The protocol

How the pool works, in full.

The model, what a default does, the score, the invariants and every parameter of pool v2, read live from the contracts on Robinhood Chain. All of it is deployed; § 08 marks what is live and what comes next.

§ 01

Model

One pool of USDG. Every agent's line is vouched by one backer, all of it out of that backer's own stake. If a line defaults, the loss comes out of the stake of the backer who vouched it.

accountingCreditPoolV2.sol
backing(r)    = value of r's locked pool shares     // a root's stake, also gets the lenders' share of fees
free(r)       = backing(r) − delegatedOut(r) − feeLocked(r)
available(a)  = delegatedIn(a) − principalOut(a)     // from its one sponsor, 0 without one

vouch(r → a, x):  require x ≤ free(r) ;  a new sponsor needs the owner's signed consent
                   delegatedOut(r) += x ;  delegatedIn(a) += x
                   // a line is only ever a backer's stake: repaying grows the record, not the line

borrow(a, P):     require minLoan ≤ P ≤ available(a)
                   principalOut(a) += P ;  fee = P · feeBps · term / 30d
                   feeLocked(sponsor) += fee             // fixed at borrow, held in the backer's stake

repay(a, P+fee): fee → lenders 50% · sponsor(a) 25% · reserve 25%
                   // plus any premium the owner consented to (at most 2% per 30 d), all to the sponsor
lenderDeposits USDG, holds shares, earns 50% of every base fee. Every line is fully backed by a backer's locked shares and a default burns those shares, so no path has been found for a loan loss to reach lender principal. That assumes Robinhood Chain, the ERC-8004 registry and USDG keep working as they do today. The registry and USDG can be upgraded by their own owners. The contracts have had no outside audit. The Safe can change the pool's settings, within the steward's policy, through a timelock with no delay. Withdrawals never wait for agents to repay, since a line is never bigger than its backer's stake. Within 7 days of a deposit a 0.5% fee stays with the lenders who stay. Experimental contracts; capital is at risk.
root sponsorLocks USDG as pool shares and vouches lines out of them, each line starting only with the agent owner's signed consent. The stake gets the lenders' share of fees, and it pays when a line it vouched defaults. Anyone can become one: the minimum stake is set in the parameters below, and stake that backs nothing can be unlocked.
agentAn ERC-8004 identity. Borrows $5 to $500 for 1 to 30 days at 1% per 30 days, within the line its one sponsor vouched. The fee is fixed at borrow and is due in full, even on an early repayment. Repaying builds its record, not its line: a line grows only when its backer vouches more of its stake. With no loan open it can leave, or move to another sponsor it signs for.
consentAn EIP-712 signature from the agent's NFT owner, naming one sponsor and the most premium it accepts. Only that sponsor's owner can use it, and it stops working if the NFT is sold. Nobody gets a line without having signed for it.
reserveTakes 25% of every base fee. Backers pay for defaults, so it covers no loss beyond rounding dust on a slash; it also pays the keeper bounty in the parameters below (0 today). From 6 October 2026 the pool is owned by PoolSteward, behind the timelock. The timelock has no waiting time since 11 October 2026, so a change runs as soon as the Safe schedules it, in public on chain. The steward holds the pool to a policy the Safe can only leave through a public handback, and never takes the reserve below its floor. Once a day anyone can call its sweep, with no timelock. It sends the reserve above its target to the engines (§ 08). At or under the target, it sends half of what arrived since the last sweep. It sends nothing under 25 USDG. The first sweep was on 9 October 2026.
§ 02

Loan lifecycle and what a default does

Four transitions. The last one is a default, where the backer pays.

state machineloan.status
defaultmarkDefault()
require now > defaultableAt                     // dueAt + grace, fixed at borrow

burn ⌈(P + fee) · totalShares / totalAssets⌉ of sponsor's locked shares
                                                // the backer pays the principal and the unpaid fee
delegatedOut(sponsor) −= P ;  delegatedIn(a) −= P
childrenDefaulted(sponsor) += 1                 // −75 on the backer's score
defaulted(a) = true                             // for good: score 0, no new line
ownerDefaults(owner at borrow) += 1             // custodians aside, that wallet's agents can't borrow again
hook(sponsor).onDefault(…)                      // a $PRIORS stake burns in the same transaction
                                                // a stock line keeps tokens worth what is owed + 20%, the rest goes back
bond.slash(a)                                   // a $5 treasury line: anyone can then send the owner's 5 USDG bond to the Safe

share price: never falls                        // lenders are untouched
totalBadDebt = 0                                // live on robinhood chain, checked by the invariant suite before every site deploy
§ 03

Score

Six terms over the on-chain record, 0 to 1000. A pure function of creditReport(agent). Nobody sets or adjusts it by hand. The site and the API also show Score v2, live since 27 September 2026: risk time up to 300, seasoned loans 200, backing 150, age 100, recourse 100 and x402 income 150, less 10 per late repayment and 75 per vouched default. A default sets both scores to 0. The two big terms are dollar-days and week-long loans, so the cheapest way to a high score is to hold real money for real time and give it back.

ScoreLib.solv1
score(r) = defaulted ? 0 :
    min(400, dollarDaysRepaid / $10)     // Σ principal × actual holding time, capped at term
  + min(200, 20 · qualifiedRepaid)      // loans held for ≥ 7 d
  + min(150, delegatedIn / $5)          // someone's money at risk for you
  + min(150, 2 · daysEnrolled)
  + min(100, 50 · recourseHonored)      // carried over from v1 only: pool v2 has no recourse
  − 75 · childrenDefaulted              // per defaulted loan it backed
// short, small loans add little; money held for weeks adds the most
recorded score inputs—
dollar-days repaid —
qualified loans —
backing at risk —
time enrolled —
recourse honored —
vouched defaulters —
score(—) · recorded contract score—
§ 04

Invariants

Checked after every call by a stateful fuzzer driving deposits, withdrawals, stakes, consented vouches, handoffs, freezes, borrows, repayments, defaults, failing hooks, parameter changes and time. These are the properties the tests check. Passing them does not prove the contracts safe. Additional default scenarios are under review.

I1 · solvency
totalBadDebt = 0
share price never falls
⇒ no loan loss reaches lenders
I2 · cash
balance(USDG) ≥
  poolLiquidity + reserve
  + unclaimedSponsorFees
backer stake is pool shares, not a balance of its own
I3 · exposure
∀a: principalOut(a) ≤ delegatedIn(a)
∀r: delegatedOut(r) ≤ backing(r) + dust
an agent never owes more than its backer vouched
Live
on Robinhood Chain
7
invariants
256 × 400
fuzz runs × depth
—
lender loss to date
§ 05

Parameters

Read from getParams() on the deployed pool. Owner-adjustable within bounds. The owner is PoolSteward, which answers to a timelock with no waiting time since 11 October 2026; every change is scheduled in public and emits ParamsUpdated.

paramvaluemeaning
§ 06

$PRIORS and the treasury

Launched on Pons, a launchpad on Robinhood Chain, paired with USDG. An agent's owner can stake it behind the agent's line on SeatVaultV5 (§ 08), live since 9 October 2026. SeatVaultV5's own USDG backs the line. V4 seats closed to new agents on 9 October 2026, and none is open. The creator fee is not routed to the treasury: the treasury is topped up by hand, by sending it USDG and calling sweep(), which anyone can do. A sweep stakes all of it as pool shares under the treasury's own ERC-8004 identity, a root sponsor. From that stake it gives each invited agent a $5 line. An automatic invite needs the agent's owner to lock a 5 USDG bond first. The bond comes back once the agent has no line, no loan open and no default, and at least 4 days have passed since it was posted. The raise to $25 is on hold. New treasury lines are held to 1,000 USDG a week today, a cap the Safe sets. Its agents' sponsor fees go back to the treasury. A default burns its shares, and anyone can then send the owner's 5 USDG bond to the Safe. Its tree is in the grove, next to everyone else's.

treasuryTreasurySponsorV4.sol
you ────────── send USDG ───▶ TreasurySponsorV4.sweep()  // by hand, anyone
                              ├──   0% ─▶ pool.fundReserve()  // reserveBps, 0 today
                              └── 100% ─▶ pool.addStake(id)   // stake, as pool shares

firstLine(agent)  invite + owner's consent ─▶ vouch $5          // once per invite, after a 5 USDG bond
raise(agent)      none on v4 since 12 October: raises are on v5  // see below
                   Σ new lines ≤ epochCap per 7 d epoch, 1,000 USDG today // set by the Safe
reclaim(agent)    idle 30 d, no loan open ─▶ line back            // anyone

collect()         its agents' sponsor fees ─▶ the treasury        // anyone
default            its shares burn · anyone can then send the owner's 5 USDG bond to the Safe

TreasurySponsorV5          the raise, since 14 October 2026        // no invites
move(agent)       a v4 agent, its owner's 5 USDG InviteBondV2 bond ─▶ vouch $5
raise(agent)      3 qualified loans, 14 d, score 100 ─▶ $25    // anyone
                   Σ raises ≤ $100 per 7 d epoch, apart from first lines
bond               back once the line is closed, never under an open line
treasuryfunded by hand: anyone can send it USDG and call sweep()
reserve— in the pool's reserve today
seats$5 seats (SeatVaultV3): a staker's $PRIORS behind an agent's $5 line. V3's own USDG backs the line. They take no new seats. Half a seat burns on a default. Back your agent
treasury feesits sponsor share of what its agents pay goes back to the treasury through collect()
contractnot launched yet
launchPons, USDG pair. The creator fee accrues to the creator's Pons escrow, not to the treasury. ponsfamily.com/launchpad
§ 07

Interface

Everything an agent, a sponsor or a lender can do on pool v2. The score is one view call on the lens. api.priors.trade serves it over x402 for 0.03 USDG a call, and priors.trade/api/check gives an agent's record for free. sdk/priors-v2.mjs wraps the lot and simulates every write before it is sent.

deposit(uint256 assets, address receiver, uint256 minShares) → shareslender
withdraw(uint256 shares, address receiver) → assetslender
enrollRoot(uint256 rootId, uint256 assets)sponsor
vouchWithConsent(uint256 sponsorId, uint256 agentId, uint256 amount, uint256 premiumBps, Consent c, bytes sig)sponsor
borrow(uint256 agentId, uint256 amount, uint64 term, address to, uint256 maxFee) → loanIdagent
repay(uint256 loanId, uint256 expectedAgentId, uint256 maxDue)anyone
leave(uint256 agentId)agent
markDefault(uint256 loanId)anyone
claimSponsorFees(uint256 sponsorId, address to)sponsor
lens.score(uint256 agentId) → uint256view
lens.creditReport(uint256 agentId) → Reportview
treasury.firstLine(uint256 agentId, uint64 expiry, bytes invite, Consent c, bytes consentSig)anyone
treasury.reclaim(uint256 agentId)anyone
treasuryV5.move(uint256 agentId, Consent c, bytes consentSig) · raise(uint256 agentId)anyone
treasury.sweep() · collect()anyone
GET api.priors.trade/v1/score/:agentIdx402, 0.03 USDG
GET priors.trade/api/check?agent=:agentId · ?x=:handlefree
verifyany RPC
§ 08

The engines

Three engines work around a new seat vault, SeatVaultV5. The contracts for revenue and engine 3 are deployed on Robinhood Chain (block 80,236,272), and their first step ran through the timelock, then 48 hours long, from 6 October 2026, 21:04 UTC. SeatVaultV5 (engine 1) is live since 9 October 2026, for agents' owners. The owner stakes $PRIORS, or pays in USDG that is swapped to $PRIORS in the same step. SeatVaultV5's own USDG in the pool backs the line. It has had internal reviews, no outside audit. Stage 1 is on since 11 October 2026, so engine 2 buys $PRIORS now. Placing it behind lines is next. Backing open to anyone and the premium come later.

designrevenue, engines 1 and 3 live · engine 2 buys, placing next
engine 1  owner ── $PRIORS ──▶ SeatVaultV5 book(agent)
          // opens the line, up to its tier's ceiling
          backers ── $PRIORS ──▶ same book
          // later: shares the fees, raises no line
          default ─▶ three quarters of the owner's stake burns
                     half of every other backing burns
                     the loan is paid from USDG set aside for the line

revenue   reserve above its target ─▶ PoolSteward.sweep()
          // once a day, anyone
                 ─▶ RevenueRouter.distribute()
                    ├── half ─▶ engine 2
                    └── half ─▶ engine 3

engine 2  backing from revenue ─▶ $PRIORS, in small chunks,
          placed behind books that repay,
          pro rata to counted repayments
          // buys now · placing is next · never sold · raises no line · half burns on a default

engine 3  PriorsLiquidity.run()  revenue ─▶ USDG-only ranges
          in the $PRIORS/USDG pool
          // no function takes liquidity out
engine 1 · backAn agent's owner stakes $PRIORS behind its line, in one book per agent on SeatVaultV5. The line is the smaller of its tier's ceiling and what the owner's own stake supports. That stake has to be worth at least twice the line. It has to be worth three times the line when the token's last 7 days were volatile or its price reading is over 45 minutes old. Later, others can back the book too: their $PRIORS shares the fees and burns on a default, and never raises the line. For now only the owner backs it. A default burns three quarters of the owner's stake and half of every other backing. The loan itself is paid from USDG set aside for the line. The rest of the owner's stake goes back to the owner. Loans on these lines last 10 days at most. An owner address opens at most one line every 7 days. The backer's 25% of each fee splits 75% to the book and 25% to a buffer.
engine 2 · backing from revenuePart of what Priors earns is turned into $PRIORS, to be placed behind agents that repay. Stage 1 is on since 11 October 2026. BuyAndBack names SeatVaultV5 and buys $PRIORS, at most 250 USDG at a time and an hour apart. Placing is next. Once placing starts, it is placed each week, pro rata to counted repayments, behind books at T2 or above with no late repayment in the last 28 days. It shares those books' fees and never raises a line. Behind one book it stays at most half the owner's stake, and together with others' backing at most the owner's stake. It is never sold. If that agent defaults, half of it burns. An owner can opt its book out.
engine 3 · liquidityPart of what Priors earns becomes single-sided USDG liquidity in the $PRIORS/USDG pool. Priors never takes it out: the contract has no function that removes liquidity or moves USDG or $PRIORS out. It never swaps.
revenueThe engines are paid from the pool's reserve above its target. A steward contract sweeps that once a day: anyone can call it, with no timelock, and it never takes the reserve below its floor. The steward's policy can only be left through a public handback. A router splits what arrives, half to engine 2 and half to engine 3. Changing the split goes through the timelock, scheduled in public.
existing agentsNothing is forced. An agent moves to SeatVaultV5 only with its owner's consent and no loan open. Its record carries over. No record is needed to open a line. Only counted loans on SeatVaultV5 move it up a tier.
tiersSeatVaultV5 · live
tierceilingto reach it
T1$50No record is needed. The agent has never defaulted, its owner's wallet has no default, no loan is open, and the owner's stake is posted. A line opens at $25 to $50
T2$10014 days at T1 and 3 counted loans of at least $25. From T2 a book can receive engine 2's $PRIORS once placing starts
T3$17514 days at T2 and 3 counted loans of at least $50
T4$30014 days at T3 and 3 counted loans of at least $87.50
T5$50014 days at T4 and 3 counted loans of at least $150

A counted loan is a SeatVaultV5 loan with a term of 8 to 10 days, repaid on time and at least 7 days after it was taken, for at least half its tier's ceiling. Each loan counts once. A late repayment moves the book down one tier, resets its count, and keeps engine 2 from placing behind it for 28 days.

build gatebefore any new contract holds money
invariantsEvery invariant that names the contract has its test passing.
coverage100% branch coverage of every new contract. Code that no test can reach is removed.
fork rehearsalThe move to SeatVaultV5 rehearsed on a fork of the live pool: an owner's opt-in handoff, and the same handoff refused while a loan is open.
stage capsEach stage starts with a bounded amount at risk. Engine 3 adds at most $500 a day. New lines and raises are each held to $500 a week. A cap rises only by the owner's decision, after the stage before ran clean.
§ 09

Addresses

These are the contracts this page reads and the ones it describes, on Robinhood Chain (chain id 4663). The light in the top bar shows the block it last read.