The House
An onchain reserve built from the world’s public markets. The token is a claim on the reserve: burn it, and take your share of the basket in kind.
What the House does
The terms, fixed at deployment
There is no owner anywhere in this protocol. No address can move a reserve asset to a destination of its choosing, no address can mint a token, and no address can change a fee. The operator’s share is a compile-time constant paid at the source to an address fixed in the constructor.
The Reserve
Five legs. One of them is cash; the other four are shares in companies whose prices are set on public markets and carried onchain by Coinbase.
The basket
How a price is taken
Never from slot0(). The value of a leg is the arithmetic mean tick over the last 900 seconds, read from the book’s own observe() oracle, and it is refused outright in four cases:
A refused book turns the reserve valuation into “unavailable”. It never turns it into a partial total dressed up as a total, and it can never affect a redemption: the contract that pays people does not import an oracle and has no function that reads a price.
Why these books and not the Uniswap ones
Both venues carry these names on Base. Measured on 21 September 2026, the Uniswap v3 NVDAc/USDC 0.3 % book held about 17,245 USDC against about 1,101,009 USDC on Aerodrome — sixty times thinner. Pricing a reserve against the thin one is the exact mistake this protocol exists to avoid, so the pin follows the depth. The reading code itself is venue agnostic; the depth is re-measured on every single read.
The Floor
The floor is the reserve standing behind one token. It is denominated in the basket, not in dollars, and that distinction is the whole of the honest claim.
What only climbs
For every leg of the basket, the units of that leg held per token in existence never go down. Not on a redemption, not on a rounding, not on a sequence of redemptions inside one transaction, not when somebody donates to the House and not when ether is forced into it.
For a leg holding B units, with S tokens in existence,
a redemption of x tokens computes
gross = floor(B * x / S) the redeemer's untaxed share
fee = floor(gross * feeBps / 10000)
toUser = gross - fee
toOp = floor(fee * 3000 / 10000) the operator's announced share
B' = B - toUser - toOp
S' = S - x
and therefore B' / S' >= B / S , because
B'*S - B*S' = B*x - gross*S + (fee - toOp)*S >= 0
since gross = floor(B*x/S) <= B*x/S and fee >= toOp.
No price appears anywhere in that argument. It is checked by unit tests, by fuzzing over deposits, donations, forced ether, masks and fee tiers, and by a stateful invariant run that drives the House at random for sixteen thousand calls and asserts the floor never falls below any level it has previously reached.
What does NOT only climb
The dollar value of the basket moves with the stock market, and it can fall a long way. Nothing in this protocol can stop that, and a site that told you otherwise would be lying about equities rather than describing a property of the code. What the contract guarantees is the quantity behind your token, in NVDAc, GOOGLc, AAPLc, METAc and ether. What those are worth is the market’s business.
Where the floor comes from
The House is funded by deposits. deposit() is permissionless and one way: it mints nothing, it buys nothing, it simply raises the floor for every holder including whoever sent it. There is no privileged funding path, and no privileged withdrawal path to go with it. At launch the reserve is empty, and this site will show it empty.
Redemption
Burn the claim token, take your slice of every leg, in kind, in one transaction. The House never sells anything for you and never needs a price to pay you.
The fee
The operator’s share is thirty percent of the fee, never of your redemption, and it is paid in kind to an address fixed at construction, in the same transaction, with nothing to claim later and no function that can redirect it. The remaining seventy percent of the fee stays in the House. That remainder is the floor climbing.
What you get
The day an issuer freezes a name
A tokenized equity is issued by a company that can halt transfers of that name or blocklist an address. If that happens, a redemption that insists on paying every leg reverts, and one line item would otherwise make the whole reserve unreachable.
redeem(amount)Pays every leg, skips nothing, and simply reverts if one leg cannot be paid. This is the safe default: a caller who did not ask to give something up does not give it up.redeemSkipping(amount, mask)You name the legs to leave behind and walk out with the rest. A skipped leg is forfeited to the House, which raises the floor for everyone who stayed, so the choice is yours and never silent.What cannot happen
The Register
A first group of active onchain wallets has been selected. The list is published in full, the rule that produced it is published beside it, and the root below is the number that will be written into the register contract and can never be changed afterwards.
The list
The rule, in full
loading…
A list nobody can reproduce is a list nobody should trust. Everything the rule depends on is a fixed number: a block range, a threshold, four token addresses and a tree convention. tools/build_register.py in the contracts repository runs it against any Base archive node and prints the same list and the same root, today and in five years.
What a seat grants
Why a proof cannot be stolen
Proofs are public — they are in the JSON file this page just downloaded. The leaf is bound to msg.sender, never to an argument, so presenting somebody else’s proof claims nothing. A seat can also only be claimed once. Both are attack tests in the suite, not assertions on a page.
Documentation
1 · Overview
Asset House is three things that barely touch each other, which is deliberate.
A claim token. A plain fixed-supply ERC-20 on Base. One million units, minted once in the constructor, no owner, no minter, no pauser, no role of any kind, no fee on transfer, no blocklist, no upgrade path. The only function that changes the supply is burn, and it can only burn the caller’s own balance. There is deliberately no burnFrom: an allowance that can destroy someone else’s balance is a role in disguise.
A reserve. A contract holding native ether and four tokenized equities. It has no owner and no oracle. It can be funded by anyone and emptied only by holders, pro rata, by burning.
A valuation. A separate, read-only contract that prices the reserve for display. It is the only thing that touches an oracle, and nothing depends on it.
2 · Supply and the opening book
The supply is 1,000,000 tokens — not the billion this kind of launch usually carries. A claim on a reserve wants a denominator a person can hold in their head.
Every derived number is recomputed from that supply. The opening geometry is a single-sided Uniswap v4 position, native ether against the token, 1 % fee, tick spacing 200, no hook, with one hundred percent of the supply in the book and zero ether committed by the deployer.
The market capitalisation is read at TICK_UPPER, not at the opening tick: the top of the ladder is the first price anyone can actually pay. The pool opens exactly one spacing above the range, so nobody can trade at the opening tick and the position is unambiguously one hundred percent token when it is seeded. The arithmetic, for the record:
price wanted = 1,000,000 HOUSE / 4 ETH = 250,000 -> tick 124,298.38 the tick RISES as the token gets cheaper, so rounding UP lowers the cap: 124,200 -> 4.0395 ETH (+0.99 %) 124,400 -> 3.9596 ETH (-1.01 %) <- chosen 124,600 -> 3.8812 ETH (-2.97 %)
A test re-derives this from the pool’s own TickMath rather than from a float, and a mutation test proves that lifting the tick from a billion-supply launch would be caught.
3 · The reserve
Five legs, fixed at construction, in this order: native ether, NVDAc, GOOGLc, AAPLc, METAc. There is no function that adds, removes or reorders a leg, and a duplicate leg is rejected in the constructor.
Holdings are always read from the live balance, never from an internal counter. An internal counter is what turns a donation into a lock: the day a balance and a counter disagree, the difference is unreachable forever. Because of that, a raw transfer into the House and a forced ether transfer both simply raise the floor, and both come back out through redemption.
4 · The floor invariant
Stated and proved in Folio III. In short: for every leg, units held per token in existence never decrease, and no price appears in the argument. Rounding is always in the House’s favour, which is what makes the inequality hold rather than nearly hold.
A redemption may not burn the last token. The remaining basket would have no claimant.
5 · Valuation and the circuit breaker
Each equity leg is priced through the deepest concentrated-liquidity book of that name on Base, quoted in USDC, using a 900-second mean from observe(). The total is then converted to ether through the Uniswap v3 WETH/USDC 0.05 % book. Two hops, and each hop carries its own guards.
The reader never asks the ABI decoder for the whole of slot0(). Uniswap v3 returns seven fields and Aerodrome Slipstream returns six; decoding seven words out of six reverts with no data at all, which stays invisible for exactly as long as the test mock imitates only one venue. Only the first five words are read, and those five are identical on both. Both shapes are present in the test rig, and both are measured against the live chain in the fork tests.
When any leg is refused, the reserve valuation reports ok = false and a bitmask naming the refused legs. This site is required to render that as “unavailable”.
6 · The register
A merkle allowlist with an immutable root, an immutable list size and the keccak of the published rule text, so anyone can prove this site is describing the same list the contract holds. The leaf convention is keccak256(keccak256(abi.encode(account))), pairs are sorted before hashing, and an odd element is carried up unchanged.
The double hash matters: it makes a leaf impossible to confuse with an internal node, which is the classic forgery on a naive tree.
There is no owner on the register. The root cannot be swapped after people have checked themselves against it, and no address can be added by anyone, ever.
7 · The operator
The operator is the deploying address, fixed in the constructor of the House and never changeable. It is paid in exactly two ways and no others:
Assets deposited into the House are not recoverable by the operator except the way everyone recovers them: by burning tokens. The operator holds the unsold float after the position is closed, and that is its claim, pro rata, like anyone else’s.
8 · What was attacked
Every item below is a test that performs the attack, not an assertion that it is impossible.
observe() on an untraded pool extrapolates and returns a well formed price. The observation timestamp catches it.9 · Tests, rehearsal and mutation
The mutation check applies fourteen plausible mistakes — the operator paid out of the redemption instead of the fee, the fee set to zero, rounding turned the other way, spot instead of the mean, each guard removed in turn, the tick lifted from a billion-supply launch, the reentrancy guard removed — and fails if any of them survives the suite. All fourteen are killed.
The rehearsal runs the real operational scripts, not copies of them, on a forked Base with throwaway keys: deploy, fund the reserve with real tokenized equities moved out of their own books, read the floor, open the position, buy through the real Universal Router on Base, redeem, check the operator was paid at the source and the floor climbed, collect fees without closing, close the position, and measure the operator’s result.