Three parts, and you own all of them

A Paddock account is not a Paddock contract. It is a Safe, with one module, and one small contract the module consults about price.

Safe v1.4.1 (L2)                      you are the only owner, threshold 1
 └── module: Zodiac Roles v2.1.0      owner = the Safe · avatar = the Safe
      ├── role PADDOCK_BUY            SwapRouter02.exactInputSingle, dollars in
      ├── role PADDOCK_SELL           SwapRouter02.exactInputSingle, dollars out
      └── the trader, one address, a member of both roles
           └── each swap is checked against:
                recipient        = this account            (EqualToAvatar)
                fee              → the Fence               (Custom)
                amountIn / min   ≤ dollars left today      (WithinAllowance)

The account's address is decided before it exists: Safe's factory deploys with CREATE2, so your address plus a fixed salt gives the same account address every time. That is why this site can find your accounts again with no database, no login and nothing stored in your browser.

Two roles rather than one branching role for an unglamorous reason. Roles can express "either this shape or that one" with an Or, but when an Or refuses a call it reports only OrViolation and throws away the reason underneath — so every explanation the Fence gives would have been lost, and this page could not tell you why your trade was refused. One role per direction keeps the reasons.

What the trader may call, exactly

One function, on one contract: exactInputSingle on Uniswap's SwapRouter02. Everything else — approvals, transfers, ether, any other contract, any other function — is refused by the module before it reaches the chain. Within that one function, each field is pinned:

The two settings that live inside the permission — the band and the freshness limit — are packed into twelve bytes the module carries with the condition. Nothing on chain can read a condition back, so the Fence answers a question instead: a swap of an impossible size is refused with its reason set to those settings, and this page reads them from the refusal. Your account tells you its own rules.

The one contract that is ours

Roles can compare a field with a constant. It cannot ask whether a price is fair. So the fee field carries a Custom condition pointing at the Fence: 0x76EA82Df90d8926bE3488a109ae8FD7bA6D455B3.

The Fence is a 4,128-byte contract with no owner, no admin, no upgrade path and no storage anything can write after it is built. It cannot move a token. It is view: the module reaches it through a staticcall, and it can only answer yes or no.

What it does, for every swap:

• refuses anything that is not exactInputSingle on the router it was built with;
• refuses a swap that does not have USDG on exactly one side, or a stock it has no feed for;
• reads Robinhood's feed for that stock and Robinhood's USDG/USD feed, and refuses if either has not printed within your freshness limit;
• works out what the trade is worth at those prices, takes your band off it, and refuses unless amountOutMinimum is at least that;
• refuses the router's two sentinel values — amountIn = 0 ("swap whatever the router is holding") and recipient = address(2) ("leave it in the router").

The floor it computes is the same number this site shows you before you trade — the page asks the contract, rather than doing the sum again in JavaScript where the two could drift apart. And the suite checks that number against a third calculation done outside the contract entirely, straight from the feeds: they agree to the wei.

The Fence is deployed through the standard CREATE2 deployer, so its address is a function of its bytecode and its stock list. Rebuild it from contracts/Fence.sol and you get the same address, or you have different code.

Listed, and not listed

A stock is listed only if Robinhood publishes a price feed for it on this chain and it has a Uniswap v3 pool against USDG with real money in it. Feeds are not enumerable, so they are found through Morpho's markets — each market names an oracle, and the real oracles name a Chainlink-style feed underneath — and then checked one by one.

At block 65,568,552, 244 Morpho markets named 235 oracles, which named 82 feeds. 26 stocks came out of that with a Robinhood feed of their own AND a Uniswap v3 pool against USDG holding at least $5,000. 23 did not, and here is every one of them.

Uniswap v4 is not used. Its swaps go through the Universal Router, which packs the recipient inside a command blob that no permission rule can read — so a v4 trade could not be pinned to your account, and four stocks that trade only in v4 are left out rather than let in on weaker terms.

What was actually run

Every number on this site comes out of one of these, and the build refuses to fill a figure nobody computed.

The properties

Each one opens a real account on a fresh fork of Robinhood Chain — the real Safe factory, the real Roles module, the real Uniswap, the real feeds — and then tries to break it. Every "this is refused" carries a control in the same run proving the same call succeeds when the guard is removed.

The sabotage sweep

A green suite proves nothing on its own: a check that stopped checking looks exactly like a check that passes. So the build is broken on purpose, 25 ways — a condition loosened, a role misassigned, the price formula inverted — and each break must be caught by the property named for it.

25 of 25 were caught by the property named for them. None survived.

Read this before you put anything in it

• The Fence is not audited. It is short and it holds nothing, but it is new code, written for this site. If it were wrong in the dangerous direction it would let a trade settle further below the market than you asked for; the loss is still bounded by what the trader can move in a day.
• A trader can still lose your money honestly. Trading within the band, all day, costs you money. The daily limit is the real bound: assume it can be lost.
• The feeds are Robinhood's. If a feed prints a wrong price, the Fence enforces the wrong price. It can only refuse a feed that has stopped printing.
• Thin pools. The band is measured against the feed, not against the pool, so a thin pool does not let a trader take more than the band — but it does mean trades often fail to fill. That is a nuisance, not a loss.
• Your own key. The account is a 1-of-1 Safe: whoever holds your owner key holds the account. Paddock does not add recovery. If that key is the risk you are worried about, use a hardware wallet as the owner and a hot wallet as the trader — which is one of the reasons this exists.
• This chain is young. State is pruned after minutes, log history is served by one node, and the public RPC throttles hard. That affects reading, not your money.

Everything this site touches

Each row was read back on the live chain by tools/verify-infra.mjs, with controls that must fail: a random address, one registry hash held against the wrong contract, and the Roles initcode with a single byte changed.