cannot dilute the holders who stay. A per-epoch ceiling turns a run into a queue, which also keeps the standing exposure to SPY’s issuer bounded and visible.

The PSM does not mint mTOMB for SPY. A two-sided module would cap the upside at one SPY and leave no seigniorage to distribute. It is a floor, not a peg.

Read from the chain, not restated. A documented parameter that has since been changed is worse than no documentation.

Epoch lengthAlso the oracle's averaging window

6 hours

Peg targetOne mTOMB, one raw SPY token

1.0000 SPY

Expansion ceilingAbove this, the Treasury mints

1.0100 SPY

Max expansion per epochOf circulating supply

3.00%

Max contraction per epochThe bond budget

3.00%

Max debt ratiomBOND supply over mTOMB supply

35.00%

DAO share of expansion

10.00%

Dev share of expansion

2.00%

Routed to the PSMZero while the book is thin

0.00%

Depth floorBelow this, no expansion

6 SPY

Spot/TWAP divergence bound

10.00%

Minimum observationsThe pool must be a real oracle first

60

Boardroom withdraw lockup

6 epochs

Boardroom reward lockup

3 epochs

PSM feeHard ceiling 5.00%

1.00%

mSHARE supply capA compile-time constant

70,000

Deployed on Robinhood Chain and verified. The pool, the position manager and the swap router are Uniswap’s own deployments, not ours.

mTOMBThe peg token

0x9fEB8B2A…bf98D1e0

mSHAREThe claim on seigniorage

0x47b4dE8E…3d982b92

mBONDThe debt token

0x5A2D81Ea…72C60315

TreasuryThe epoch clock, and the only minter

0x61653d4e…cD3feb97

BoardroommSHARE staking

0xFa2d282E…9987C455

CemeteryLP staking, pays mSHARE

0x1781B8aA…3Eb294Fd

LpWrapperERC-20 claim on the full-range position

0x2a399cb2…f9EfCcA4

OracleTWAP over the pool, stateless

0x9489F02C…4002A89f

PSMRedemption floor

0xf024d104…fb2A202C

VestingThe dev allocation, no clawback

0xe266D61E…9c7EA263

mTOMB/SPY poolUniswap V3, 0.3% fee

0x3f71b38e…d6120010

SPYThe peg target. Third-party, not ours

0x117cc213…2B3B4C0C

Stated plainly, because the rest of this page is only worth reading if this part is honest.