The ScanHood suite

01 Overview

ScanHood is a safety layer for Robinhood Chain, an Ethereum L2, that grew into a full product suite built on the same engine. At the center is a real, on-chain safety scanner (honeypot simulation, LP-lock verification, deployer reputation, official-issuer recognition), and every other product routes through it: a launchpad with five locked-liquidity launch paths, covered-call vaults on real tokenized stocks, a scan-checked swap that flags DANGER-rated tokens clearly before you trade, without deciding for you, direct stock buying against verified tokenized equities, and a referral + streak rewards system paid entirely on-chain.

One guarantee holds across every launch path: liquidity is locked in a contract with no withdraw function, so it structurally cannot be pulled by the creator, the deployer, or ScanHood itself. Nothing here depends on ScanHood staying online: the contracts are self-contained and keep working on their own.

02 Launch paths

All five paths share the same locked-liquidity guarantee. They differ in how the pool gets seeded and what protections apply before it's fully live.

V4's missing anti-snipe window is a deliberate tradeoff, not an oversight: V3's protection works by checking the sender inside the token contract itself, which is possible because every V3 pool is its own deployed contract. V4 pools all live inside one shared PoolManager, so there is no per-pool contract to hook into. The idiomatic fix is a custom V4 hook, but hooks are genuinely novel attack surface, a meaningful share of real V4 exploits are hook bugs, so ScanHood ships V4 launches without one rather than add an untested risk to save a few blocks of sniping. The locked-liquidity guarantee is unaffected either way.

03 The bonding curve

Each curve coin uses a constant-product curve seeded with virtual ETH, the same x·y=k math behind Uniswap itself, so price starts low and rises smoothly as tokens are bought. There is no presale and no team allocation: the full supply is minted straight to the curve contract at creation.

Fees

The live curve charges a flat 0.5% trade fee on every buy and sell, and includes an optional on-chain referral split (see Rewards below). It charges nothing to create a coin beyond the flat launch fee.

Graduation

When the real ETH raised on a coin's curve crosses its target, anyone can trigger graduation: the curve wraps the raised ETH into WETH, opens a full-range Uniswap V3 pool at the curve's final price, and mints the liquidity position. The position NFT stays inside the curve contract forever, there is no function that can move it out. Curve trading closes at that point; the coin now trades on the open V3 pool like any other token.

04 Direct launches (V3 & V4)

Direct launches skip the curve entirely: the full 1,000,000,000-token supply is minted and paired against ETH in a live pool in the same transaction as creation. This is the path built for creators who want deep, tradeable liquidity from block one rather than a gradual bonding phase.

On V3, an optional atomic initial buy lets the creator buy their own coin in the same block as launch, useful precisely because the anti-snipe window (max wallet 5% of supply, max tx 5.5%, enforced for 366 blocks after launch) would otherwise apply to everyone equally, including the creator. V4 launches have no such window to work around, so deployers simply buy normally right after launch through the regular swap flow.

05 Crowd Launch

Every other path has one payer funding the pool. Crowd Launch pools many bids into one: anyone opens a launch with a target FDV and a countdown window, anyone can bid ETH into it while the window is open, and when the window closes, anyone can permissionlessly trigger conclude(), which wraps the full pooled raise into a single call to the same Direct V3 launch factory used by Direct launches above, minting one locked Uniswap V3 pool for the whole raise at once.

Every bidder in the same launch clears at the same effective price, there is no advantage to being the first bid versus the last, which is the specific thing this path is built to resist: a single wallet bundling buy transactions into the launch block to front-run everyone else. Because the pool doesn't exist until the window closes and graduation runs, there is nothing to snipe in the first place.

Claims are pull-based, not pushed: after graduation each bidder calls claimTokens() for their pro-rata share of the purchased supply; if a launch doesn't raise enough to clear before its window ends, it opens for refunds instead and each bidder calls claimRefund() for their exact ETH back. Nothing is auto-distributed, so one broken recipient can never block anyone else's claim or refund.

06 NFT launchpad

A fixed-supply collection factory: supply is capped forever at deploy, with no owner function anywhere in the contract that could mint more later. Royalty is declared on-chain via a real EIP-2981 implementation, so OpenSea and every other marketplace that honors the standard pays it automatically on every resale, no custom marketplace or escrow required.

The 10% royalty ceiling is enforced on-chain, not just validated in the create form: the factory reverts outright if a creator tries to set a higher royaltyBps at launch. Two optional features are wired into every collection: a timed mint window (mintEnd, real contract state read live by the browse page to show a countdown or "ended"), and an owner-only batch airdrop() that mints straight from the collection's reserve supply to a list of recipients, useful for team/community allocations without opening a second mint path.

07 Fees & revenue

Every path snapshots its fee terms at launch time, on-chain, per token. Once a coin is live, its fee split can never be changed after the fact, not by ScanHood, not by anyone.

On direct V3/V4 launches, ongoing swap fees from the locked pool split 70% to the creator, 30% to the protocol, claimable at any time by whoever the locker's records show as the token's fee recipient. On the bonding curve, the trade fee (1% or 0.5% depending on curve version) is paid entirely to the protocol fee recipient at the moment of each trade, since there is no separate creator position to route a share to before graduation.

08 Liquidity locking & custody

This is the core guarantee, and it is structural rather than a promise ScanHood is trusted to keep. The locker contracts that hold every direct-launch liquidity position, and the curve contract that holds every graduated position, simply do not have a withdraw function in their code. There is nothing to disable, nothing an upgrade could reintroduce, because there is no code path that moves the underlying position out, ever.

• No owner, admin, or multisig call can withdraw a locked position, because the call does not exist.
• Locking is verified on-chain at lock time: the locker checks it actually owns the position NFT before marking a token as locked.
• Fee collection is separate from withdrawal, anyone can trigger a fee claim for a token's recorded recipient, but the underlying liquidity itself never moves.

09 Vaults: covered-call yield

A DeFi options vault (the Ribbon Finance pattern) that writes one weekly covered call against a real tokenized stock, one epoch at a time. Deposit real AAPL or TSLA, get ERC-4626 vault shares back, and each week the vault sells a call against the pooled position for a premium, real yield on top of whatever the stock itself does.

The vault never hands over your shares if a call finishes in-the-money: it sells just enough of the pooled position through ScanHood's own V4 swap helper to cover the payout in USDG, and depositors keep the rest. Strike and premium are chosen off-chain by a keeper from real volatility history, but the contract itself enforces hard, on-chain sanity bounds regardless of what the keeper proposes: strike must land within 50% of the live oracle price at open time, premium must clear a floor of 0.1% of the vault's own assets, and the mandatory settlement sale can't lose more than 3% to slippage versus the same oracle price. A price feed older than 96 hours halts the vault rather than settling on stale data. Deposits and withdrawals are open whenever the vault is Idle, and freeze only for the exact duration of an open epoch.

10 Swap: scan-checked trading

A non-custodial swap for any Robinhood-Chain token that runs every trade through the same safety engine as the public scanner before you confirm. A DANGER verdict doesn't disable the button, it relabels it: "Buy anyway — DANGER", so the warning is impossible to miss but the decision stays with the trader, not the interface. ScanHood's contract never holds tokens or ETH between the two legs of a swap.

Quotes are computed two different ways depending on direction: a sell reads the pool directly (V2's getAmountsOut, or V3's live slot0 price) since no execution is needed to price it; a buy runs the real swap function as a simulated eth_call against a funded address and reads back the exact output, so the number shown is what you'd actually receive, not an estimate.

11 Tokenized stocks

Buy Robinhood's own tokenized equities, NVIDIA, Apple, Tesla, the S&P 500 and more, directly with USDG, priced against a live Chainlink-shape oracle. Every stock is checked against Robinhood's real, official tokenized-stock issuer before it's listed: a script reads each candidate token's actual on-chain creator address from the chain's own explorer API and only allowlists it if that creator matches the real issuer exactly. A token that copies an official stock's name but wasn't deployed by that issuer is flagged as an impostor, not silently listed.

NAV (fair value) is read live from each stock's own Chainlink feed; the displayed "vs NAV" tag shows how far the USDG pool price has drifted from that oracle value, a rich or cheap tag can be a real signal or just a thin pool moving on a small order. Buys route through ScanHood's own V4 swap helper, which holds nothing between trades.

12 Rewards & referrals

The rewards curve (v2) adds an on-chain referral split: whoever referred a trader earns 50% of the protocol's own fee share on that trader's volume, paid automatically, no claiming step for the trader, no separate reward token.

• Self-referral is a guaranteed loss. A self-referred trade still pays the full 0.5% fee; only the protocol's half shrinks, so referring yourself costs 0.5% to recover 0.25%. No KYC or heuristics are needed to stop it, the arithmetic already does.
• Binding is one-shot. Once a wallet's referrer is set, it cannot be changed, rotated to chase a better rate, or hijacked later by a different link.
• A hostile referrer can't break trading. Referral credits are pull-based bookkeeping, not a push payment, so a referrer contract that reverts on receive can never brick someone else's trade.

Separately, scan streaks (Scanner → Sentinel → Guardian → Watchtower) reward consistent, distinct-day usage of the safety scanner with status badges only, no token payout, deliberately, so there is no economic incentive to farm them with bots. A streak is a real per-wallet count, one day advances it, a gap of more than a day resets it, tracked server-side against the wallet you're connected with when you scan.

13 Safety scanning

Every token that shows up anywhere on ScanHood, on the screener, the scanner, the swap, or freshly launched through any of the five launch paths, is checked against the same engine before it's surfaced. A scan runs a real buy-then-sell round trip as a simulated transaction (not a static heuristic list) to catch honeypots directly, then layers on LP-lock verification, deployer reputation (serial-rugger and spam-launcher scoring), and official-issuer recognition for tokenized stocks. Tokens launched through ScanHood's own contracts start from a structural advantage here, since the lock guarantee in Liquidity locking above is verified on-chain rather than merely claimed.

This is the same engine that powers the public Scanner, the verdicts shown across the Screener, and the gate on the Swap, ScanHood's products all read from one verified data source rather than each keeping their own opinion. The same scan is available over a public API for developers and agents (see /docs).

14 HOOD: ecosystem directory

A directory of real projects across Robinhood Chain and the broader crypto ecosystem, infrastructure, lending, trading, analytics, ramps, wallets, and bridges, organized by category. Every listed link is checked against the project's own official domain rather than an unverified submission; a listing is a reference, not an endorsement of any project's token.

15 Security model

ScanHood is non-custodial throughout. Users sign their own transactions with their own wallets; ScanHood's frontend never holds or routes user funds. The privileged owner role that exists on each factory contract is deliberately narrow: it can tune parameters for future launches only (fee share within the hard 50% cap, launch fee amount, config enablement), and it can never touch an already-locked position, because, as above, no function exists that would let it.

• Per-token fee snapshot: a coin's fee split is frozen at its own launch and cannot be altered afterward.
• Locker-side ownership check: lockPosition independently confirms the locker actually holds the position NFT before flagging a token as locked, rather than trusting the factory's word for it.
• No arbitrary-call passthrough anywhere in any locker, the entire attack surface of "owner calls an arbitrary function on my behalf" simply isn't present in the code.
• Reentrancy guards are enforced across every launch path; slippage bounds (minimum-out) apply on every buy, sell, and mint. Crowd Launch has no separate min-out step, every bidder in a launch clears at the same price by construction.

16 Contract addresses

All contracts below are live on Robinhood Chain. Addresses are also visible on-chain via any block explorer, and each one below is cross-checked directly against what the live product pages actually use, not just a deployment record.

17 Disclaimer