Architecture, security and contracts

• BasketFactory: deploys vaults and owns the NavOracle. Register a constituent (token + its pool price feed) here, then create baskets from registered constituents only. Assets are pinned by address, never resolved by symbol.
• BasketVault: the ERC-20 index token and the custody core. Only in-kind mint and redeem live here; all swapping is peripheral, so the contract holding assets never touches a DEX.
• ZapperV2 and the Router form the swap periphery: USDG ↔ basket through pinned pools, with per-leg token checks and a full dust sweep back to you.
• NavOracle, PoolPriceFeeds and PoolPrices provide pool-derived pricing: spot from each asset’s deepest pool, cross-checked against a second venue; PoolPrices gives the reference for order triggers and floors (10-minute pool averages, or the live pool price for a v4-only token), read through the PriceRouter.
• LimitEscrow, SellEscrowV4 and SpendPermitManagerV4: ownerless order contracts for limit buys, exits and recurring / TWAP schedules. Anyone may execute; floors are enforced on-chain.
• IntentEscrow: settlement for cross-chain buys from a wallet.
• AccountFactory and BsktsSessionModule: your Safe account and its browser-only trading keys.
• IndexVault and IndexZapper: BSKTS, the basket of baskets.
• BasketSwapRouter: switches directly between baskets.

Off-chain, a relayer submits your account’s signed transactions and pays their gas, and a keeper indexes orders and fills triggered ones (as anyone may). Neither can move your funds.

• Solvency by rounding: mint rounds amounts up, redeem rounds down; custody stays proportional, so redeeming the whole supply can never exceed the vault’s balances.
• Unconditional exit: redeem never reads the oracle and has no pause. Holders can always leave in kind.
• Pool prices only: no external price feed anywhere; every price is read from the asset’s own pools, cross-checked, and orders trigger on a 10-minute pool average no single transaction can move (a v4-only token, which has no average to read, is taken at its live pool price).
• Your account, your keys: only your wallet can withdraw from your account. Session keys can only trade inside it, within expiry, slippage and daily caps; the relayer can only submit what you signed.
• Ownerless order contracts: the escrows and schedule manager have no admin, no pause and no upgrade path. Anyone may fill, but every fill is held to a floor you agreed to, priced on-chain rather than by the route the filler chose.
• Segregated liability: a fill can take exactly one order’s escrowed amount; no path nets one order against another.
• Inflation-attack floor: the first mint burns a small amount of dead shares, neutralizing the classic first-depositor share-price attack.
• Address-pinned constituents: because impersonator tokens share real symbols and names on-chain, baskets reference every asset by address only.

Live on Robinhood Chain (id 4663). Tap any address to open it in the block explorer. Every contract below is exact-match verified on Sourcify: its deployed bytecode matches the bskts source exactly, metadata hash included. Check any address yourself at repo.sourcify.dev/4663/<address>. The Robinhood Chain explorer attaches source by bytecode similarity and may show an unrelated contract, so Sourcify is the authoritative record.

Core

Orders

Accounts

Basket vaults

Earlier versions (read-only: existing orders can still be cancelled)