how the numbers are produced.

haven is two layers over a wallet on Robinhood Chain. the analysis layer is entirely read-only: it calls eth_getBalance and erc-20 balanceOf through a public rpc and asks public price endpoints what those balances are worth. the hedge layer takes that measured exposure and constructs an offsetting short position, sized, margined and priced before you are asked to approve anything.

haven never holds keys, never takes custody, and never moves a balance on its own. a read-only session created by pasting an address cannot execute anything at all — it has no signer.

trust model

read-only by default; every state change is explicitly approved by you

storage

your positions, activity log and rewards progress live in this browser (localStorage), keyed per wallet address

server code

used only to proxy public price endpoints that browsers cannot call directly, because they send no CORS headers

no accounts

there is no login, no email, no server-side user record

all chain reads go to a single json-rpc endpoint on chain id 4663. addresses below are read live from the chain on the status page — haven checks that bytecode exists at each factory address, and reads symbol() and decimals() from each canonical token rather than trusting a hardcoded label.

chain

Robinhood Chain · id 4663

rpc

https://rpc.mainnet.chain.robinhood.com

explorer

https://robinhoodchain.blockscout.com

pons factory v1

0xA5aAb3F0c6EeadF30Ef1D3Eb997108E976351feB

pons factory v2

0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e

canonical WETH

0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73

canonical USDG

0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168

wrong-network handling: if a connected wallet reports a different chain id, quoting still runs on the read path but signing is blocked with the wrong-network reason until the wallet switches.

a scan runs in a fixed order and reports progress at each stage. it is deterministic: the same wallet and the same block produce the same holdings.

• 01connect to the rpc and read the native balance with eth_getBalance
• 02load the asset registry — every tokenized asset with a deployment on this chain id
• 03call balanceOf(wallet) on each registered token, batched 40 calls at a time, so one failing token cannot fail the scan
• 04discard every zero balance; a token you do not hold is never rendered
• 05request quotes for the symbols that survived, batched 12 symbols per request
• 06compute exposure, concentration and volatility from the priced subset

balance reads use Promise.allSettled, so a token whose contract reverts is skipped rather than aborting the scan. a token you hold whose price source did not answer is still listed, with its amount, and marked unpriced — it is excluded from portfolio totals rather than valued at zero.

no token amount is ever converted to a javascript float. amounts are bigint at their native decimals; usd is carried as bigint micro-dollars, so one dollar is 1_000_000 and the smallest representable unit is one millionth of a dollar.

value_micro = amount * price_micro / 10^decimals   // integer division
share_pct   = part_micro * 10000 / total_micro / 100
mid_micro   = (bid_micro + ask_micro) / 2
spread_bps  = (ask_micro - bid_micro) * 10000 / mid_micro

integer division truncates, so a displayed total can be under the true value by fractions of a cent — never over it. floats are used only for percentages, chart geometry and the volatility figure, never for a value that feeds sizing or margin.

formatting is decimal-string manipulation on the bigint: the whole part and fractional part are split and padded, so an eighteen-decimal balance renders exactly rather than through the nearest double.

haven uses two independent price paths, both proxied through its own server so no third-party key or browser call is involved, and both cached server-side so upstream rate limits cannot break the app.

registry

robinhood rhj/assets — symbol, name, decimals, deployment address, trading status

quotes

robinhood rhj/prices per symbol — bid, ask, daily high/low, daily volume, halt flag, generatedAt

cache

a quote refreshes after 60s and is served for up to 10 minutes; a symbol upstream has not answered is absent, never estimated

client poll

quotes are considered stale after 10s and refetched every 15s while a page is open

spot

coingecko simple/price for ethereum — usd, 24h change, upstream observation timestamp

history

coingecko market_chart, 30 daily closes, refreshed at most every 15 minutes

cache

at most one upstream spot call per 60 seconds for the entire app; the last good value is preserved through a rate limit rather than replaced by a guess

stale rule

an observation older than 5 minutes is flagged stale, and a stale mark blocks execution

scope

reference and analytics only — this is explicitly not an execution oracle

if a price service returns nothing at all, the affected field reads unavailable and the position it belongs to is excluded from totals. a loading request is shown as loading, never as zero.

exposure is computed only over priced holdings. gross exposure sums absolute values; net exposure sums signed values, so a short leg reduces it. today all wallet holdings are long spot, so the two match.

hhi = Σ (weight_i)²          // weight as a fraction of priced total
hhi > 0.50  → highly concentrated
hhi > 0.25  → concentrated
otherwise   → diversified

hhi is the herfindahl-hirschman index of position weights. a single-asset wallet scores 1.00 by definition — that is a real reading about your wallet, not a warning badge.

σ_portfolio = Σ ( σ_i × weight_i )   // weighted by priced value
σ_i         = stdev(daily log returns) × √365 × 100

volatility is realized, annualized from daily log returns over the available window — not implied and not forecast. an asset with no return history contributes nothing, and when no holding has history the portfolio volatility field is null rather than zero.

a protection level is a percentage of measured exposure, not a leverage setting. choosing 50% on $1,800 of ETH means shorting $900 of notional — after which roughly half of the next move in ETH is offset.

notional   = exposure_micro × protection_pct
collateral = notional × 20%      // initial margin
open fee   = notional × 8 bps
impact     = 4 bps modelled on notional

direct offset

short one asset at 100% of its notional — removes essentially all of its directional move

partial protection

the same short at 25/50/75% — keeps upside proportional to what is left unhedged

concentration hedge

offered when one name exceeds 35% of portfolio value; capped at 80% coverage of that name

portfolio beta hedge

a single index short against the whole stock-token sleeve, fewer legs than hedging each name, at the cost of basis risk

market-neutral pair

hold the long spot leg, short a correlated perp; isolates relative performance

volatility reduction

an overlay targeting realized variance rather than direction, sized at half the chosen protection level

a strategy only appears when the wallet actually contains the exposure it hedges. a sleeve you do not hold is not shown as an empty option.

no hedge router is deployed on Robinhood Chain yet. rather than invent an address, hedges are opened on the haven paper venue: real prices, real sizing, real margin, funding and pnl accounting, positions that persist and can be resized, topped up or closed — settled by this app rather than by a contract. references are labelled hpv1-… precisely so they can never be mistaken for a transaction hash.

initial margin

20% of notional posted at open

maintenance margin

8% of notional — below this the position liquidates

taker fee

8 bps on notional, charged at open and again at close

funding

1 bps per 8 hours paid by the short side, accrued continuously pro-rata rather than in jumps

modelled slippage

4 bps on notional

unrealized = ±notional × (mark − entry) / entry      // sign by direction
equity     = collateral + unrealized − funding
health     = equity / collateral × 100
liq_price(short) = entry + (collateral − maintenance − funding) × entry / notional

reducing a position realizes pnl on the closed slice at the current mark and charges the taker fee on the delta only. closing settles unrealized pnl, subtracts the close fee and all accrued funding, and writes both a close and a realized-pnl entry to the activity log.

every quote carries a lifecycle, and signing is refused rather than attempted whenever a precondition fails. the review dialog lists the exact reasons.

calculating → quote ready → reviewing

sizing and cost are computed, then held for a countdown

quote expired

the countdown ran out; a new quote must be produced before signing

awaiting signature → submitted → confirming → active

the approval path once every check passes

disconnected / wrong network

no signer, or the wallet is on another chain id

insufficient balance

collateral plus fees exceed what the wallet holds

stale market data

the mark is older than the staleness window

oracle unavailable

no valid current price for the protected asset

price impact exceeds limit

modelled impact is above the configured maximum

simulation failed

the pre-flight simulation did not succeed; nothing is submitted

view-only session

the address was pasted rather than connected, so there is no signer at all

a holding is hedge-eligible only when all four conditions hold at once. failing any one of them is reported as the specific reason, not as a generic error.

• 01a valid current price exists for the asset
• 02that price is not stale
• 03the venue reports enough liquidity for the requested notional
• 04a supported hedge instrument is registered for the symbol

haven's own read surface is public and unauthenticated. it proxies only public data, forwards no wallet address upstream, and returns an explicit error code instead of a placeholder when an upstream fails.

GET /api/public/rh/assets

tokenized asset registry with per-chain deployments

GET /api/public/rh/quotes?symbols=…

cached bid/ask/volume/halt per symbol, up to 80 symbols

GET /api/public/rh/corporate-actions

splits and similar events affecting stock tokens

GET /api/public/prices/eth

native reference price, 60s server cache, stale flag

GET /api/public/prices/eth/history

30 daily closes plus annualized realized volatility

upstream_unreachable / upstream_unavailable

the source did not answer, or answered with an error status

upstream_invalid_response

the body was not parsable json

price_unavailable · 503

no good value has ever been cached, so nothing can be served

• 01it does not custody assets, hold keys, or move funds without your approval
• 02it does not guarantee a hedge ratio: basis, funding and slippage all move against a perfect offset
• 03it does not predict prices, and shows no forecast, backtest or performance claim
• 04it does not price an unpriced asset, invent liquidity, or fill a missing field with a plausible number
• 05it does not report a hedge as onchain-settled while it is settled on the venue

hedging costs money in every state of the world: fees at open and close, funding for as long as the position is held, and forgone upside on the hedged share of your exposure. that is the price of removing downside, not a fee to be optimized away.