Trust model
HoodStash is non-custodial protocol software. Contracts hold vault assets and enforce accounting rules.
An interface, indexer, keeper, or MCP server cannot replace chain state.
What the contracts enforce
- Vault shares represent activated depositor accounting.
- Pending deposits remain separate from active stock.
- Withdrawal shares move into escrow when requested.
- Every token balance belongs to a defined accounting bucket.
- Sold claims cannot exceed committed stock.
- Exercise cannot exceed the sold amount.
- Every exercise exchanges payment and stock in one transaction.
- A strike remains inside contract policy rails.
- A pause cannot transfer principal to an administrator.
- The protocol fee comes from premium, not principal.
- Value-moving functions update state before an external transfer and use reentrancy protection.
The protocol design gives the complete rules.
The chain is authoritative
Direct contract reads decide:
- balances;
- claims;
- current phase;
- auction state;
- price usability; and
- whether a transaction can succeed.
The indexer records contract events for history, transparency, and analytics. It can lag, restart, or replay.
The indexer database never authorizes a transaction.
Price safety
Settlement records a specific price round. That round must satisfy every configured price rule.
Settlement waits when:
- the answer is invalid;
- the price is stale;
- the round is incomplete;
- the submitted round is not the first eligible round after expiry;
- the sequencer is down;
- the sequencer recovery period is active; or
- the stock token reports a price pause.
The contract does not replace a missing price with an estimate.
Corporate actions
The stock token price can pause during a split, merger, or other corporate action.
The pause flag is an additional warning. Freshness remains mandatory.
Price-dependent operations resume only when the flag is false and the price is fresh.
Token units
The contracts read token and feed decimal values at runtime. They do not assume one fixed decimal count across every asset or chain.
Keeper boundary
The keeper calls routine, permissionless transitions.
Before a live transaction, the keeper:
- reads current chain state;
- checks phase and eligibility;
- checks price safety when required;
- simulates the transaction;
- uses a leader lock to prevent a second writer; and
- sends only when live intent is enabled.
The keeper has no exclusive settlement right.
A volatility report uses the published deterministic method. When input data is insufficient, the keeper uses the no-report call. It does not invent a value.
Administrative controls
Governance can change approved parameters through a delay.
The guardian can pause approved operations.
These controls can delay:
- deposits;
- auctions;
- settlement;
- exercise; and
- withdrawals.
They cannot use a pause function to take vault principal.
Contract strike limits continue to apply to governance.
Immutability and migration
The MVP contracts do not use an upgrade proxy.
A new contract version needs a new deployment. Users choose whether to move.
For a serious defect, the expected path is pause, permitted exit, new deployment, and opt-in migration.
Fee
The current premium fee is 12%.
- It applies to collected option premium.
- It does not take deposited stock.
- A zero-premium week has zero premium fee.
- Two percentage points fund the first-loss reserve until its target.
Configurable values can change through their contract controls. A user should read current state before a transaction.
First-loss reserve
The insurance pool is a limited first-loss reserve.
It:
- holds the dollar token;
- receives part of the premium fee;
- pays only a verified settlement shortfall;
- cannot pay more than its balance;
- limits one event to 30% of the pool; and
- requires the configured governance process.
The reserve does not guarantee a balance.
Exit paths
Pending deposit
The owner can cancel before activation.
The current app does not show this control yet.
Withdrawal request
The owner can cancel before the target weekly round locks. After processing, the owner pulls the recorded stock and dollar-token claim.
Emergency exit
After the contract's required pause or feed-halt delay, a share holder can redeem for its proportional asset buckets.
This path reads no price. It still respects fixed liabilities for settled claims.
An outside token issuer can stop its own token transfers. The protocol cannot override that issuer.
Risks that remain
Market and strategy risk
The stock can fall. Premium might not offset the loss.
A covered call can also miss gains above the strike.
Liquidity and timing risk
Deposits and withdrawals use queues. Active claims and unsafe price data can delay processing.
Contract risk
A defect can cause delay or loss. Public source and testing do not remove this risk.
Stock-token issuer risk
The issuer can pause, freeze, upgrade, or change the stock token. Transfer or redemption conditions can change outside HoodStash.
Dollar-token issuer risk
The issuer can pause or freeze the dollar token.
A freeze of the vault or reserve can stop required transfers. The protocol cannot force the issuer to clear it.
Price and network risk
The protocol depends on outside price data and network availability.
Fail-closed checks prevent an unsafe price from becoming settlement. A long outage can stop protocol operation.
Auction risk
An auction can have weak demand, partial fills, or no valid clearing result.
No sale means no auction premium.
Wallet and interface risk
A wallet can sign an unintended call. An interface can display old or incorrect data.
Read the decoded transaction and use contract state for money.
User checks
Before a deposit or bid:
- Confirm the network.
- Confirm contract addresses.
- Read the current phase and pause state.
- Read the current fee and strike rails.
- Read token decimal values.
- Simulate the transaction.
- Confirm token, amount, recipient, and approval target.
- Reject an unexpected unlimited approval.
Never share a private key or seed phrase with an operator, website, agent, or support contact.