Most RWA demos end at "imagine if."
This one ends with two transactions you can look up.
AUREUS — 49 seconds, a bond's entire life on Robinhood Chain:
Mint — 1.5 USDG in, bonds out at the on-chain NAV (1.499826 aCETES) Accrue — value accrues as coupon, pushed on-chain by the keeper. CETES at 5.55% p.a.
Redeem — bonds back to USDG whenever the vault can pay. No lock-up. Settle — both transactions on-chain, verifiable by anyone:
Mint → https://t.co/YjblzPzQoh 4f230023fdc59003e1eb987e7cbc4e32
Redeem → https://t.co/LteY3unHjl
Every figure is real: NAV, balances and reserves are read from the contracts. The 5.55% is the protocol's published CETES coupon.
Five sovereign markets live today — Mexico (CETES) · Brazil (TESOURO) · UK (GILTS) · EU (EUROB) · US (USTRY).
0x6063ff09d30b06f80fc7539c5fbfcfa5ea2166ad
Watch ↓
https://t.co/V4wDfEakWI
There is nothing to sign up for.
No account. No username. No password. No approval email. No queue, no "your application is under review". Nothing to close, nothing to deactivate, nothing to recover.
The app asks for exactly one thing: where to send the bond. That's an address. Your wallet is the whole account — and disconnecting is the whole way out of it.
You don't even need the wallet to look: all five pools, the NAV, both reward streams and every vault's reserves are readable with no connection and no signature.
The lowest-friction sovereign bond account ever built is a page and a wallet.
https://t.co/V4wDfEakWI
There is a market where the minimum ticket is a phone call to a private bank, the account takes weeks to open, and the desk closes at 4pm in a time zone you don't live in.
It's the market where governments borrow. Mexico pays 5.55% there. Brazil pays 11.58%. Both figures are published to the world every day — and almost nobody outside those countries can touch them.
The gate was never the bond. It was the door: a local account, a local tax number, a local broker, local hours.
AUREUS puts five sovereign markets on one page — CETES, TESOURO, GILTS, EUROB, USTRY — minted
and redeemed against USDG, the dollar already in your wallet, on Robinhood Chain.
No minimum. No business hours. The vault keeps no hours at all.
https://t.co/V4wDfEakWI
Look before you connect.
The app shows all five pools without a wallet and without a signature — NAV, pool size, both reward streams, the AUREUS budget and the date it ends — read from Robinhood Chain,with the timestamp of the read shown on the page.
And the admin — the only thing that could change parameters or swap the price keeper — is a 2-of-3 multisig, not a single key. No admin can move a staked bond, and a vault's only way out is redeem().
Check the numbers first. Then mint.
https://t.co/V4wDfEakWI
We didn't ship this and hope.
Minted on mainnet, staked, claimed rewards, redeemed, unstaked — every step run end-to-end
with real money, and every transaction is still on the chain.
That run is what the CETES pool holds today: 1.5 CETES. No outside stakers yet — you'd be early, not late.
And in costs the same as out: exit() unstakes everything and claims both streams in one transaction. No lock-up, nothing to unlock.
https://t.co/V4wDfEakWI
There is a second reward stream, and it is already running.
30,000 AUREUS per pool — bought on the open market, never minted — paid out per second to the
people staked. The CETES pool still has 29,998.31 to stream, ending Nov 10.
To stake: pick a bond → STAKE → confirm. Unstake whenever — no lock-up, no queue.
AUREUS is an incentive, not a dollar yield: the pool can only pay what it holds, and you can read the entire budget on-chain before you stake.
https://t.co/V4wDfEakWI
Please don't worry; this involves a fair amount of physical effort, and I need to rest—as well as eat, sleep, and attend to other social gatherings and activities. I will keep updating the results, and everyone is more than welcome to try out the website's features.
The entire yield story is one number: 10 bps.
Every redemption out of a vault pays a 0.10% fee. That fee does not go to us. It is routed, in the same transaction, into that bond's own staking pool — where it becomes part of the stream its stakers are earning.
So the more a bond is minted, redeemed and used, the more its stakers earn. That's the whole mechanism: no treasury cut, no emissions dressed up as revenue.
https://t.co/V4wDfEakWI
Mint at the price the chain says — not at a quote someone typed this morning.
Send USDG, receive the bond at its on-chain NAV. No order book, no spread, no counterparty to wait for. No mint fee, no cap, nothing to sign up for — your wallet is the whole account.
CETES · TESOURO · GILTS · EUROB · USTRY — five sovereign markets, five tokens, one page,settled on Robinhood Chain.
Start with a dollar: https://t.co/V4wDfEakWI
Don't take the numbers on faith. Everything is one call away.
reserves() — what the vault actually holds
latestRoundData() — the NAV print, with its timestamp
redeemFeeBps() — 10. That's the whole fee schedule.
maxRedeemable() — the reserve-bound ceiling, right now
Contracts on Robinhood Chain · 4663. Addresses are in the app.
https://t.co/V4wDfEakWI
Most RWA demos end at "imagine if."
This one ends with two transactions you can look up.
AUREUS — 49 seconds, a bond's entire life on Robinhood Chain:
Mint — 1.5 USDG in, bonds out at the on-chain NAV (1.499826 aCETES) Accrue — value accrues as coupon, pushed on-chain by the keeper. CETES at 5.55% p.a.
Redeem — bonds back to USDG whenever the vault can pay. No lock-up. Settle — both transactions on-chain, verifiable by anyone:
Mint → https://t.co/YjblzPzQoh 4f230023fdc59003e1eb987e7cbc4e32
Redeem → https://t.co/LteY3unHjl
Every figure is real: NAV, balances and reserves are read from the contracts. The 5.55% is the protocol's published CETES coupon.
Five sovereign markets live today — Mexico (CETES) · Brazil (TESOURO) · UK (GILTS) · EU (EUROB) · US (USTRY).
0x6063ff09d30b06f80fc7539c5fbfcfa5ea2166ad
Watch ↓
https://t.co/V4wDfEakWI
The admin of every AUREUS contract now sits behind a 2-of-3 multisig.
Until today all 15 admin slots — five bonds × oracle, vault and staking pool —belonged to a single key. That key is also the one that holds gas and gets woken every six hours to publish the NAV. One leak, and whoever took it could swap the keeper, change the vault parameters, or pause redemptions.
That key is no longer an admin. All 15 slots moved, one transaction at a time, to a Safe 2-of-3 on Robinhood Chain:
0x5E8C4c241a29ff7E60c648f378A4AA70053Ee92e
What that buys: a single leaked key — including the hot one — is no longer enough to take over. What it doesn't buy: if the machine itself is fully compromised, the two keys kept on it go together. We'd rather say that out loud than sell a guarantee the setup doesn't give.
How it was done, since the details are the point:
· Canonical Safe contracts — the official v1.4.1 factory, singleton and fallback handler.
Not a custom multisig of ours.
· Every transaction hash is computed twice: locally over the EIP-712 typed data, and again by reading the chain's own getTransactionHash(). The two must match before anything is signed.
· Before moving a single permission, we proved the new keys could sign: a harmless transaction — the Safe calling its own getThreshold() — went to mainnet first.
· Only then did the 15 transfers happen, each one read back from the chain.
· And the proof afterwards: a real admin-only call, executed through the Safe — setting the price keeper to the value it already had.
The first attempt actually reverted. We tried to batch all 15 handovers into one transaction signed by the Safe, and it failed with GS013 — because the Safe was not the admin yet and could not hand itself the keys. A handoff has to come from the current admin. That's the kind
of thing you only find out by trying it on a live chain.
Read back afterwards: 37/37 pool invariants, 56/56 contract checks, 56/56 site checks.
https://t.co/vVnrE9cpfO
AUREUS — day one on Robinhood Chain.
Yesterday we opened staking. The five bond vaults have been minting and redeeming at NAV since Oct 10. So here is the state of the system after day one — read straight from chain 4663, not from a dashboard we could have made say anything.
The bonds. Each one mints and redeems at an on-chain NAV, moved every six hours by a keeper as the coupon accrues:
CETES · 1.00030364 (5.55% / yr)
TESOURO · 1.00063347 (11.58% / yr)
GILTS · 1.00019084 (3.49% / yr)
EUROB · 1.00010113 (1.85% / yr)
USTRY · 1.00017273 (3.16% / yr)
25 prints since launch. 0 failures. Annualize each NAV's drift since deployment and you get the coupon the site quotes — the number on the marketing page and the number on-chain are the same number.
Reserves. The CETES vault holds 1.700007 USDG against 1.699804 CETES in existence.
Every token is redeemable at NAV, and the vault has exactly one way to release funds:
redeem().
Staking. The pools opened yesterday. One position so far — 1.5 CETES, opened during our final end-to-end run. No outside stakers yet; day one is the quiet part.
The reward budget, though, is real and already streaming: 30,000 AUREUS per pool, bought on the open market (none minted), paid per second to whoever holds a position. 29,998.31 left in the CETES pool, streaming until Nov 10.
This morning's reconciliation, on-chain: 37/37 invariants. Pools hold exactly what they owe. Each vault's fees route to its own pool. A staked bond leaves the pool only when its owner takes it out — no admin key can move it.
Read it without a wallet, no signature:
https://t.co/V4wDfEakWI
Day one is the quiet part. The mechanism is the story — and it ran.
1. How often does the keeper update coupon accruals?
It helps to split this in two, because the two halves have different answers.
The accrual itself is continuous, not periodic. A bond's value accrues linearly at the instrument's rate — the keeper doesn't "run accruals," it publishes the accrued number on-chain. Between publishes the on-chain NAV is a step function that catches up at the next print, computed statelessly from the last print and its own timestamp: next = last × (1 + rate × elapsed / year), using the same rates the site's ticker shows (CETES 5.55% / TESOURO 11.58% / GILTS 3.49% / USTRY 3.16% / EUROB 1.85% — one source, not two).
The publish cadence is a 6-hour heartbeat, run as a scheduled job. Each run publishes only the bonds actually due (≥6h since their last print), so a run with nothing due sends zero transactions — the heartbeat is a latency bound, not a metronome.
Hard bound, enforced by the contract rather than the schedule: maxStaleness = 24h (read from the oracle). Once a print goes stale, latestRoundData() reverts — and since mint/redeem read the price first, both revert with it. Fail-closed by design: the vault would rather stop than transact at a price that no longer holds. The app shows "price stale" and disables the buttons instead of guessing. Each publish is additionally clamped to 5% (maxMoveBps = 500); at these rates that is ~5 months of accrual, so the clamp never binds in normal catch-up — it exists so a stolen keeper key cannot reprice a bond in one shot.
The observed record since the 2026-10-10 deployment: prints have landed every ~6–12 hours (some 6-hourly runs find nothing due and are no-ops by design), and the longest gap was 17.5 hours, when the host machine slept through an overnight run and caught up on wake. The 24-hour window has never been approached; as of this writing all five prints are 0.1 hours old. The keeper is a funded hot key (~43k gas per publish ≈ 0.0000345 ETH/day on this chain); gas runway is a standing ops item — currently ~20 days, and it is the one thing that can stop this system — fail-closed, as above, never mispriced.
2. How does the app communicate reserve changes as coupons arrive?
The app is built around one distinction: NAV and reserves move on two different clocks. The NAV (coupon) rises on the keeper's publishes. Reserves — what can actually be paid out — move only when USDG is actually paid in: a mint, or the custodian calling fundCoupon(). A rising NAV does not conjure USDG, which is why the redeemable ceiling can sit below the outstanding supply. (A mint moves both sides equally, so it never closes the gap; only fundCoupon does.)
What the app shows:
- Two first-class figures, read live over the user's own wallet provider on connect, on bond switch, and after every transaction: VAULT RESERVES (reserves()) and REDEEMABLE NOW (maxRedeemable()).
- The redeem panel's MAX button caps at min(your balance, maxRedeemable()) — the UI will not let you even build a redemption the vault will reject.
- Standing copy explains the gap: coupon is published on-chain by the keeper but paid into the vault separately; until it arrives, redemptions beyond reserves are rejected
on-chain; "the figure above is what the vault can actually pay right now."
- If you hold more than the ceiling, a specific banner fires: "You hold more bonds than the vault can currently redeem (…). That is the coupon not yet paid in."
- If a redemption is nonetheless rejected, the app surfaces the chain's own error rather than a generic one: "The chain rejected it: not enough reserves. The coupon has not been paid into the vault yet — this redemption cannot settle."
- If the print goes stale, the ceiling reads "— price stale" rather than 0 — a zero would look like an empty vault — and mint/redeem are disabled.
Freshness is stated, not implied. A wallet-connected user reads the chain directly; a visitor without a wallet gets a public snapshot, and the page prints when it was read ("as of <timestamp> UTC · NAV last published <date>") instead of claiming "just now." What the app deliberately does not do is push: there is no subscription to
CouponFunded, so a page left open updates on the next interaction. The authoritative record that a coupon arrived is the vault's CouponFunded event — one call away.
A live illustration, read just now: the CETES vault holds 1.700007 USDG against 1.699804 outstanding bonds at NAV 1.00030364. maxRedeemable() is therefore 1.69949 aCETES — about 0.00031 aCETES below the full supply. That gap is precisely the coupon that has accrued since the last funding and has not landed yet. It is sub-cent today because the instrument is tiny; the mechanism is the point. (The other four vaults are at zero supply and zero reserves — nothing has been minted there yet, so their ceiling is 0 for that trivial reason.)
@AUREUS_RH The live mint and redeem transactions make the bond lifecycle verifiable, while on-chain NAV keeps pricing transparent. How often does the keeper update coupon accruals?
Redemption is reserve-backed, and the app shows the reserve.
maxRedeemable() is a public number. When the coupon hasn't landed yet, a redemption beyond reserves reverts — InsufficientReserves. That's not a bug: it's the vault
refusing to pay money it doesn't have. When the coupon arrives, the ceiling rises.
10 bps fee. No queue, no gatekeeper.
https://t.co/V4wDfEakWI