Docs
A tokenized share is only worth what the underlying share is worth. Everything below exists to keep the pool honest about that — and to stop trading when it cannot be.
Rivex is a decentralised exchange for tokenized equities on Robinhood Chain. Each market is a pool holding a stock token and USDG, the chain’s dollar, and you trade against that pool rather than against another person.
What makes it different from an ordinary pool is that it is anchored: it knows what the share is actually worth, because a Chainlink price feed tells it, and it refuses trades that would take it too far from that.
Every pool has a tolerance band around the oracle price — currently 1%. Trades inside the band go through normally. A trade that would push the pool further outside the band is rejected.
The check happens after the trade is calculated, not before, and that distinction matters. If a pool has drifted, the thing that repairs it is somebody arbitraging it back toward the oracle. So the rule is not “must end in band” but “must end in band, or closer to the oracle than it started”. Corrective trades are always allowed; only trades that make the gap worse are refused.
The band cannot be set tighter than 0.5%, because the feeds themselves only re-post when the price moves half a percent. A tighter band would be measuring the oracle’s own lag rather than any real drift.
Rivex is the rare on-chain venue that closes. Trading follows the US equity session — 09:30 to 16:00 New York, Monday to Friday — and that calendar, daylight saving included, is computed inside the contract rather than posted by anyone.
The reason is unglamorous. A stock feed does not switch off at the closing bell; it keeps answering with the last traded price. Over a weekend the world moves and the pool does not, so anyone can buy it out at Friday’s price and sell into Monday’s open. The people who lose that money are the liquidity providers.
Holidays follow no arithmetic rule, so there is a second, stronger test: a pool will not trade unless its oracle has actually updated since today’s opening bell. On a holiday it has not, whatever the calendar says. That needs no maintenance and cannot be forgotten.
Every market is always in one of four states, readable on-chain at any time.
Every trade pays 0.05%. Liquidity providers keep three quarters of that. The remaining quarter is the protocol’s, and it is split three ways on-chain.
Nobody has to be trusted to move that money. Sweeping fees out of a pool and splitting them is a public function — anyone can call it, and it can only send funds to those three destinations.
Protocol-owned liquidity is the bucket that compounds. Because it sits in the pools as an ordinary liquidity provider, it also earns the LP three-quarters — which is how the protocol’s income grows past its own 25% share.
Stake the protocol token and you receive a share of trading fees, paid in the fee tokens themselves rather than in freshly minted supply. Nothing is minted to pay you. If nobody trades, nobody earns.
Not every market pays stakers. The reward list is capped at eight tokens, because claiming walks all of them and an unbounded list would make claiming unaffordable. The venue lists more markets than that, so the fees from the ones beyond the cap go to the treasury instead. The staking page shows which tokens you are actually paid in, read from the contract.
Rewards stream over a week rather than arriving in a lump. That is a safety property, not a preference: with instant distribution, somebody could stake, trigger the fee collection, claim and unstake in a single transaction, taking a share of fees that built up over days without ever carrying any risk. Streaming means being staked for one block earns one block’s worth.
Unstaking is immediate and there is no lock-up. There is also an emergency exit that returns your stake while abandoning unclaimed rewards, so your principal can never be trapped by a misbehaving reward token.
Pools use the Liquidity Book model: instead of one curve, the price range is cut into discrete bins, and you choose which bins your liquidity sits in. Liquidity concentrated near the current price earns far more of the fees than the same capital spread thinly.
The trade-off is the ordinary one for any market maker. If the share price moves a long way, you end up holding more of whichever side fell — the same exposure you would have from quoting a two-sided market anywhere else.
What you do not carry here is the weekend. An ordinary stock pool keeps quoting Friday’s close straight into Monday’s news, and the difference is taken out of the providers by whoever arbitrages it. These pools refuse that trade, which is the single biggest reason to provide liquidity here rather than somewhere else.
Choosing bins is the hard part, and you do not have to do it. A vault holds the position for you and gives you one ordinary token instead. The section below covers what that changes and what it does not.
Supplying liquidity to a Liquidity Book pool means choosing a bin range and ending up with a position spread across dozens of bins — an ERC-1155 balance per bin, not one asset, not transferable as a unit. A vault holds that position for you and issues an ordinary ERC-20 against it.
Nothing is harvested. Liquidity Book accrues swap fees into the bin itself, so the same bin balance is simply worth more later. Your share grows with the position. There is no harvester to trust, no reward schedule to fund, and no moment where someone has to remember to call something.
The vault takes no fee. The protocol already earns its capped share of every swap the vault’s liquidity facilitates, split on-chain between stakers, protocol-owned liquidity and the treasury. Charging a second fee for supplying that liquidity would be taking twice for the same act.
Depositing is gated; leaving is not. A deposit has to be priced, and a price can be manipulated — so a deposit is refused while the pool sits more than 0.25% from its oracle, which in practice means deposits are open during market hours. A redemption is priced by nobody: it burns exactly your fraction of every bin and hands you what comes out. No anchor check, no pause, no owner, no condition of any kind.
A vault has no owner. Not a multisig, not a timelock, nobody. The only privileged-looking function is rebalance, which moves the position back around the market once it has drifted out of range, and anyone may call it.
What a vault does not remove is the ordinary risk of providing liquidity. If the price moves, you end up holding more of whichever asset fell — the same arithmetic as supplying the pool directly. The vault saves you the bin management, not the exposure.
Most protocols describe their admin powers vaguely, or not at all. Here is the whole list, because a promise you can check is worth more than one you have to take on faith. Every row below is a function you can read in the deployed contracts.
Where fee revenue is sent, what code a future pool runs, and listing a new stock. The multisig proposes; the chain publishes the change and when it lands; anyone who dislikes it has two days to withdraw first.
The trading calendar, the tolerance band within its hard-coded limits, restarting a paused market, and the staking reward list. Judgement calls that should be deliberate but must not wait two days.
The vaults. A LiquidityShares contract has no owner at all: no pause, no fee setter, no upgrade, no rescue. Rebalancing is public. This is the strongest guarantee on the page and it is the one that needed the least work, because it is an absence rather than a mechanism.
One function: stop a market. It cannot restart one, cannot touch the band or the calendar, cannot move a token, and cannot pass its own role on. It is allowed to be a hot key precisely because that is all it is.
Stop you withdrawing. The oracle hook is only ever called on a swap. It is not called when you remove liquidity, and the contract refuses to be connected to that path at all — a market whose hook was wired to a withdrawal cannot be created. A paused market, a dead oracle, a closed session: you can still take your tokens out of every one of them.
Take your money. No admin function transfers anyone’s balance. There is no withdrawal path out of the fee splitter other than the published split, and none at all out of protocol-owned liquidity — that vault can put money into pools and never take it out, including for us.
Mint the token. There is no mint function. The supply was fixed at deployment.
Raise the protocol’s cut. Liquidity providers keep 75% of every fee. The 25% ceiling is compiled into the audited Liquidity Book code, not a setting.
Widen the band without limit. The tolerance band cannot exceed 5%, and the staleness limit cannot exceed seven days. Both ceilings are constants; the owner picks a number inside a range the code will not let them leave.
Two honest caveats. Until the multisig is live these roles are all one key, and this page will say so until that changes. And a timelock protects you against a change you can see coming — it is not a defence against a contract bug, which is what an audit is for and this has not had one.
The contracts are unaudited. They have an extensive test suite, including adversarial tests written as working exploits, and three real vulnerabilities were found and fixed that way. That is not the same as a professional audit.
The oracle is a dependency. If Chainlink stops publishing, pools stop trading. That is the intended behaviour — a pool with no live price should not be quoting one — but it does mean an oracle outage halts the venue.
Administrative control exists. Set out in full above — who holds which power, how fast they can use it, and what none of them can reach.
Tokenized equities are securities. They are not offered in the United States, and Rivex does not offer them either — it is a venue for tokens that already exist on Robinhood Chain.
