Architecture

Pool economics must react to real-world data, but Solidity cannot make HTTP requests and swaps must stay cheap. So the system is a pipeline that pushes data toward the chain and collapses it into one cached value the hook reads in constant time.

The pipeline

market data ─► ingestor ─► publisher ─┐   (fundamentals only)
Chainlink equity feeds (already on-chain) ─┤
                                           ▼
    registry ──────────────────────► stock oracle
   (symbol / token / feed)                 │
                                           ▼
                                    rule engine (pure)
                                           │
                               cached EffectivePoolState
                                           │
    PoolManager ──► hook ──► fee vault ──► holders / stakers
                      └────► treasury (1% carve)
                      LPs paid natively by V4

Three decisions that shape everything

Price never comes from us

Robinhood Chain already carries Chainlink equity feeds, and the adapter reads them directly. Our permissioned publisher handles fundamentals only. If our backend dies entirely, price-driven rules keep working — the highest-frequency, highest-stakes input is off our trust surface.

The hook never evaluates rules

evaluatePool() collapses oracle data into one slot; beforeSwap reads only that. Swap gas is constant regardless of rule count, and evaluation is permissionless because it is deterministic.

LPs are paid by Uniswap, not by us

The LP share is returned as V4's native dynamic fee, which already distributes pro-rata. This deletes an entire LP-accounting subsystem, and it is why V4 positions being NFTs rather than fungible tokens does not matter to us.

Which token gets taxed

Always the input. That requires both swap callbacks, because V4's “specified” currency is the input on an exact-in swap but the output on exact-out.

Trust model

Fundamentals use a permissioned publisher. This is a trade-off: price comes from Chainlink and does not depend on us, while a compromised publisher could move fundamentals-driven rules only within the 15% ceiling, and nothing else. An interface sits at that boundary so the implementation can be decentralised later without touching the hook.