Contracts and addresses

Network

Addresses

Current deployment (current, V2): clears Robinhood Stock Tokens and Pons V2 launch curves through one router. Deployed from block 72,249,552. The four NoFomo contracts are source-verified on Sourcify with an exact match.

Legacy deployment (legacy): the first mainnet deployment, against Pons V3 pools. It is kept for history (the first real mainnet clears happened here) and is read-only in the product. Deployed at block 34,664,366.

Retired v1 contracts

The first Pons V2 curve deployment is retired: a critical issue was found in our internal review (finding F-01 on Security). It never held user funds (no clusters, no mandates, no ETH). NoFomo no longer indexes it or builds transactions for it. Deployed at block 35,811,920. Do not send anything to these addresses.

Third-party contracts the adapters read from. They are not NoFomo's and are listed for verification only.

How the pieces fit

BlockClearingV2

Clusters. openBlock(market, window, ceilingBps) creates one (window 10 s to 1 h, ceiling 10 to 2,000 bps), fixes the payout token and records a reference quote (what 0.001 ETH buys right now, fees included); it can join in the same call. join(id) escrows ETH (minimum 0.000001 ETH) and keeps the best quote seen; leave(id) refunds it before close.

After close, clear(id) is a permissionless crank: it asks the venue for maxEthForImpact, computes the fill ratio, takes the 10 bps fee and makes one buy. The fill is measured by balance and must price within the ceiling plus a 3% guard of the best quote seen while the cluster was open. If it doesn't, or the venue can't quote, clear reverts and can be retried; from 15 minutes after close a clear that still can't fill settles as a full refund. A clear that runs out of gas always reverts, so nobody can void a cluster by under-supplying gas (a stock clear on a USDG route uses about 2.6M gas).

claim(id) pays a wallet its tokens and refund; anyone can push a wallet's claim with claimFor(id, wallet) (proceeds only ever go to that wallet). If the token transfer fails (a paused stock or a blocked wallet), the ETH refund is still paid and the tokens are parked in owedTokens for claimTokens(id). Views: getBlock, previewClear, entitlementOf, minTokensFor. Fees accrue and are sent to the fixed fee recipient by withdrawFees().

MandateVaultV2

Mandates. arm(params) creates a mandate from one struct: originator, per-execution and daily caps, ceiling, expiry, and two scope fields: market (the only market it may fund, or zero for any market the router accepts) and maxSpotWad (skip it when pre-trade spot is above this, or zero for no cap). topUp adds ETH, revoke returns the whole balance instantly. The originator calls execute(market, ceilingBps, ids, minTokensOut) with up to 64 mandate ids in strictly increasing order; the vault sizes each one within its limits and scope, makes one buy, and transfers tokens to every participant at the same price. Lookups: mandatesOf(allocator), mandatesFor(originator), getMandate(id).

VenueRouter

The one IVenue both contracts pin (buy, sell, quoteBuy, quoteSell, spotPrice, maxEthForImpact, underlying). It has no admin. A market is a stock if its code is the canonical Robinhood Stock Token proxy, a Pons market if the Pons factory records exactly that curve for its token, and anything else reverts unknown market. kindOf(market) returns 1 (stock), 2 (Pons) or 0. The router re-measures every fill by balance and forwards any ETH a venue hands back.

StockV3Adapter

Robinhood Stock Tokens on their Uniswap-V3-style pools. The market handle is the stock token itself and underlying is the identity, so nothing can change what a cluster pays out. Quotes replicate the pool's swap loop exactly (tick by tick), and maxEthForImpact never admits more than the ceiling, including on two-hop routes through USDG. listedCount() and listedTokens(i) enumerate the 33 routes; tradeBlocker(token) says why a stock can't trade right now (paused, corporate action pending when a multiplier change takes effect within 2 hours, or no route); sharesPerToken(token) is the ERC-8056 multiplier (shares = raw tokens x multiplier; everything onchain is in raw tokens). The owner has renounced ownership, so the route table can no longer change.

PonsV2CurveAdapter

Pons V2 bonding curves. Its market handle is the curve itself, not the token. It measures tokens received by balance difference and refuses graduated or non-ETH curves. In V2 it is only reachable through the router, which first checks the curve against the Pons factory.

Events

Everything the API and the app show is derived from these events and direct contract reads. You can rebuild it from the chain alone.

What is trusted

• No admin keys, no pause switch, no upgrade proxy on the NoFomo contracts. Fee rate, guard and limits are constants.
• Escrow leaves the contracts only through a clearing (into the venue), a claim, a leave or a revoke.
• The venues themselves: stock pools and Pons curves are third-party code. The adapters and the router are written to distrust them where they can (balance measurement, the price guard).
• The stock token issuer: Robinhood Stock Tokens are upgradeable, and the issuer can pause them, block wallets and burn tokens. That is outside NoFomo's control; see the risk disclosure.
• The fee recipient address is fixed at deployment and only ever receives the 10 bps fee.