Deposit & mint
Deposit USDG — the Minter computes NAV at that moment, buys the basket at constituent weights through the on-chain router and moves it into custody. You get a share proportional to your deposit against NAV.
0.15% mint fee
$INGT · V1 · Robinhood Chain · unaudited · July 2026
Analytics shows a price.
The vaultholdsthe asset
Ingot Finance builds sector index vaults for tokenized equities on Robinhood Chain. Deposit USDG — the protocol buys the basket at constituent weights and mints your vault share. Burn it at any moment and take the NAV back. Above the vaults sits the Foundry: agents that run your mandate inside on-chain guardrails and write down every decision.
0.15%mint & redeem feeNAVmint & burn at net asset valueDIVdividend pass-through to holders
0.15%mint & redeem fee
60sNAV snapshot
24hweight-drift check
5pprebalance trigger
2hstaleness cutoff
7iMAG7 constituents
01
The difference is custody
Analytical indices like VAULTS compute a basket price by formula and publish the composition. Ingot Finance holds the basket itself. The difference is simple: analytics shows the price — the vault stores the asset behind that price.
ANALYTICAL INDEX
Shows the price
Computes the basket price and publishes it. There is nothing behind the number: no assets, no mint, no redemption — and a dividend payout is physically impossible, because there is nothing to distribute.
INGOT VAULT
Holds the asset
Holds real tokenized equities in an on-chain custody contract. Shares are minted and burned at NAV, dividends on the underlying stocks reach the share holders.
Tokenized equities multiply faster than the tools to treat them as a portfolio. An investor sees dozens of individual tickers on Robinhood Chain and on Solana, but cannot buy a diversified basket in one transaction and redeem it at fair value. Funds and ETFs solve this on traditional markets through creation and redemption with authorized participants. On-chain, nobody has reproduced that mechanism in its pure form for tokenized equities yet.
02
Protocol mechanics
MINTUSDGMINTERDEX SWAPSCUSTODYVAULT SHARE
REDEEMBURN SHARESELL BASKETUSDG
Every rule is a contract, not a promise
Deposit, swaps, custody, rebalancing, oracle guards, dividend distribution and the agent guardrails are separate contracts with fixed parameters. The log on the right walks through that behaviour exactly as specified — including an agent tick and the policy check that refuses one. It is a scripted walkthrough, not live market data.
- ▸mint & redeem always settle at NAV
- ▸ rebalance only past 5pp drift — never on schedule alone
- ▸ stale feeds exclude an asset from NAV, never guess
- ▸all feeds stale → mint & redeem halt, funds stay put
- ▸ agents act only from their own account, never from yours
Redemption
Burn the share at any moment. The protocol sells your pro-rata slice of the basket back into USDG and sends it to you. In-kind redemption — taking the equities themselves — ships in V2.
0.15% redeem feeV2 in-kind
Peg to NAV
The share trades on DEXes independently of NAV — arbitrage closes every gap: mint at NAV when the market is above it, redeem at NAV when it is below. ETF creation & redemption, in a contract. The Peg Keeper watches that spread on the protocol's own account.
⇄ NAV both directions
Rebalancing
The Rebalancer checks weight drift every 24 hours and swaps only past 5 percentage points. Rebalancing on every snapshot, like analytical indices do, would burn holder returns on exchange fees.
24h drift check5pp trigger
Oracle guards
A feed silent past its max age marks its asset stale and drops it from NAV. If every feed goes stale at once, mint and redemption halt until recovery. Equity feeds are deviation-and-heartbeat driven, so off-hours gaps are normal and the exact age of every feed is published on the transparency page.
2h default cutoffHALT all stale
Dividends
The vault holds the real equities, so dividend payouts arrive on its balance and are distributed pro-rata by NAV share at the record date. An index without holdings has nothing to distribute.
DIV pro-rata at record date
The arbitrage loop
Price above NAV — arbitrageurs mint at NAV and sell. Below — buy and redeem. Both directions pull the market price back and keep the spread tight.
03
Agents on top of the vaults
A vault decides what to hold. It never decides when you should hold it. The Foundry is the layer above: a protocol-owned keeper defending the peg, and agents you forge yourself that run a mandate inside on-chain guardrails — each one writing down its reasoning before it is allowed to touch money.
TICKMANDATECONTEXTMODELPOLICY GUARDACCOUNTRECEIPT
REFUSEDRECEIPTREASON STOREDNO TX SENT
Peg Keeper
The protocol's own agent, owned by nobody's wallet but the treasury. Every minute it compares NAV per share with the share's DEX mid price; past the spread band it mints at NAV and sells, or buys and redeems at NAV. Until a share pool exists it runs in observe mode and records exactly what it would have done — labelled as observation, never dressed up as live arbitrage.
60s watch cadence100 bps action band
Allocator Agents
You write a mandate in plain English and pick a model. The mandate compiles into a policy — allocation bands per vault, a cash floor, a per-trade ceiling — and the agent runs from an account you deploy and own. Its session key may only mint and redeem Ingot vault shares from that account. It can never send funds anywhere, and one transaction revokes it.
CAPS per-tx & daily0 withdrawal rights
Reasoning Receipts
Every tick is journaled whether it trades or not: the context the model was handed, its decision and rationale, the policy verdict with the exact reason when it is refused, the transaction hash, the latency and the token counts. A failed or malformed model call produces a receipt and no transaction — the runtime is fail-safe by construction.
1 tick = 1 receiptTX hash on every execution
Triggerschedule
Decisiondeposit 250.00 USDG
VaultiMAG7
Confidence0.72
“Cash is 18.4% of equity, above the 10% floor and above the mandate’s target band. iMAG7 sits at 39.1% against a 30–70% band and no constituent is stale, so I am adding a single 250 USDG tranche rather than the full gap — the mandate asks for gradual entries on drawdowns, and yesterday’s deposit has not settled into the weights yet.”
per-tx cap · 250 ≤ 500 USDGdaily remaining · 1,750 USDGiMAG7 band · 30–70% → 41.8%cash floor · 10% preservedno stale constituent
tx 0x8f3c…a91d·latency 2,140 ms·3,812 in / 214 out tokens·policy approved
04
Vaults at launch
V1 · LIVE
iMAG7
The Magnificent 7 in tokenized form. iMAG7 opens the protocol because every constituent has a verified price feed and a pool deep enough to absorb a real deposit — the two conditions a vault needs before it can honestly mint at NAV.
Pool depth is the binding constraint today: deposits beyond roughly $2–3k can breach the 1.5% slippage guard on the thinnest leg and revert. The quote panel shows the price impact per constituent before you sign.
AAPLMSFTGOOGLAMZNNVDAMETATSLA
EQUAL WEIGHT · HELD IN CUSTODY
05
Smart-contract architecture
Vault Registry
Stores each vault's config: constituents, weights, token addresses
Minter
Handles deposits, swaps and share minting
RISK SURFACE · AUDIT V1Redeemer
Handles redemption and reverse swaps into USDG
Custody Vault
Holds the underlying tokenized equities — the value everything else orbits around
Rebalancer
Tracks weight drift and triggers correction past the threshold
Oracle Adapter
Aggregates prices and tracks staleness per feed
Dividend Distributor
Receives dividend payouts and distributes them to holders
Agent Account Factory
Deploys the guardrail account, owned by the user who sent the transaction
Agent Account
Holds the agent's USDG and shares; the session key may only mint and redeem
Peg Keeper
Protocol-owned NAV arbitrage, bounded by a per-action and a daily budget
CUSTODY IN V1 · HONEST DISCLOSURE
One key today. Multisig next. Audit before scale.
At launch the Custody Vault contract is controlled by a single owner key held by the team — not a multisig yet, and not fully permissionless logic. Saying “multisig” before the multisig exists would be the exact kind of detail this protocol refuses to bury. Moving ownership to a team multisig is the next governance step; full on-chain custody without a trusted party requires a separate audit of the swap and storage logic, and Ingot Finance does not launch that part until the audit is complete.
The Custody Vault and the Minter contract remain the protocol’s main risk surface until that review is passed. Deposits do not scale before the public audit of both contracts.
Agent accounts are a separate surface with a different shape: they hold only what their owner funds them with, the protocol never takes custody of them, and the session key inside them cannot withdraw — it can only mint and redeem Ingot vault shares.
06
Risks, stated plainly
Custody contract
The Custody Vault stores real value: a bug in its logic loses deposited assets — it doesn't just distort a chart, as in a purely analytical product.
Owner key in V1
Custody is controlled by a single owner key at launch, not a multisig. That adds trust in one operator on top of smart-contract risk, and it is the protocol's largest non-code risk today.
Oracle failure
An oracle that goes stale or feeds wrong data moves NAV in the wrong direction and opens an arbitrage window against the holders.
Basis risk
Tokenized equities trade with basis risk to the stock price on the traditional exchange: the gap widens in periods of thin liquidity, or when the exchange is closed while the token keeps trading.
Agent judgement
A model can reason badly. The guardrails bound the damage — caps, allocation bands, a cash floor, no withdrawal rights — but they cannot turn a poor allocation into a good one. Whatever your agent does remains your position.
Session keys
The agent's session key is generated and held encrypted by the backend. It can only mint and redeem for your account and can never withdraw, and one transaction revokes it — but until you revoke it, that key can act on your account.
07
The protocol token
$INGT launches on the Pons launchpad with a fixed supply and locked liquidity. It carries the brand and coordinates the people around it — and it is deliberately not the thing that holds the assets.
Fixed supply
A Pons launch mints its entire supply once and leaves no mint function behind. One billion units, immutable from the first block — the team cannot print more, and neither can the launchpad.
1e9 units, minted onceNONE further issuance
Locked liquidity
The launch pairs $INGT against WETH in a 1% Uniswap V3 pool and hands the position to the Pons locker. The liquidity is not ours to withdraw, which is the only version of that promise worth making.
WETH pair1% pool feeLOCKED LP position
A fee stream, if it is one
The locked position accrues trading fees: 70% to the fee wallet set at launch, 30% to Pons. The token page reads that wallet on chain and states plainly whether it is the Ingot treasury — a claim about protocol revenue has to be checkable.
70 / 30 creator / PonsON CHAIN wallet verified
A vault share is a claim on assets: iMAG7 is minted when you deposit USDG, burned when you redeem, and backed by tokenized equities held in custody. $INGT is not that. It gives no ownership of anything in the Custody Vault, no redemption at net asset value and no on-chain utility in V1. That is exactly why the vaults stay protocol-issued ERC-20s with a supply that moves on every deposit — and why only the fixed-supply protocol token belongs on a launchpad. Confusing the two is the one mistake this page exists to prevent.
08
Ingot vs analytical index
| Parameter | VAULTS | INGOT FINANCE |
|---|---|---|
| What it is | Index analytics | A real vault with deposits |
| Asset ownership | None | Yes, on-chain custody |
| Mint & redeem | None | Yes, at NAV |
| Dividends | Impossible | Pass-through to share holders |
| Token price | Informational | Arbitrage-pegged to NAV |
| Portfolio automation | None | Agents inside on-chain guardrail accounts |
| Decision trail | Not applicable | A reasoning receipt per tick, tx hash included |
| Risk surface | Minimal, data only | Vault contract and custody |