hMAG7 Protocol Documentation

Everything you need to verify, integrate or build on the first MAG7 index token on-chain.

Overview

hMAG7 is an ERC-20 index token on Robinhood Chain (chain ID 4663), fully collateralized by an equal-weight basket of the seven "Magnificent Seven" stock tokens issued on-chain by Robinhood: AAPL, MSFT, GOOGL, AMZN, NVDA, META and TSLA. It replicates the creation/redemption mechanics of a traditional ETF, with the fund administrator replaced by an immutable smart contract.

• Fully backed: every share is redeemable in-kind for a fixed quantity of each component, directly from the vault.
• Priced by Chainlink: each component has a native USD price feed on Robinhood Chain.
• Open 24/7: creation and redemption are permissionless functions with no market hours.
• Value capture: 100% of protocol fees flow to $M7 buyback-and-burn and $M7 stakers.

Architecture

Mint & redeem

Minting

The vault itself only knows one way to mint: in-kind. You deposit the exact per-share quantity of each of the seven components (the "creation unit") and receive freshly minted hMAG7. Quantities are fixed at deployment so that one share started at ≈ $100 of equal-weight exposure. This is deliberate — it means minting and redeeming never depend on DEX liquidity.

amountsForMint(shares) → uint256[7]   // exact deposit per component
mint(shares, to)                      // pulls components, mints shares (0.30% fee)

One-click mint (ZapV4)

Sourcing seven stock tokens yourself is friction almost nobody will accept, so ZapV4 wraps the in-kind mint in a single transaction: you send ETH, it buys the exact components on Uniswap V4 and mints them into the vault for you. No approvals, no seven separate trades. Unused ETH is refunded in the same transaction.

zapMint(ethUsdgPool, stockPools[7], shares, minSharesOut, to) payable

Inside one PoolManager.unlock() it does seven exact-output swaps for the components, then a single ETH→USDG swap that covers exactly the USDG owed. The deltas net to zero, so only ETH is ever settled. The app quotes every candidate pool per component and picks the cheapest — routing through USDG or directly through an ETH pool, whichever prices better.

Why Uniswap V4 and not 0x: the 0x Swap API refuses every one of these tokens outright — BUY_TOKEN_NOT_AUTHORIZED_FOR_TRADE, "due to legal restrictions" — in both directions. The Uniswap V3 pools are empty. V4 is where the liquidity actually is.

ZapV4 has no owner and no admin functions. It holds nothing between transactions: whatever it doesn't spend goes straight back to you. Your msg.value is a hard ceiling and minSharesOut is your slippage guard.

Redeeming

Redemption burns your shares and pays out all seven components pro-rata against actual vault balances — rounding dust accrues to remaining holders, so the vault can never become insolvent. Redemption does not touch any DEX: your exit works regardless of secondary-market liquidity, and there is no function that can pause it.

redeem(shares, to) → uint256[7]       // burns shares, transfers components (0.30% fee)

Pricing & oracles

Every component has a Chainlink AggregatorV3Interface USD feed on Robinhood Chain (8 decimals, 24h heartbeat, 0.5% deviation threshold). Two properties matter:

• Corporate actions are already in the price. Robinhood stock tokens implement ERC-8056: dividends and splits adjust an on-chain multiplier, and the Chainlink price includes it. The vault therefore accounts in raw balances and needs no corporate-action logic.
• Feeds pause outside market hours. On weekends no rounds are published. All protocol staleness checks use an 80-hour window (weekend + margin); the site labels this state "market closed".

NAV is computed by NavLens as Σ (vault balance × Chainlink price). If hMAG7 trades away from NAV on a DEX, arbitrage via mint/redeem pulls it back.

Fees

Fees accrue in hMAG7 shares to the FeeConverter. The caps are constants in the bytecode — no admin, DAO or exploit can raise fees above them.

$M7 tokenomics

$M7 is the protocol's value-capture token. It has not launched yet, and this page will not pretend otherwise — supply, distribution and listing are still open. What already exists is the pipeline that will feed it, and that pipeline is the only path protocol fees can take:

hMAG7 fee shares
  → redeemed into the 7 stock tokens
  → sold for WETH   (Chainlink price floor, max 1% slippage, on-chain)
  → split: burn share → buys $M7 → sent to 0xdead (totalBurned())
           staking share → WETH to M7Staking (set once, max 50%)

Additionally, the launch platform's creator fees (WETH) earned on $M7 trading volume are routed into the same pipeline.

Staking

M7Staking is a minimal, ownerless staking contract: stake $M7, earn WETH. Rewards are distributed pro-rata using a per-share accumulator. Rewards that arrive while total stake is zero are buffered and released with the next distribution. There is no lock-up, no cooldown and no admin key.

stake(amount) / withdraw(amount) / claim()
pendingReward(user) → uint256   // claimable WETH

Index Factory

Anyone can create a new index with the same guarantees via IndexFactory.createIndex(...) — the basket becomes immutable at creation, fee caps apply, and the vault is registered in the on-chain registry (getAllIndexes()). hMAG7 is index #1.

Creator economics

Index creators earn from their index. At creation you choose the feeCollector; the recommended setup is an IndexFeeSplitter — an immutable, ownerless contract that routes a fixed share of all fees (in index shares) to the creator and the remainder into the $M7 buyback pipeline. The split is fixed forever at deployment, and distribute() is permissionless.

factory.createIndex(name, symbol, tokens, units, 30, 30, 100, creator)
new IndexFeeSplitter(vault, creator, protocolCollector, 5000)  // 50/50
vault.setFeeCollector(splitter)                                 // done

Security model

• No custody risk on collateral: no function exists to move vault collateral except holder redemption.
• No upgradeability: no proxies, no migration hooks. Deployed bytecode is final.
• No pause: redemption can never be frozen.
• Keeper is powerless over destinations: the fee keeper can only execute the fixed pipeline; component sales are bounded by a Chainlink-derived minimum output on-chain, so even a malicious keeper cannot sandwich value out.
• One-time bindings: the $M7 target token and the staking pool + split are settable exactly once, then permanent.
• Firewalled token: the vault holds no $M7; a $M7 price collapse has zero effect on hMAG7 backing.

Addresses (Robinhood Chain · 4663)

RPC: https://rpc.mainnet.chain.robinhood.com · Explorer: robinhoodchain.blockscout.com

Risks

• Underlying asset risk: hMAG7 tracks seven equities; it falls when they fall.
• Issuer risk: the components are stock tokens issued by Robinhood Assets (Jersey) Ltd; hMAG7 inherits any risk attached to that issuance.
• Oracle risk: NAV views depend on Chainlink feeds. The vault's core (mint/redeem) works without oracles by design.
• Smart-contract risk: the contracts are tested but unaudited at launch.
• DEX liquidity risk (one-click mint only): the zap buys the components on Uniswap V4, and those pools are thin — a ~$100 mint costs about 0.1% over NAV, ~$1,000 about 0.5%, ~$5,000 about 2%. Beyond that the shallower pools (AMZN, MSFT) start to fail and the transaction reverts rather than fills at a bad price. If you already hold the seven tokens, mint in-kind and skip this entirely. Redeeming never touches a DEX.
• Jurisdiction: the underlying stock tokens are not available to U.S. or U.K. persons; hMAG7 inherits this restriction.

Terms & Risk Disclosure →