ArcaDocs · system design
Architecture
Three components, each holding only the power it needs — nothing more. The vault is the only one that ever touches funds.
| Component | Where | Role | Power over funds |
|---|---|---|---|
ArcaVault | onchain | ERC-20 index token, custody, and every rule — mint, redeem, rebalance rails, invariants | Full — and rule-bound |
ArcaUniV4Router | onchain | Adapter that runs the vault's swaps across Uniswap v4 (multi-hop through a quote currency) | Transient only — pulls in, swaps, and pushes back within one call |
| Agent | offchain | Momentum read → swap plan → submits rebalance() with its rationale | None — holds only the rebalancer key |
One contract per index: the ERC-20 token, asset custody, and all policy in a single place. Every setting that bears on safety — the asset set, slippage/turnover caps, cooldown, fee cap, supply ceiling — is immutable once deployed. What stays mutable (guardian actions) is kept deliberately small, and can never move balances or block redemption.
The vault never speaks Uniswap directly; it calls one clean interface — swap(tokenIn, tokenOut, amountIn, minOut). The adapter follows an owner-registered route of v4 pools (stock → quote → stock, since stocks pair against a quote currency, not each other) inside a single lock. Toward funds it holds no state: a malicious or buggy route can at worst burn one approved amountIn— already bounded by the vault's turnover and slippage rails — and can never drain custody.
Runs offchain: fetch prices → compute momentum-tilted target weights (with per-asset caps) → plan the smallest set of swaps within the turnover budget → submit. Its key is a rebalancer session key — the only function it can successfully call on the vault is rebalance().
- If the agent dies, the product degrades gracefully — mint and redeem keep working; the basket simply stops rotating.
- If the key leaks, the attacker inherits the same cage — bounded trades inside the rails, and no withdrawals.
Valuation reads Chainlink stock feeds (AggregatorV3Interface, 8 decimals) — the official oracle stack on Robinhood Chain. Oracles gate rebalance quality (slippage checks and NAV); they are deliberately not in the redemption path.
Oracle note