How PROG programs
a token economy.
The technical reference for trading-tax intake, strategy composition, launch orchestration, receipt-backed discovery, authority, failure behavior, release gates, and APIs.
Two economic layers from one recurring fee stream.
PROG starts where a bonding-curve launch normally stops. Each settled creator-fee claim splits immutably: 5% enters the PROG protocol vault and 95% follows the project's committed policy across liquid reserves, weighted DeFi portfolios, custom tokenized-market baskets, treasury-owned or alliance liquidity, and project-token support.
The main PROG token adds a second layer. A built and tested—but not yet deployed—revenue flywheel is designed to route protocol revenue 50% to operations, 30% to automatic PROG buy-and-burn and 20% to permanently locked PROG/native liquidity.
It is not a principal floor, guaranteed-yield product, managed stock fund, dividend, holder redemption right, or guarantee of buybacks or price appreciation. It is experimental tokenomics infrastructure with explicit risk budgets and fail-closed execution.
- Chain
- Robinhood Chain · 4663
- Carrier
- Pons V2 (curve → V4)
- Reserve asset
- USDG
- Authority
- Project Safe (EIP-1271) + bounded operators
Ten sections. Every failure has a destination.
01Contract rolesTyped modules · bounded authority
01bOnchain / offchain boundaryVerifiable custody · fast control plane
Onchain
- Project identity, Pons binding and deployment provenance.
- Policy, metadata and strategy commitments.
- Owners, operators, caps, deadlines, pauses and exit rules.
- Timelocked factory/version admission and event-rebuildable registration.
Offchain
- Wallet UX, simulation, quotes and keeper scheduling.
- Full metadata, artwork, search, rankings and charts.
- RPC indexing, alerts and cached Explore views.
- Analytics may be replaced; contracts still enforce fund-moving bounds.
Upgrade model: existing treasuries are not controlled by a universal proxy admin. New code ships through a new versioned package, while project configuration changes remain bounded or timelocked. A paused reserve-only project can migrate only after PROG governance attests the exact replacement graph and project governance independently waits 48 hours. The treasury preserves the same owner, asset, policy, 5% fee, fee recipient, branch split, ceilings and accounting continuity; alliance and buyback migrations remain disabled in v1.
Status: the shared V2 factory, fixed registry, settlement, strategy and recovery infrastructure is live and exact-match verified on Robinhood Chain. Project/token creation remains disabled pending the PROG canary. The three flywheel contracts are tested source only and are not included in the 18 live deployments.
01cCertification matrix11 fork-certified lifecycles · experimental + unaudited
The current aggregate suites contain 198 Forge and 46 TypeScript tests. None of this substitutes for an independent audit.
02Creator-tax claim + conversionPull-based · fail-closed
Claimability invariant
escrow.credit(treasury) == amount operator → treasury.claimExact(amount) treasury → escrow.withdraw() // msg.sender = treasury destinationDelta == amount escrow.credit(treasury) == 0
Execution bounds
- 3% maximum slippage against the oracle quote.
- 15-minute maximum deadline.
- Independent ETH/USD and USDG/USD minimum; feed freshness bounded (1h / 26h).
- Runtime drift or a weak fill reverts atomically; tax stays in escrow.
- Fallback to the project Safe is a separate allowlisted operator action, never automatic.
03Strategy composition + redemptionCustom weights · up to 8 feeders
Creators set the top-level liquid, DeFi, and tokenized-market weights. Inside the DeFi sleeve they can compose up to eight admitted feeders with independent weights and caps. Strategy additions and cap increases are timelocked; disabling risk is immediate. Failed deposits remain liquid USDG.
Cash redemption unwinds only realizable positions. Locked strategy shares transfer pro rata in-kind, so early redeemers cannot drain cash and leave locked risk behind.
04Tokenized markets + high-water accounting12 admitted routes · 33 verified feeds
Every admitted route binds token runtime, Chainlink feed and aggregator, direct USDG pool, maximum feed age and maximum weight. A policy can select 1–8 routes. A single-asset thesis may use 100% of the market sleeve with an explicit concentration flag; multi-asset baskets enforce route-specific diversification caps.
Only realized gain above the adjusted high-water mark may leave. At most 50% of new gain enters a buyback, with a 25 USDG canary per batch because the downstream ETH/USDG route exceeded the 3% bound at larger sizes on the fork. The 33-feed universe is verified market data, not 33 executable routes.
05Ownership + holder benefitRead before buying
Live or implemented project mechanics
- Creator tax follows a published, inspectable policy instead of an opaque wallet.
- Treasury positions, caps, routes, limits and receipts are inspectable.
- Realized gain above the high-water mark can fund a capped buyback and burn of the launch token, on the Pons curve and in the graduated V4 pool.
Not current rights
- Holders do not own, redeem or receive treasury USDG, Spark/Morpho shares or stock tokens.
- No dividends, distributions, principal floor, guaranteed yield or guaranteed buyback size.
- A holder-owned reserve and direct cash distributions are roadmap modes that require new contracts and qualified legal review.
Reserve shares and stock-token positions belong to the configured project beneficiary. Direct distributions or a holder-owned reserve require separate contracts and qualified legal review before any public claim.
06Failure matrixA destination for every failure
07Risk registerValue can decline
- Market: tokenized-market and DeFi positions can lose value; the treasury is risk-bearing.
- Liquidity: routes can be too thin to execute within bounds; buybacks may not occur.
- Strategy: withdrawals can lock; protocols can lose funds.
- Issuer: stock-token rights, transfer eligibility and corporate actions vary and are not established by runtime tests.
- Oracle: stale or divergent data stops operation and can delay action.
- Governance: Safe signers, operators and timelocks remain trust dependencies.
- Contract: internal tests and fork evidence do not replace an independent audit.
- Third parties: Pons, Robinhood Chain, Spark, Morpho, Uniswap and Chainlink are independent systems PROG does not operate.
08Release gatesExperimental launch + future work
Experimental launch gates
Future scale-up considerations
Audit and legal work are not blockers imposed on the initial decentralized experiment. They remain available as future risk-reduction work if PROG gains traction, supports larger balances or expands its operating model.
PROG shared infrastructure is live on Robinhood Chain. No PROG token/project has launched, no canary funds have been routed, and public execution remains disabled.
09Plan-only APIRead-only · no execution
POST /api/plan/previewGET /api/plan/schemaGET /api/plan/exampleGET /api/catalogGET /api/readinessPOST /api/launch# reproduce the pinned example digest from any machine curl -s https://prog.build/api/plan/example | jq .plan \ | curl -s -X POST https://prog.build/api/plan/preview -H 'content-type: application/json' -d @- | jq .digest
The digest is keccak256 of the sorted-key JSON manifest. The launch workspace computes it locally and cross-checks it with the server; identical inputs always produce the same digest. GET /api/plan/example returns the fixture the test-suite pins.
Words used precisely.
Public copy says creator tax or trading tax. Literal ABI names appear only in technical contexts like this page and the evidence files.
The Pons fee charged on each buy and sell. PROG receives 5% of creator fees actually claimed through its settlement controller; the remaining 95% follows the creator's committed routing policy.
The undeployed, token-bound module designed to route PROG's platform revenue 50% to operations, 30% to PROG buy-and-burn and 20% to permanently locked PROG/native liquidity.
The runtime-locked PonsFeeTreasury that claims tax, converts to USDG and allocates by policy. Project-owned.
A market route or strategy whose token, feed and pool identities are runtime-locked under concentration caps and selectable in a plan. Fork-certified routes have also completed a signed deposit/exit lifecycle; read-certified routes have not.
The sleeve's adjusted peak value; only gain above it counts as realized and may fund a buyback.
A deliberately small execution bound (25 USDG per buyback batch) that grows only with observed liquidity.
The workspace produces a deterministic manifest and digest before any wallet request. The canary-gated orchestrator then reveals transactions one at a time after simulation and receipt verification.