A desk on Robinhood Chain
THE CURB
The position · Apple Inc. · all positions

Apple Position — Series 1

Exposure to Apple Inc., split across two stock-token issuers.

What one lot holds
Component A · Ethereumcandidate

AAPLx, held as the official non-rebasing wrapper, not raw AAPLx

xStocks (Backed) — the legal entity comes from the issuer’s documents, not assumed here

Not known, and not guessed
  • —Which wrapper address and version would be the component — to be checked on chain, not taken from the API.
  • —Whether the wrapper balance stays static through every corporate action. Shown for the 8 August 2026 dividend; no split on record.
  • —Whether a Curb series contract and its receipt holders are eligible holders.
What is known, the four checks, and sources
Known, from the issuer’s documents
  • —Apple exposure, deployed on Ethereum as an ERC-20.
  • —A non-rebasing wrapper in two versions; the public API returns wrapperAddress and wrapperAddressV2.
  • —Corporate actions change raw balances and multipliers, so the wrapper is the candidate unit.
Four checks, each on its own
Transferable from the series to a walleton a fork at block 26,276,737: a series took it in and paid it out — yes; across the issuer’s activation at block 25,706,680 the wrapper’s shares did not move
not determined
Unwrappable, if a wrapperon a fork at block 26,276,737: redeem for an arbitrary holder — no
not determined
A market offer for the intended sizethe wrapper holds 9.7772 of the raw token and has 9.7454 shares in all — a size to weigh any intended lot against
not determined
Eligible for redemption through the issuer
not determined

Each is a decision for whoever admits the part. The lines under them are dated evidence.

Sources
Component B · Ethereumcandidate

AAPLon

Ondo (Global Markets) — the legal entity comes from the issuer’s documents, not assumed here

Not known, and not guessed
  • —The address API needs a key (403 without one); the address used is the product page’s, read on chain daily.
  • —Whether a Curb series contract and its holders are eligible. Being able to hold is not eligibility.
  • —How corporate actions display across networks, for the version that would be used.
What is known, the four checks, and sources
Known, from the issuer’s documents
  • —AAPLon is live on Ethereum; the product page lists each deployment, its decimals and a live shares-per-token figure.
  • —Smart contracts may hold it, access rules still apply; transferable outside the U.S., with restrictions.
  • —Dividends are reinvested in the token price, so no cash balance arises in the series.
  • —Ankura Trust Company is security and attestation agent; Spearbit and Cyfrin are named auditors.
Four checks, each on its own
Transferable from the series to a walleton a fork at block 26,276,737: an arbitrary holder moved it — yes; a series took it in beside the real wrapper and paid both out — yes
not determined
Unwrappable, if a wrappernot a wrapper: the issuer’s token itself is the unit
not determined
A market offer for the intended size16,583.9610 tokens in all at that block — a size to weigh any intended lot against
not determined
Eligible for redemption through the issuer
not determined

Each is a decision for whoever admits the part. The lines under them are dated evidence.

Sources
Try it · Sample units only: no prices and no chain. Form lots, exit, and claim each part.
Simulation · illustrative units · no contract, no funds

Apple Position — Series 1

One lot holds 10 units of Mock A and 20 units of Mock B. Cap: 1,000 lots of liability, reserved included.

These mock quantities demonstrate bookkeeping. They are not stock-token amounts, wrapper share amounts or a production lot definition.

Preview · before anything is signed
Deposit A
30 units
Deposit B
60 units
Receipts
3 lots
Indicative value
not available
Gas
not estimated

Both deposits and the receipt would be one atomic transaction. The receipt cannot be sent or sold; exit is by claim, one component at a time.

The world, and the operator
The ledger · every figure in base units
every invariant holds
ComponentActiveReservedOwedHeldSurplus / short
A00000
B00000
Receipts outstanding
0
Your receipts
0
Your claim on A
0
Your claim on B
0
Invariants
  • ●R[A] = Σ claims[A]— 0 reserved, 0 in claims
  • ●B[A] ≥ L[A]— 0 held against 0 owed (0 active + 0 reserved)
  • ●L[A] ≤ cap × q[A]— 0 owed of 10000 permitted
  • ●R[B] = Σ claims[B]— 0 reserved, 0 in claims
  • ●B[B] ≥ L[B]— 0 held against 0 owed (0 active + 0 reserved)
  • ●L[B] ≤ cap × q[B]— 0 owed of 20000 permitted
  • ●n = Σ receipts— 0 outstanding, 0 held
What happened

Nothing yet. Mint some lots, or replay the worked example.

What this does not show
  • — No price, no value, no gas: the ledger counts units and nothing else.
  • — No wallet, no eligibility, no issuer contract: a halt here is a switch, not a reason.
  • — No reorg, no reentrancy, no chain: those require contract and chain tests, beyond this model.
  • — The same functions run in the repository’s tests; the worked example is reproduced there row by row.
Look up an address · See what the index holds for any address. Until a series is live, every address comes back empty.
My position · read only · nothing is connected

What the index holds for an address in this series: active receipts, the units they entitle, and open exit claims per component. Claims are listed apart from receipts and never counted as backing, so nothing is counted twice.

Nothing has been read. An address that has never touched the series reads as zero receipts and zero claims, not as an error.

What must happen first

Six checks before any real asset. Each is decided by a named person, not a model.

  • G1Instrumentin research

    A’s raw token, both wrappers and B’s token are read on Ethereum daily and match the issuers’ records. Related parties are mapped; B’s broker-dealer and custodian are not named.

  • G2Rights and accessnot started

    Technical ability to hold a token is not enough.

  • G3Componentsin research

    On an Ethereum fork the real wrapper transfers and unwraps, AAPLon transfers, and a series took both in and paid both out. Who stands behind each address is recorded. Through the 8 August 2026 dividend the wrapper’s shares held still (T14). No split on record; eligibility is not a fork question.

  • G4Contractin research

    The prototype in contracts/ passes T01–T12, T17, T19, T20, T22–T25 and a fuzz run. No independent review, no audit, no deployment.

  • G5Operationsin research

    Reconciliation, index recovery, the incident drill and wallet mint/claim are rehearsed on a local chain with mock components. A 2-of-3 treasury Safe is recorded on Robinhood Chain. An Ethereum series operator and key policy are not yet approved.

  • G6Economicsin research

    Gas to form and exit is measured on a fork, with no price applied. User need is not validated: the owner decided on 20 September 2026 not to hold interviews.

What we will say, and can test
  • —A holder can know and prove the composition of their position.
  • —The ledger never erases a right to a component that cannot yet be transferred.
  • —Mint and exit require no decision by a model.
What we will not say
  • ×Capital is protected.
  • ×It cannot be frozen.
  • ×It is the same as holding the share directly.
  • ×It is automatically safer.
  • ×It can always be sold at the reference value.
  • ×It earns more.
  • ×The issuers or custodians are fully independent of each other.
  • ×It is the first of its kind.
The full record

Everything behind the summary above, kept in full. Open what you need.

Related parties, as the issuers’ documents name them
Related parties · as the issuers’ documents name them · read 2026-09-12
Component A · AAPLx
issuer
Backed Assets (JE) Limited — issuer of the tracker certificate AAPLx (ISIN CH1436219187)AAPLx product page (last updated 30 June 2025, as the page says)
tokenizer
Backed Finance AG — tokenizer, as the product page lists itAAPLx product page (last updated 30 June 2025, as the page says)
broker
Alpaca Securities LLC — broker, one of three the product page listsAAPLx product page (last updated 30 June 2025, as the page says) · which broker holds the shares behind any given token is not stated
broker
InCore Bank AG — broker, one of three the product page listsAAPLx product page (last updated 30 June 2025, as the page says)
broker
Maerki Baumann & Co. AG — broker, one of three the product page listsAAPLx product page (last updated 30 June 2025, as the page says)
custodian
Alpaca Securities LLC — custodian, one of four the product page listsAAPLx product page (last updated 30 June 2025, as the page says) · the same firm is listed as broker and as custodian
custodian
InCore Bank AG — custodian, one of four the product page listsAAPLx product page (last updated 30 June 2025, as the page says) · the same firm is listed as broker and as custodian
custodian
Maerki Baumann & Co. AG — custodian, one of four the product page listsAAPLx product page (last updated 30 June 2025, as the page says) · the same firm is listed as broker and as custodian
custodian
GTN Europe Financial Services Limited — custodian, one of four the product page listsAAPLx product page (last updated 30 June 2025, as the page says)
security agent
Security Agent Services AG — security agent; the FAQ describes a three-party structure of issuer, custodians and an independent security agent that may take control of collateral accounts on issuer defaultAAPLx product page (last updated 30 June 2025, as the page says) · independence is the issuer’s description; the prospectus terms govern and are not read here
underlying
Apple Inc. (ISIN US0378331005, LEI HWUPKR0MPOU8FGXBT394) — the underlying; the token is a tracker certificate with economic exposure and no shareholder rightsxStocks FAQ
network
Ethereum (ERC-20); also Solana (SPL) and other networks the API lists — the deployment the series would use is EthereumAAPLx product page (last updated 30 June 2025, as the page says)
bridge
xStocks CCIP bridge (Chainlink CCIP) — moves xStocks between networks; the series does not use itxStocks FAQ · not a dependency of the series as designed; listed because the issuer lists it
contract authority
proxy admin 0x696c685a…a085 and owner() 0x49754062…3a65 (raw token); admin 0x31206300…8bfa (wrapper v2), admin 0xe39fffff…0cc7 (wrapper v1), the same owner() on all three — can replace the code behind the token and the wrappers (EIP-1967 proxies)the chain, at the recorded fork block · who those addresses belong to is not read from the chain and is not asserted; the issuer’s documents do not name them
issuer
Backed Assets (JE) Limited — sets the wrapper rules: the current wrapper uses the live multiplier and is the one to integrate; the v1 wrapper is unwrap-only and, in the issuer’s words, never to be used as collateral or a pricing source; the vault exchange rate is not a priceWrapped xStocks
issuer
Backed Assets (JE) Limited — publishes the multiplier on chain before each corporate action, activating at 00:30 UTC the day after the ex-date, and advises venues to pause around activationxStocks corporate actions · the series holds the wrapper, whose share count changes only on deposit and redeem; shown on a fork across the issuer's dividend activation of 8 August 2026 at block 25,706,680 (T14, contracts/evidence/apple-s1.corporate-action.json); a split is not on the record
Component B · AAPLon
issuer
Ondo Global Markets (BVI) Limited — issuer of Ondo Stocks, as the eligibility page names itOndo Stocks eligibility
broker
not known — the launch post says the platform acquires AAPL through “a U.S.-registered broker-dealer” and holds backing at “one or more U.S.-registered broker-dealers”Ondo Stocks launch post (3 September 2025) · no broker-dealer is named in the documents read
custodian
not known — the launch post says the underlying shares are held “with a regulated custodian”Ondo Stocks launch post (3 September 2025) · no custodian is named in the documents read
verification agent
Ankura Trust Company — conducts the daily attestations of holdings the trust page describes, said to be viewable from 1 October 2025Ondo Stocks trust & transparency · the attestations are not read here; independence is the issuer’s description
security agent
Ankura Trust Company, LLC — holds a first-priority, perfected security interest in the collateral for tokenholders and may take possession and distribute proceeds in specified events of issuer default; appointed by every acquirer on a secondary marketOndo Stocks secondary market restrictions · the same firm is named as security agent and as verification agent; independence is the issuer’s description
issuer
Ondo Global Markets (BVI) Limited — described as a special purpose vehicle with a distinct board and an independent director, majority-owned by Flux Finance, Inc., a subsidiary of the Ondo Foundation, which is said to guarantee an insurance fund; contracts said to be audited by Spearbit and CyfrinOndo Stocks trust & transparency · the audit reports and the fund’s terms are not read here
underlying
Apple Inc. — AAPL, held as shares behind a total-return tracker token — the token gives economic exposure with dividends reinvested; it is not a stock and gives no right to receive the sharesOndo Stocks launch post (3 September 2025)
settlement asset
USDon (Ondo’s stablecoin), with a USDC swapper — mint and redeem through the issuer settle in USDon; USDC converts 1:1 through a swapper whose liquidity bounds instant conversion; swapping needs whitelisting and the swapper has no UIOndo Stocks investing & redeeming · a dependency of issuer redemption, not of the series’ own mint and exit
network
Ethereum mainnet, BNB Chain and Solana; bridgeable to HyperEVM — the chains the technical page names; the deployment the series would use is EthereumOndo Stocks technical
network
AAPLon on Ethereum: 0x14c3abf9…2d4c, 18 decimals — the deployment as the issuer’s product page publishes it and the chain confirms (symbol, decimals, supply)AAPLon product page (app.ondo.finance) · the issuer’s documented API for the same record answers 403 without a key; the product page is the source used, never an example
contract authority
beacon 0x985462c9…1598; owner() and paused() not answered — can replace the code behind AAPLon (a beacon proxy: the implementation lives behind the beacon)the chain, at the recorded fork block · who controls the beacon is not read from the chain and is not asserted; the issuer’s documents do not name it
issuer
Ondo Global Markets (BVI) Limited — may pause trading around an ex-dividend date (the documents give 7:50–8:10 pm the day before, subject to change) and halt a token until a dividend amount is known; status.ondo.finance lists haltsOndo Stocks corporate actions · a halt at the issuer is exactly the case the series’ per-component claim is built for; it is not prevented by the series
Shared, or possibly shared

No party is named under both components in the documents read. That is a fact about the documents, not a finding of independence: component B’s broker-dealer and custodian are described but not named.

  • ?Alpaca Securities LLC — broker and custodian for A on the product page; named for B only in the launch post’s list of supporting “wallets, custodians, and exchanges” (as “Alpaca”), with no role stated for AAPLon.
  • ?Chainlink — the CCIP bridge the xStocks FAQ names for moving A between networks; listed in B’s launch post among supporters with no role stated; also the vendor of the price feeds the desk beneath this product reads on Robinhood Chain.

A role with no name is one the documents describe without naming the party. It stays empty on purpose: a name guessed from a partner list is a claim this desk refuses. The pages these lines come from are watched for change by hash; a changed page is a note on the desk and a reason to read them again.

Evidence and status: sources, the chain, deployment, tests
Evidence and status · what was fetched, what the chain said, what is deployed
Issuer sources · archived on a schedule, kept as received
Documents watched · 13 · hashed, never read for meaning
Deployment · index · reconciliation
Deployment
not deployed
Index
none — nothing is read from a chain for a series that is not deployed
The operator
no deployed series operator is recorded; the Robinhood treasury record does not verify an Ethereum operator
Reconciliation
none
Contract code
nothing to verify while no series is deployed; when one is, its code is compared with the build in this repository on every tick, immutables included
Sign it yourself
nothing is prepared for a series that is not deployed; when one is, the preview endpoints return the bytes for your own wallet, and the site still sends nothing

no reviewed deployment is configured for apple-s1; nothing is read from a chain for it

Indicative value · one lot · not available
A · 10 units
— not available · SOURCE_MALFORMED — rpc error 10: User balance exceeded
B · 20 units
— not available · SOURCE_MALFORMED — rpc error 10: User balance exceeded
Lot total
not totalled while a component has no price

an estimate from dated sources, each named with both of its times; not a quote, not an offer, and never totalled while a component has no price.

Contract tests · recorded run

54 passing · 0 failing at commit dccd2cb2de · 2026-10-26 12:04 UTC · solc 0.8.30 · fuzz seed 0x7727ea51… × 256 runs

a passing run is not a review and not an audit; it says these cases held at this commit with this seed

What the chain said · ethereum-mainnet · read 3h ago
RoleAddressCodeSymbolDec.asset() vs claimAnswers as tokenBehind it
A raw token0x9d275685…ec890atrueAAPLx18not applicableyesimpl. 0x65c40d62…
A wrapper v10x5aa7649f…9c0724truewAAPLx18matchesyesimpl. 0x14f37168…
A wrapper v20x943bf64d…c9de8ftruewAAPLx18matchesyesimpl. 0x76c6851e…
B issuer token0x14c3abf9…7b2d4ctrueAAPLon18not applicableyesbeacon 0x985462c9…

Read daily beside them: the raw token’s corporate-action multiplier 1.003269 · the current wrapper converts one share to 1.003269 raw. A move here is a corporate action, journalled as one; it is not a fault.

Across a corporate action · the issuer’s activation at block 25,706,680 · 2026-08-08 00:30 UTC · component A
  • yesthe raw token’s multiplier moved: 1.002664 → 1.003269 (+0.0603%)
  • yesthe wrapper’s shares did not move: 0.0498 before, 0.0498 after (T14)
  • yesthe wrapper’s raw balance moved with it: 0.0499 → 0.0500 (+0.0603%)
  • yesthe wrapper’s conversion rate equals the multiplier on both sides

Read at the block before the activation and at the activation block, on archive state. contracts/test/fork/AppleCorporateActionFork.t.sol on two forks of Ethereum at the block before and at the activation block, archive state; nothing sent. Not shown: the same for a split or a reverse split: this activation was a dividend reinvestment; anything about component B across this block: its dividends are documented as reflected in price, not balance, and are not read here; that the next activation behaves the same: each is a new event on the record.

On a fork of Ethereum · block 26,276,737 · 2026-10-26 12:03 UTC · component A
  • yesasset(), symbols and decimals as the issuer’s record says
  • yesan address that is nobody in particular can transfer the wrapper
  • yesa series contract took the real wrapper in and paid it out (mint, exit, claim)
  • nothe wrapper unwraps for such a holder: 10 shares → 0.0000 raw, as quoted
  • nothe raw token moves for such a holder: 1 sent, 0.0000 received
  • nothe raw token’s balance is a stored number
  • yesB · AAPLon answers as the issuer’s product page publishes it (symbol, 18 decimals)
  • yesB · an address that is nobody in particular can transfer AAPLon
  • yesB · a series took the real wrapper and real AAPLon in, one lot, and paid both out (mint, exit, claim A, claim B)

The wrapper held 9.7772 of the raw token and had 9.7454 shares in all at that block; AAPLon had 16,583.9610 tokens in all. contracts/test/fork/AppleComponentsFork.t.sol on a fork of Ethereum; balances set by storage, no holder impersonated; each recorded scenario restores clean fork state and transfer results use recipient balance deltas. Rerun: cd contracts && npm run test:fork.

What each operation cost to execute · at that block · gas
a plain transfer of the wrapper (holding A directly)
43,882
a plain transfer of AAPLon (holding B directly)
66,578
mint 3 lots (both deposits, the receipt)
170,806
allocate 3 lots for exit (no token moves)
90,740
claim A (the real wrapper moves out)
62,081
claim B (real AAPLon moves out)
65,102

execution gas by gasleft() deltas inside one call, with the real wrapper as A and real AAPLon as B: storage already touched is warm, so a real transaction pays cold access, the 21,000 base and its calldata on top; an input to a cost comparison, not a price. No gas price and no token price is applied here: a cost in money needs both, dated.

Who stands behind each address · at that block
AddressEIP-1967 implementationProxy adminowner()paused()
raw token 0x9d275685…0x65c40d62…f19b0x696c685a…a0850x49754062…3a65not answered
wrapper v2 0x943bf64d…0x76c6851e…55830x31206300…8bfa0x49754062…3a65not answered
wrapper v1 0x5aa7649f…0x14f37168…ad480xe39fffff…0cc70x49754062…3a65not answered
B · AAPLon 0x14c3abf9…behind beacon 0x985462c9…1598no slot setnot answerednot answered

Every address with an implementation slot set can have its code replaced by whoever controls its admin, and a beacon proxy by whoever controls its beacon; that is a fact about the instrument, not a fault. The three xStocks contracts answer owner() with one and the same address: one party stands behind the raw token and both wrappers. AAPLon answers neither owner() nor paused(); its code stands behind a beacon. Who those addresses belong to is not read from the chain and is not asserted here.

What this does not prove
  • — that the unit balance stays static through every corporate action: one dividend is on record (T14), no split
  • — that a Curb series contract or its receipt holders would be eligible holders
  • — anything about the issuer’s reserves, custody, or the value of a unit
The drill: incidents staged on a local chain
The drill · incidents staged on a local chain · 2026-09-13 10:52 UTC
  1. 1
    issuer freezes A

    while A was frozen a claim of A reverted and a claim of B paid; minting was refused; after the resume the A claim paid

  2. 2
    series short of A

    the reconciliation found A SHORTFALL by exactly what was seized and B MATCHED; the condition is DARK on A alone; on chain, claims of A halt and claims of B pay

  3. 3
    backend down

    a holder claimed B with no site involved — the permit is on chain — and the index, started afterwards, caught the claim up

  4. 4
    RPC fails

    with the node unreachable the index reported HEAD_UNREAD and kept its cursor and events; the reconciliation reported UNKNOWN for both components (STALE conditions), not a shortfall; when the node answered again the index continued from the same cursor with nothing to re-read

  5. 5
    source lost

    an issuer record that stops answering is a STALE condition naming the source; the last archived record stays on file and nothing is inferred from an example instead

  6. 6
    operator quorum

    the operator nominated a 2-of-3 multisig; one signature could not accept authority, two accepted; the former single key then could no longer stop minting; a stop and a resume each needed two signatures; the index recorded the nomination, accepted handover and both reasons

On chain · 26 transactions or refusals
  • the issuer of A (mock) halts every transfer of Atx 0x29f27f88…
  • alice claims her A (100 units reserved)reverted TransferFailed(0)
  • alice claims her B (200 units reserved)tx 0xb6a96be3…
  • carol tries to mint 5 lots while A is frozenreverted TransferFailed(0)
  • the issuer of A (mock) resumes transfers of Atx 0x3cc97bb8…
  • alice claims her A after the resumetx 0xa509fdbb…
  • bob claims his B with no backend involvedtx 0xb29657a5…
  • the operator (single key) nominates a 2-of-3 multisig without transferring authoritytx 0xe458c3dc…
  • signer 1 proposes acceptance from the nominated multisig (1 of 2)tx 0xbf96b705…
  • signer 2 confirms acceptance (2 of 2): the nominated multisig becomes operatortx 0xa2c57f29…
  • the former operator tries to stop minting alone after the handoverreverted NotOperator()
  • signer 1 proposes a stop of minting (1 of 2 confirmations)tx 0x20acf3ce…
  • carol mints 1 lot while the stop is still one signature shorttx 0x34ec19e4…
  • signer 2 confirms the stop (2 of 2): the multisig executes ittx 0xbb849558…
  • carol tries to mint 1 lot while minting is stoppedreverted MintPaused()
  • signer 3 proposes the resume (1 of 2)tx 0x825ac938…
  • carol tries to mint 1 lot while the resume is one signature shortreverted MintPaused()
  • signer 1 confirms the resume (2 of 2)tx 0xee9e443a…
  • carol mints 1 lot after the resumetx 0x1665d37e…
  • the issuer of A (mock) seizes 50000000000000000000 base units of A from the seriestx 0xb79fd191…
  • bob claims his A while the series is short of Areverted ShortfallHaltsPayment(0)
  • carol mints 5 lots while the series is short of Areverted BackingShort(0)
Limits
  • — the issuer of A is a mock whose freeze and seizure are switches; a real issuer’s actions have their own rules and timing
  • — no person was paged: the conditions here are computed, not delivered; delivery is the webhook’s job and was proven separately
  • — nothing here is a recovery: what was seized stays seized, and no rights were moved

a Hardhat node on one machine with mock components; not a public chain. Run by contracts/scripts/drill.ts (the chain half) and tests/positions-drill.test.ts (the site half), run by hand.

The rules of a series
  • —One company, two components from two issuers, one network.
  • —Fixed units of each component per lot, set once, never changed.
  • —Deposits are in kind and atomic: both arrive or no receipt.
  • —Exit burns the receipt; each component is claimed separately to the holder’s wallet.
  • —A receipt is one whole lot (decimals = 0): not one share, not one dollar.
  • —No rebalancing: a falling component is never bought more of.
  • —Receipts are not transferable here. Exit is by claim, not sale.
  • —An upgrade is a new series; components are never swapped under a holder.
  • —Mint and exit need no oracle and no model: rights are counted in units.
  • —Units sent straight to the contract change nothing and cannot be swept.
Deferred

Stablecoin deposit and an automatic router · Cash redemption · Dynamic rebalancing · Leverage, lending, insurance, bridges · Uncurated lists and permissionless series · Transferable receipts and a market for stuck claims · Reward tokens, buybacks, and governance that could change an old series’ backing.