Tokenized stocks, priced by the real market.
Canopic quotes each Stock Token against USDG from the live Chainlink mid. The spread and the fee appear as separate lines before you sign, and every trade lands on-chain for anyone to check.
You send
You get
- Oracle mid
- 177.40 USDG
- Half-spread · 10.0 bps
- 9.99 USDG
- Inventory skew
- +0 bps
- Venue fee · 2.0 bps
- 2.00 USDG
Clears in one transaction, capped 75 bps from the mid
- Tier A spread
- 10 bps
- Each side, during regular US hours
- Venue fee
- 2 bps
- Printed as a separate quote line
- Price guard
- 75 bps
- The furthest any Tier A fill can land
- Clearing
- Atomic
- One transaction on Robinhood Chain
Listed right now: NVDAx in Tier A; SPYx in Tier A; AAPLx in Tier A; MSFTx in Tier A; QQQx in Tier A; TSLAx in Tier B; AMZNx in Tier B; PLTRx in Tier C.
Price formula
One open equation behind every quote
Quotes come out of fixed arithmetic applied to data that lives on-chain. Take the same inputs and you will arrive at the same number Canopic did.
quote = oracle mid + half-spread × session ± skew + venue fee
- oracle midPart 1
177.40 USDG
The Chainlink reading after it passes the guards. If a round comes back zero, out of date or implausible, the market pauses rather than trading on it.
- half-spread × sessionPart 2
10.0 bps at ×1.0
Each tier sets a base half-spread (Tier A uses 10 bps), which the session then scales: ×1.0 in regular hours, ×1.5 before and after them, ×3.0 when the exchange is shut.
- inventory skewPart 3
+0 bps
When a vault drifts away from holding half token and half USDG, trades that bring it back get a better price, up to ±15 bps on Tier A.
- venue feePart 4
2.0 bps
Appears as a separate line on the quote and as its own field in the emitted fill event, never folded into the price.
177.61USDG
A fixed guard rail sits around it. Should anything upstream misbehave, a Tier A trade still cannot clear more than 75 bps away from the mid.
Checked again at execution
Inside your transaction, the router works the vault price out afresh from the oracle and the vault's state. Whatever app you use, it cannot give you a worse deal than the formula allows.
Makers have to beat it
A signed RFQ quote from an attested maker wins only if it gives you more than the vault price. Quotes that lose cost the maker nothing, which keeps them coming.
Your limits are binding
Every order carries the slippage limit and expiry you signed. Should the market move beyond either before the block lands, the trade is cancelled instead of executed.
Market hours
Spreads that follow the exchange clock
A Stock Token can change hands at any hour, yet the stock behind it trades on an exchange for only about 32 hours each week. The oracle reports which session is in force, and each market prices that gap accordingly.
- Regular
Regular hours
spread at ×1.0 · clip unchanged
- Extended
Pre-market and after-hours
spread at ×1.5 · clip at ×0.75
- Off-hours
Exchange shut
spread at ×3.0 · clip at ×0.5
Saturday and Sunday count as off-hours throughout. Quotes keep coming at ×3.0 with clips cut in half, and the quote states this up front. Going silent would bolt exchange hours onto a network that never sleeps; pricing a weekend like a Tuesday would leave vault depositors absorbing every Monday open for free. When a trade can wait for regular hours it will cost less, and Canopic points that out rather than hiding it.
What pauses a market entirely
4- 1The latest oracle reading is older than this session allowsBack once a new oracle round arrives
- 2A corporate action is under way and the feed reports oraclePaused()Back once the feed comes back
- 3One oracle round moves the price by over 25%Back once a public review clears the timelock
- 4The sequencer went down, plus one hour of grace after it recoversBack once the hour of grace runs out
A pause freezes new quotes only. Depositors can take their funds out of a vault the whole time.
Routing
Vaults and makers, compared on every order
Everyday trades execute against vaults priced from the oracle, while large ones invite signed quotes from professional makers. Whichever offer leaves you better off is the one that clears.
- Layer 1
Oracle vaults
What it does
Each vault offers a bid and an ask around the checked Chainlink mid, widened according to tier, session and inventory. Everyday order sizes execute against them immediately.
Why it matters
Prices you can rebuild by hand from a published formula, and depositor returns that reflect what traders pay for instant execution, not what arbitrageurs leave behind.
- Layer 2
Maker quotes
What it does
Large orders are sent off-chain to attested market makers, who reply with signed prices. Quoting is free for them, and they only win the trade by outbidding the vault.
Why it matters
Big tickets get competitive pricing instead of sliding along a curve, then clear in a single step straight from the maker's wallet using an existing Permit2 approval.
- Layer 3
Smart routing
What it does
Every order enters through one contract. It checks eligibility and the price guard, weighs the vault price against any maker quote, and executes whichever is better for you.
Why it matters
Swapping one stock for another happens as two hops via USDG in one transaction. Should either hop fail its checks, neither one goes through.
Furthest from mid
75 bps
The Tier A price guard. Whether a vault or a maker fills you, the trade cannot land beyond this distance from the checked mid, regardless of other settings.
Total venue fee
2 bps
Listed on the quote and logged in the fill event, plus a 10% cut of the spread each vault earns. No charge is tucked inside the price.
Funds we hold
None
Assets stay in your own wallet or in vaults that depositors own. Because each trade clears in one transaction, Canopic never holds anything that could be lost.
Who it serves
Traders
Buy and sell around the clock with every cost broken out, and see which session applies on each quote.
Vault depositors
Fund a vault and collect the spread. Exits pay back in kind and stay open in every state, paused or halted, even once your attestation has expired.
Market makers
Sending a quote is free, you only fill when you beat the vault price, and every trade clears in one transaction.
Versus pools
Why ordinary AMMs misprice real stocks
A constant-product pool works for tokens that only trade on-chain. It falls apart when the true price is set on a stock exchange, as shallow pools showed when they quoted tokenized shares at large premiums around their 2025 debut.
Where prices come from
- x·y=k pool
- Set by whatever ratio the reserves are in
- Canopic
- Tied to the Chainlink mid and held within a fixed guard
Saturday and Sunday
- x·y=k pool
- Quoted exactly as on any weekday
- Canopic
- Off-hours pricing widens spreads and shrinks clips, and the quote says so
Depositor income
- x·y=k pool
- Lost to arbitrage whenever the real price shifts
- Canopic
- Depositors keep the spread, and skew pays traders who rebalance the vault
Stock splits
- x·y=k pool
- The pool breaks or has to be migrated
- Canopic
- Quoting halts and comes back once the feed reflects the split
Large orders
- x·y=k pool
- Pay more the further they push along the curve
- Canopic
- Attract competing signed quotes from makers
Charges
- x·y=k pool
- Folded invisibly into the curve
- Canopic
- Broken out on each quote and logged in the fill event
The two can coexist happily. Arbitrageurs who drag other pools towards Canopic's prices bring useful volume, and skew pricing rewards them for evening out the vaults as they go.
Network
Built on the chain that issues the stocks
On Robinhood Chain, and nowhere else, a regulated broker mints tokenized shares as standard ERC-20s. Chainlink prices them, anyone can deploy against them, and the broker's own customer base sits behind them.
- Network status
- LiveMainnet since 1 July 2026
- Blocks every
- ~250 mswith 100 ms preconfirmations
- Typical gas
- ~$0.001median per transaction, in ETH
- Listed equities
- 2,000+each one a standard ERC-20
- Built on
- Arbitrum Nitro, fully EVM-equivalent
- Data availability
- Blobs posted to Ethereum
- Token issuer
- Each token fully backed by Robinhood Assets (Jersey) Ltd
- Splits and dividends
- Handled by ERC-8056 uiMultiplier()
- Price data
- Chainlink feeds and Streams, which also report the session
- Settlement currency
- USDG from Paxos, issued natively, MiCA-regulated
- Wallets
- ERC-4337 and EIP-7702, with gas covered on your first trade
- Block explorer
- Every trade opens on Blockscout
- 01
Any wallet can hold and trade a Stock Token directly, since the issuer runs no allowlist on these plain ERC-20s.
- 02
The session signal that drives spreads arrives through the oracle, the very feed that sets each price.
- 03
Sub-cent transactions make small trades worthwhile and let quotes update ten times a second.
Guarantees
Eight promises you can test yourself
Claiming openness costs nothing, so each promise here comes with a way to prove it. Should one of them ever fail its test, we treat that as an incident and publish a full write-up.
Every fill broken down on-chain
Each fill event logs the mid, spread, skew and fee, line for line as the quote displayed them.
Verifycompare any receipt with its Blockscout entry
No trade outside the guard
This is enforced by a contract invariant rather than a promise, and it covers maker fills and vault fills equally.
Verifyrun the published invariant tests yourself
Execution data in the raw
How far every fill landed from the mid, updated live and available to download unprocessed.
Verifyderive every statistic from on-chain logs yourself
Order flow is never sold
Each trade clears on-chain at the best price the router can prove.
Verifyrerun the price comparison on any trade
Your assets stay yours
Trades clear in one transaction, and vault inventory belongs to depositors rather than to Canopic.
Verifysearch the audit reports for any way to move user funds
Exits that cannot be blocked
Depositors can leave a vault in every state, including when all pauses are switched on.
Verifyfind withdrawals made mid-halt on the Ledger
Setting changes are delayed and public
Any change to a parameter sits in a timelock queue with its stated reason before it can take effect.
Verifyread the governance history back to the first block
Open code that matches what runs
With each release, CI proves that the deployed bytecode is identical to the audited source.
Verifycompile the release tag and compare
Help
What people usually ask us
Short replies to the questions that come up most. The documentation covers each one in depth, including the maths and what happens when things go wrong.
What kind of platform is Canopic?
A swap venue that never takes custody of your funds. Prices come from oracle-priced vaults and competing makers, each trade clears in one transaction on Robinhood Chain, and Canopic never holds your assets. You will find no order book here and no balance to top up.
Why does the same stock cost more to trade at night?
Its home exchange has shut for the day, and vault depositors carry the risk of a price jump until it opens again. Off-hours quotes therefore use three times the usual spread and a smaller clip. The session tag on every quote shows the multiplier that applies before you confirm.
Does buying tokenized AAPL make me an Apple shareholder?
It does not. What you hold is a Stock Token, an ERC-20 debt security from Robinhood Assets (Jersey) Ltd that follows the share price, with dividends folded into the token by its ERC-8056 multiplier. Before your first trade you will see a disclosure explaining how this differs from owning the stock.
Where does a vault depositor's income come from?
From the spread their vault collects on each fill, after the protocol takes its 10%, building up as value per share. There are no token rewards or points. Classic impermanent loss is not a factor, since arbitrage against the reference price cannot bleed a vault that is priced from the oracle; the genuine risks, inventory exposure and weekend gaps, are spelled out and reflected in pricing.
Can anyone at Canopic change a price?
No. Every quote is produced by a published formula fed with on-chain data. It starts from the vetted Chainlink mid, widens it by a half-spread that depends on tier and session, nudges it for inventory, then adds a fee shown on its own line. The team cannot alter a quote or a fill, and settings only move through a timelock that carries a public explanation.
What is planned beyond Stock Tokens?
Launch covers Tier A equity markets with caps that everyone can see. After that come more Stock Tokens as their feeds and reviews are finished, followed by tokenized treasuries and gold under the same listing checks, then a public API and SDK, and finally a transfer of control to governance. No stage starts until the previous one has proven itself.
Is there a way to build Canopic into another app?
There is. The router is an open contract with a stable interface, and eligibility belongs to each user's wallet, not to the app they use. The quote API and TypeScript SDK arrive in the roadmap's infrastructure stage. No partner programme exists, and the official interface gets no special access.
Your first trade is minutes away.
Verify once and you can start trading right away. Depositors earn the spread on their vaults, makers quote for free, and each trade clears on Robinhood Chain.