Paddock puts your tokenized stocks in an account that only you own, and gives one address you choose — a friend who trades, a bot, your own phone — permission to buy and sell inside it. Not to withdraw. Not to trade at a made-up price. Not to trade more in a day than you allow.
Two transactions from your wallet, and one address can trade for you. Nothing of Paddock's ever holds your money, and there is nothing of Paddock's to approve.
Paddock opens a Safe — the multisig most of crypto keeps its treasury in — with you as its only owner. Then it adds one module: Zodiac Roles, which decides what an address is allowed to call. You are the owner of both.
One address may trade. You set how far below Robinhood's published price a trade may ever settle (the band), how stale a price may be before nothing trades at all, and how many dollars may move in a day.
Send stocks or dollars to the account like any other address. They are yours the whole time: you can take everything back, swap the trader, or remove the module entirely, whenever you like, without anyone's cooperation.
"Trading access" usually means handing over the keys and hoping. These are enforced by contracts that were already on this chain — each one is a rule the chain refuses to break, and each was executed on a fork of the real chain before this page was written.
A trader cannot approve a spender, cannot call a contract you have not allowed, cannot send ether, and cannot raise their own limit — the module refuses every one of those before it reaches the chain. See the permission tree.
The dangerous hole in "they can trade but not withdraw" is price. Someone who can only trade can still push a thin pool far from the market, make your account sell into it, and push it back — and walk away with your money without ever holding it.
Robinhood publishes Chainlink-style price feeds for its own stocks on this chain. They are the only price here that does not come out of a Uniswap pool — a pool cannot move them. Before any swap runs, a contract called the Fence reads the feed and refuses the trade unless what it promises to bring back is at least the feed price, less your band.
The band has to cover the cost of trading honestly, or the trader cannot trade at all: the pool's fee (up to 1% on the thin ones) plus however far the pool has drifted from the tape. Measured over every listed stock at block 65,568,552, a $1,000 trade landed 32 bp under the feed at the median and 167 bp at the worst. A 2% band clears both with room; a 0.5% band would refuse trades in 8 of 26 of them.
| Stock | Robinhood feed | Pool | $1,000 buy | $1,000 sell | Deepest pool |
|---|---|---|---|---|---|
| AAPL Apple | $335.24 | $335.90 | 24 bp | -13 bp | $273,014 |
| AMD AMD | $546.81 | $546.66 | 33 bp | 40 bp | $145,880 |
| AMZN Amazon | $251.37 | $251.62 | 39 bp | 21 bp | $602,647 |
| ASML ASML Holding NV | $1,620.93 | $1,630.32 | 88 bp | 64 bp | $9,543 |
| BABA Alibaba | $108.55 | $108.62 | 40 bp | 29 bp | $57,737 |
| CRCL Circle Internet Group | $84.59 | $84.44 | 12 bp | 49 bp | $890,132 |
| DELL Dell | $586.42 | $584.48 | 71 bp | 138 bp | $247,647 |
| GME GameStop | $22.34 | $22.21 | 35 bp | -23 bp | $941,669 |
| GOOGL Alphabet Class A | $345.66 | $345.53 | 0 bp | 10 bp | $1.25m |
| INTC Intel | $111.05 | $110.85 | 47 bp | 71 bp | $90,079 |
| META Meta Platforms | $678.67 | $677.59 | 17 bp | 50 bp | $89,592 |
| MSFT Microsoft | $496.04 | $496.00 | 29 bp | 32 bp | $366,377 |
| MSTR Strategy Inc. | $132.77 | $131.98 | 42 bp | 97 bp | $297,650 |
| MU Micron Technology | $976.82 | $975.36 | 15 bp | 46 bp | $854,389 |
| NVDA NVIDIA | $219.67 | $219.52 | -3 bp | 13 bp | $3.18m |
| PLTR Palantir Technologies | $175.19 | $175.20 | 32 bp | 33 bp | $72,152 |
| QQQ Invesco QQQ | $716.62 | $717.02 | 10 bp | 0 bp | $544,279 |
| SGOV iShares 0-3 Month Treasury Bond | $101.06 | $100.90 | -2 bp | 12 bp | $2.40m |
| SLV iShares Silver Trust | $59.20 | $59.49 | 78 bp | -17 bp | $243,973 |
| SNDK Sandisk Corporation | $1,597.32 | $1,594.32 | 97 bp | 136 bp | $27,315 |
| SPCX Space Exploration Technologies Corp. Class A Common Stock | $155.13 | $154.97 | -6 bp | 16 bp | $1.59m |
| SPY SPDR S&P 500 ETF Trust | $762.86 | $762.61 | 1 bp | 10 bp | $197,973 |
| TSLA Tesla | $368.71 | $367.94 | 9 bp | 31 bp | $737,658 |
| TSM Taiwan Semiconductor Manufacturing | $428.79 | $426.17 | 44 bp | 167 bp | $62,987 |
| USAR USA Rare Earth | $15.76 | $15.76 | 45 bp | 39 bp | $32,243 |
| USO United States Oil Fund | $156.65 | $156.11 | -5 bp | 66 bp | $820,170 |
A fence is not a guardian. Here is exactly what a hostile trader can still do to you, and what the settings cost them.
Nothing stops a trader trading badly, or trading all day. Each round trip can lose up to your band, so the most you can lose in a day is roughly your band times your daily limit — $20.00 a day at $1,000 and 2%. Set the limit to what you would be willing to lose to a bad week.
Everything rests on Robinhood's own feeds being honest about Robinhood's own stocks. If a feed prints a wrong price, the Fence will enforce that wrong price. What the Fence can refuse is a feed that has stopped printing: after 4 days — your setting — it refuses every trade rather than trust a stale number.
23 of the chain's stocks are left out, and the page says why for each: 14 have only an "oracle" that reads the Uniswap pool itself — useless as a reference — and the rest have no v3 pool deep enough to trade in. Your account can still hold them; the trader simply cannot trade them.
Paddock takes no fee, has no token, and never sits between you and your money. These are measured on a fork of the real chain, at the gas price and ETH price at the time.
Measured on a fork of Robinhood Chain at block 65,711,223, priced at 0.0601 gwei and ETH at $2,453 — the gas price the chain reported and the price Robinhood's own ETH/USD feed reported when this was built. Opening an account is two transactions and the figure above is both together; most of it is approving all 26 listed stocks to Uniswap's router once, so the trader never needs another approval. The very first account opened on this chain also deploys the Fence — $0.439 extra, paid once by whoever is first, never again.
Named plainly, with what each one can do to you if it is wrong.
Your account. The canonical deployment — Safe's own registry lists this chain, and every code hash was compared with it. It holds everything; you are its only owner and its only signer.
The permission. Gnosis Guild's module, audited by G0 Group and Omniscia. Its address on this chain was re-derived from the initcode Gnosis Guild publishes, which is what proves the code there is that code.
A 4,128-byte contract with no owner, no upgrade path and no way to move a token. It is asked one question — is this price within the band — and can only answer yes or no. If it were wrong, the worst it could do is refuse honest trades, or allow a worse price than you asked for.
Every one of these is a command in this repository, and every number on this page comes out of one of them. What each check does.
No. Every swap they can make must pay the account itself — the permission compares the recipient with the account's own address and refuses anything else. They cannot transfer, approve, or send ether, because the only function they may call is a Uniswap swap.
Yes — by trading badly, within the band you set. That is the honest limit of this design: each trade can settle up to your band below Robinhood's price, and they can do that as often as your daily limit allows. See what this does not fix.
Send one transaction from your own wallet: freeze the trader, or remove the module entirely. Neither needs the trader's cooperation, and neither moves a single token. Withdrawing everything is also one transaction.
Yes. It is an ordinary Safe v1.4.1 (the L2 version, which emits the events Safe's app reads), and Safe's app supports this chain, so your account shows up there like any other — with Paddock's module listed under Apps → Zodiac.
Anyone, like any address on a public chain. Paddock stores nothing: the account's address is derived from your own wallet address, so this page finds your accounts again with no database and no login.
Robinhood's feeds stop printing when the US market shuts, and the chain keeps trading. Your freshness setting decides what happens: at the default, Friday's close is an acceptable reference for four days, so trading continues within the band around it. Set it to an hour if you would rather nothing traded out of hours.
Open an account, name one address, set a band and a daily limit. Two transactions, about $0.306 of gas.
Open an account →