AN NFT THAT POWERS A MINI HEDGE FUND.

01The non-fungible agent

Most NFTs do nothing after the mint. Most on-chain vaults collect a reward drop and sit on it. A non-fungible agent does neither, and the claim is narrow enough to be tested: each token owns a wallet, that wallet makes markets in real tokenized stocks, and a bot runs it under rules written on chain rather than in a terms-of-service page. The holder can take everything out at any moment, and nobody else can take anything out at all.

Autopilot for when you sleep.
An institutional terminal for when you want the wheel.

That is the whole product. The machinery of a trading desk is not new; what is new is the size it has been cut down to. One person can own this one, sell it, pause it or take the wheel from a phone, without a manager, a minimum or a redemption window. The collection is capped at 444 tokens, which is the cap on how many of these can ever exist.

Everything below is either enforced by a deployed contract or it is not claimed. Where a mechanism exists in source but is not yet deployed, the text says so.

02The balance sheet

The balance sheet is not metadata, and it is not a promise kept in somebody's database. It is a wallet. Every token gets an ERC-6551 token-bound account at mint, at an address derived deterministically from the token id, so it can be computed before the mint happens and can never be reassigned afterwards.

The vault has no private key of its own. Its owner is not a stored field that somebody has to remember to update; it is read live as ownerOf(tokenId). That single detail is what makes the fund portable: when the token is sold, the new holder commands the wallet in the same block, with no migration step, no signature, and nothing an operator could forget to do.

A second key, the agent key, is installed at mint. It may call a short, fixed list of functions on the vault and nothing else: place liquidity inside the guard, pull liquidity back to the vault, and swap inside the guard. It cannot withdraw, cannot approve, cannot transfer, and cannot call arbitrary contracts.

One consequence is worth stating early, because it is unusual for a collectible: the book is public before the sale. Anyone can read what a given agent holds, priced by the same oracles the market uses, straight from chain or from the token's own metadata. What a buyer is paying for is legible in advance.

03The guardrails

Own the wallet. The agent only drives. 12 guardrails live inside the account itself, and every bot action, a swap or a liquidity move, passes all of them before anything happens. The list is short on purpose: each item is a specific attack it exists to defeat.

Asset allowlist

The strategy's own list. A token that is not on it cannot be bought or sold by the bot, in either direction.

Canonical route

The pool is pinned exactly: currencies, fee, tick spacing and hooks. A compromised key cannot route through a thin pool of its own and keep the difference.

Per-trade cap

Notional priced from the oracle at execution, not from the pool. A trade over the cap reverts.

Daily cap

A rolling window the account accrues into. It cannot be reset by the bot.

Oracle slippage band

The minimum output must be realistic against the Chainlink price for the pair. This is what makes sandwiching unprofitable rather than merely discouraged.

Cooldown

A minimum interval between the bot's trades. The holder's own trades are not subject to it.

Staleness

A feed older than the strategy's limit stops trading. This is why the desk stands down when the US market is closed.

Band width

Liquidity bands are bounded in ticks, per pair, in the LP policy registry. A band too tight to be safe or too wide to be honest reverts.

Oracle centering

Liquidity may only be ADDED while the pool trades within a configured distance of the Chainlink price. A pool that has run away from its feed refuses new exposure in the contract itself.

Unconditional exit

Withdrawing liquidity back to the vault ignores every other brake. No pause, no dead oracle, no breaker can lock that door, and a withdrawal that would owe the pool anything reverts.

Pause

Holder only, instant. The bot is locked out; the holder is not.

Global breaker

A guardian can halt every agent at once. It can stop, but it cannot restart. Restarting waits on the registry's owner: today the deploy key, a timelock once the pending handover completes (section 09).

Approvals are blocked inside the vault's generic call path as well, so a seller cannot pre-approve a wallet of their own before listing and drain the vault after the sale closes.

None of these are policies. A policy is something an operator can change their mind about; these are conditions of the transaction. A trade that fails one is not logged and reviewed later. It reverts.

04The desk

Every token runs the same machine: the Fee Harvester, an algorithmic market maker. On an AMM chain every swap pays the pool a fee, and the fee belongs to whoever holds the liquidity. Measured on 4663, retail order flow loses about 33 basis points per trade against the oracle mid, and liquidity providers kept 77% of gross fees after arbitrage losses over the chain’s full history. The agent takes that side of the counter: it parks the vault as concentrated liquidity in the deepest stock pools, centered on the Chainlink price, re-centers as the market walks, and collects.

It does not guess direction.
It rents inventory to everyone who does.

That trade is short volatility and long flow, so the brakes are the strategy, not a footnote to it: no oracle means no quoting, a fast feed move empties every pool, a pool drifting off the feed refuses new exposure in the contract itself, and a drawdown fuse parks everything until a human looks. Withdrawing back to cash is the one action nothing can block.

Copilot. 8 pinned strategies exist alongside it, one per allowlisted asset plus cash. Each is a real policy row in the registry, in an id range kept separate from the automatic set so the two can never collide. Pinning is how a holder says “hold this and stop working” without pausing the agent: the harvester reads the token's strategy every pass and stands down on any vault that is not running its own. A second desk serves the pinned vaults instead, on this same collection and signing with the same key, because a vault has exactly one agent signer: its whole job is to move the vault into the asset that was pinned and then sit still, under the same guard as every other trade. What has not reached this collection yet is the reward pipeline that funds vaults on their own; that still belongs to the rotation-era collection.

Autopilot and copilot are one switch apart, and the switch belongs to the holder. A holder who wants their own hands on the wheel trades the vault directly from the terminal, at the same pools the desk uses, with the floor priced off the same oracle.

05The income

One line carries this income statement, and it is not a token emission or a rebate. The operating income is the pool fee: every swap that crosses the vault's liquidity band pays the pool's fee tier, and that fee accrues to the liquidity, which is the vault's capital. It is the same bid-ask income a market maker earns anywhere, measured on this chain in section 04.

The capital arrives two ways. The simplest is direct: the holder sends USDG to their vault's address and the agent puts it to work, with no deposit function, no approval and no intermediary. The engine is the creator fees of a coin, a pipeline deployed and proven end to end on the legacy collection, where the path from a fee to working capital has no human step in the middle:

1. Fees land in the Treasury as native ETH. The Treasury has no destination parameter anywhere in it.
2. Flush converts the balance to a stablecoin through the canonical pool, with a floor computed off the ETH rate, and deposits it into the distributor. An operator key chooses only when and at what floor; it cannot choose where.
3. Accrual happens per token id, not per address, using a scaled accumulator with checkpoints. There is no holder list and no snapshot to game, and unclaimed rewards travel with the token when it is sold.
4. Claim is permissionless and pays into accountOf(tokenId) only. Anyone may trigger a claim for anyone; the money cannot land anywhere else.
5. The desk puts it to work on its next pass, under the guard above.

Tokens minted after a deposit do not inherit it. The distributor binary-searches the supply checkpoints so a new agent starts from the accumulator value at its own mint, which means minting late cannot dilute the people who were there first, and cannot enrich the newcomer either.

One thing is source, not yet deployment, and this paper marks such things: the collection currently on sale is not wired to this pipeline yet. Its distributor ships with the coin launch; until then its vaults are funded directly, and everything else on this page applies to them in full.

06The execution rail

Liquidity goes through the Uniswap v4 core directly. The vault implements the core's unlock/callback protocol itself: it adds or removes liquidity on the canonical pool, settles both legs in the same transaction, and owns the position at its own address with no position NFT and no periphery contract in the path. That matters on this chain specifically, because the periphery is modified (below) while every probe of the core behaved canonically.

Swaps, the bootstrap leg that turns fresh cash into inventory, route through the chain's UniversalRouter into the same pools. Two details matter in practice. The router on this chain vendors a modified v4-periphery whose swap struct carries an extra field; encoding without it makes the router misread the calldata and revert with no reason string. And approvals are ephemeral: the vault approves Permit2 for exactly the trade amount, grants the router a short-lived allowance, then revokes both in the same transaction, so no open allowance survives a trade.

Two rails exist for swaps, both under the same floor. The default takes the canonical pool pinned in the registry. The second is an allowlisted aggregator (1inch), for routes the canonical pool cannot serve; the guard does not trust its routing, it checks the result. The vault must receive at least the oracle-implied minimum or the trade reverts, and the allowance is revoked in the same transaction. The harvester's own bootstrap swaps use the canonical rail.

07Portability

Sell the token,
sell the whole fund.

The holder can withdraw any asset to any address at any time, pause the bot, or rotate the agent key to one of their own. None of these require permission, and none can be blocked by the operator or by a paused bot: pausing stops the agent, not the owner.

Selling is the interesting case. Because the vault's owner is read from ownerOf, the wallet, its stock holdings, its accrued fees and its strategy transfer in the same transaction as the token. The transfer is atomic, so the instant the sale lands the buyer commands the vault, and no window exists afterwards in which the seller still does. What atomicity cannot prevent is a seller emptying the vault while a listing is live, so a buyer should read the vault first: the token's metadata and the dashboard show its live contents. An escrow that locks the vault for the length of a listing is deployed for the legacy collection and pending for this one. Marketplace royalties are ERC-2981, on chain; on the collection currently on sale no royalty is set yet, and turning one on is an owner transaction, as visible as everything else here.

08Operations

The processes run off chain, and none of them holds custody. The harvester is the desk: every few minutes it reads the pools, the feeds and each vault's book, re-centers bands that price has walked away from, collects fees on a cadence, and flees to cash on the storm brakes, whether that is a fast feed move, a stale oracle, a pool off its feed or a drawdown past the fuse. What it cannot do is exceed the guard: every one of those moves executes inside the contract's own limits. It also stands down, per vault, the moment a holder switches their token to another strategy, because the vault is theirs and not the desk's. The paymaster flushes the Treasury on a fixed cadence and claims each agent's share into its own vault, paying the gas as a service. Today that serves the legacy fleet; the collection on sale joins when the coin launch wires its distributor.

A per-vault drawdown fuse empties every pool and stops new exposure until a human looks, and a kill-switch file stops a process outright. Neither can move funds. The worst a compromised operator key can do is quote badly inside the guard, or stop working.

09Risks

“Fund” is a shape, not a legal form. There is no pooled vehicle, no manager, no LP agreement and no offering. Each vault is a single wallet its owner alone controls, and the words fund, desk and portfolio in this paper describe how the thing behaves, not what it is in law. Nothing here is financial advice or an invitation to invest.

These are debt instruments, not equity. Tokenized stocks on this chain do not carry shareholder rights and are not available to US, UK, CH or CA persons.

The bot can be wrong. On-chain caps bound the size of a mistake; they do not prevent it. Fee income depends on the chain’s trading volume, and a market-making book loses on violent gaps faster than any brake can react. Measured on live chain data over a finite window. Past performance is not indicative of future results.

Liquidity and oracles are real constraints. Pool depth limits the size that can trade without damage, pool fees are charged before any slippage band applies, and when a feed goes stale the agent stops rather than guessing. Smart contracts carry risk regardless of review.

Issuer and governance powers exist. The tokenized stocks carry issuer controls, pause, mint and administrative burn, held by their issuer and not by this protocol. And the protocol's own governance is young: the registry's owner is the deploy key until the pending timelock handover completes. Both are stated here because this paper promises only what is true today.

10Addresses

Chain 4663. Every claim above can be checked against these.

Own the wallet. The bot only drives.