JEL classification G11, G12, G23.   MSC 2020 91G10, 94A17.

Keywords:  constrained generation; transfer coefficient; selection versus allocation; concentration; tokenised equities; ERC-20 vault accounting; in-kind redemption; allowlists as containment

1Introduction

1.1 The sentence is the position

An investor with a view states it in words before stating it in weights. "Nuclear is the only way the AI buildout gets its power" is a complete investment thesis. It names a driver, asserts a causal channel and implies a set of beneficiaries. What it does not do is settle. To become a position it has to be resolved into instruments that exist, sized against one another, and held somewhere that can be redeemed.

Every step of that resolution destroys information, and the profession has organised itself around the last step. Optimisers, risk models and rebalancing schedules operate on the weight vector, which is the part of the process that arrives after the interesting decision has already been made. Section 4 shows this ordering is inverted: at the concentration levels a thesis basket actually runs, the choice of holdings carries an order of magnitude more expected active return than the choice of weights across them.

Theory is built around that finding. A creator writes a sentence. A model reads the chain first, selects between five and twelve tokenised equities from an allowlist of 194, weights them, and attaches one line of reasoning to each holding. The creator signs a single transaction and a vault is deployed. The vault is itself the ERC-20 token, so a holder of the token is a holder of the basket, with no share class between them and no manager to ask for their money back.

1.2 Four failures of the thematic basket, in the order they bind

Thematic investment products have an empirical record and it is poor. Ben-David, Franzoni, Kim and Moussawi document that specialised exchange-traded funds lose roughly 30% in risk-adjusted terms over their first five years, an alpha near $-6\%$ annually for newly launched products against $-0.24\%$ for broad-based ones, and that the indices these products track run up before launch and give the run-up back afterwards [1]. Their conclusion is unambiguous: by the time a thematic product reaches the market, the securities it holds have already reached their valuation peak. Any system that makes thematic baskets cheaper to create inherits this literature as its null hypothesis, and a design that does not answer it is a machine for reproducing a documented failure at lower marginal cost.

The failure decomposes into four parts, and they bind in this order.

Referential failure. The instruments named must exist. A selector operating over the space of plausible ticker strings will emit plausible strings, and plausibility is not existence. At any per-name validity $p$, the probability that an unfiltered basket of eight names is wholly valid is $p^8$, which falls below 80% at $p=0.97$. This is arithmetic rather than an empirical claim about any particular model, and it is why §6 treats the allowlist as a projection applied after generation rather than an instruction issued before it.

Expressive failure. A basket that ranks nothing has said nothing. Proposition 1 makes this exact: the equal-weighted portfolio is the unique weight vector whose active weights vanish identically, so its transfer coefficient against every cross-sectional signal is zero. A model that returns equal weights has produced a set, not a portfolio, and the distinction is measurable at the moment of publication rather than after a year of returns.

Dimensional failure. Adding holdings diversifies away idiosyncratic noise and dilutes thesis relevance at the same time, because candidates are admitted in descending order of how well they express the sentence. The two effects trade against each other and the trade has an interior solution. Section 5 locates it.

Custodial failure. A thematic product is a promise about what is held. On chain, the promise can be a constraint. The reachable state space of a Theory vault is the set of sparse subsets of a fixed allowlist, so the worst outcome a creator can arrange for a holder is the worst outcome of the equities on that list. Section 6 states the bound and Appendix D lists the allowlist authority that enforces it.

1.3 What Robinhood Chain changes

Equities are ERC-20 contracts. Tokenised stocks and exchange-traded funds on this chain are ordinary tokens with 18 decimals, transferable at any hour because blocks do not stop, and carrying the ERC-8056 scaled-amount extension so corporate actions do not rewrite raw balances [13, 14]. Independent indexing of the tokens' first week found 46% of stock-token transfers settling outside regular exchange session times [2, 3]. A basket of equities can therefore be a token holding other tokens, with no custodian, no transfer agent and no creation-redemption mechanism operated by an authorised participant.

A vault can be its own share class. The ERC-4626 tradition separates the vault from the share and then spends considerable design effort reconnecting them [4]. When the assets are themselves ERC-20 contracts on the same chain, the vault contract can simply be the ERC-20, and pro-rata redemption in kind becomes a transfer loop over the holdings, with no settlement process in between.

The chain has no exchange yet. This is the constraint the deployment is honest about. There is no venue on Robinhood Chain through which a keeper could convert a sleeve asset into basket holdings, and Theory's router address is therefore the zero address. Section 11 treats this as a commitment device: a contract that has no venue to trade through cannot mistrade, and a reader verifying that claim reads one storage slot rather than auditing a policy.

1.4 Thesis

The claim of this paper is narrow and checkable. The map from a sentence to a basket is a composition of four operations, each of which can be specified, bounded and independently verified: a generator proposing candidates, a projection onto an allowlist that admits only instruments the authority has vouched for, a concentration step that forces the selector to rank and records the reason for each holding, and a commitment in which the creator signs and the factory deploys. The value in the system sits in the first two operations and the last one. The weighting step, which is where portfolio technology conventionally concentrates, contributes 7.6% of the expected active return at eight holdings, and this paper reports that number rather than concealing it.

1.5 Contributions

C1. Proposition 1, that the active weights of an equal-weighted basket vanish identically and its transfer coefficient against every cross-sectional signal is therefore exactly zero, together with the entropy characterisation that makes equal weight the unique maximum-entropy weight vector on its support (§4.1, Appendix A).

C2. A quantitative decomposition of basket active return into selection and weighting components under a calibrated cross-sectional model, giving a dominance ratio of 12.2 at eight holdings and 19.8 at five, with the honest reading that concentration is worth a small fraction of the total (§4.2).

C3. Proposition 3, a holdings-count optimum derived from geometric relevance decay, whose argument ranges over 5 to 12 as the decay length ranges over 4 to 9.5, deriving the contract's holdings band from the model rather than from taste (§5, Appendix B).

C4. Proposition 4, the containment theorem: the reachable state space of a vault is $4.49\times 10^{18}$ sparse faces of a fixed 194-simplex, which bounds creator-imposed loss by the worst drawdown of an allowlisted equity and excludes creator-minted tokens by construction (§6.3).

C5. An analysis of the inherited two-clock problem, showing that basket structure cuts the 99th-percentile weekend mark error from 14.00% on a single tokenised equity to 6.36% on an eight-holding basket, and that unpausable in-kind redemption removes the residue from the exit path entirely (§7).

C6. A valuation of the creator's revision right as a perpetual switching option, giving 148 basis points per revision at a signal persistence of 0.6, against which the 200 basis point fee cap and the 50 basis point protocol fee are priced, and a break-even information coefficient of 0.069 for a creator charging the cap at four revisions a year (§8).

C7. A complete protocol specification with twelve invariants stated in a form suitable for formal verification, the deployed parameter set, and a threat model that names the residual trust surface in every row (§9 to §12, Appendix D).

1.6 Notation

2Related Work

2.1 The empirical record of thematic products

The reference point for any system that manufactures thesis-shaped portfolios is the specialised exchange-traded fund. Ben-David, Franzoni, Kim and Moussawi assemble the full cross-section and find that specialised funds underperform by roughly 30% in risk-adjusted terms over their first five years, concentrated in the launch cohort, while broad-based funds show an alpha statistically indistinguishable from zero [1]. Their mechanism matters more than the magnitude. Issuers launch when attention peaks, the underlying index has already appreciated, and the post-launch period gives the appreciation back. The finding is about the timing of issuance and the incentives of issuers, and it applies with full force to a protocol that reduces the cost of issuance to a gas fee.

Theory's answer is structural in two places and honest in a third. The creator owns the vault and may revise it, so the basket is a maintained position with a public revision history rather than a fixed index snapshot; §8 prices that right and shows what a creator must deliver to justify charging for it. The cost stack is 50 basis points of protocol fee plus a creator fee capped at 200, so the worst case fee load is 250 basis points, which is 41.7% of the 600 basis point launch-timing drag the literature documents for newly launched specialised products. And the honest third point: a Theory vault whose creator never revises it is, statistically, a thematic index fund launched at peak attention, and a holder should price it as one.

2.2 The fundamental law and the transfer coefficient

Grinold's formulation relates the information ratio of an active strategy to skill and breadth, and Clarke, de Silva and Thorley extend it to constrained portfolios by introducing the transfer coefficient, the correlation between the active weights a manager actually holds and the active weights an unconstrained optimiser would hold given the same forecasts [5, 6]. The extension is the piece this paper uses. It converts "how much of the manager's view reached the portfolio" from a rhetorical question into a scalar between zero and one, and Proposition 1 evaluates that scalar at exactly zero for the equal-weighted case. Perold's implementation shortfall provides the complementary accounting on the execution side [7].

Brinson-style attribution decomposes active return into allocation and selection effects [8]. The decomposition in §4.2 is the within-basket analogue: the choice of support against the choice of weights on that support, evaluated over a universe of fixed size with an explicit information coefficient rather than against a benchmark's sector weights.

2.3 Vault standards and share accounting

ERC-4626 fixes the share interface and, more importantly for this design, the rounding conventions: shares issued for assets round down, assets released for shares round down, and every rounding decision favours the vault over the caller [4]. The inflation or donation attack against an empty vault, in which a first depositor mints one share and then transfers assets directly to the vault contract so that a second depositor's deposit rounds to zero shares, is well documented, and the accepted mitigations are a virtual offset added to both numerator and denominator, internal balance tracking, and locked shares minted at genesis [9, 10, 11]. Section 9.3 adopts locked genesis shares at par together with floor-toward-vault division on every quantity, and Appendix C states the resulting worst-case bound.

Theory departs from ERC-4626 in one respect and the departure is deliberate. A 4626 vault holds one underlying asset and issues a share denominated in it. A Theory vault holds a basket and is the share, which makes the natural exit an in-kind transfer of the pro-rata slice rather than a conversion. Section 9.7 specifies that path and §7.3 explains why making it unpausable is the single most load-bearing safety decision in the protocol.

2.4 Generation under a hard constraint

A language model asked to name instruments produces strings that are distributed like instrument names, and the failure mode of interest is a well-formed reference to something that does not exist. The engineering literature calls the general remedy grounding, and its strong form is constrained decoding, in which the admissible output set is enforced during generation. Theory uses the weaker and more auditable form: generate freely, then project onto a set fixed on chain in advance, and drop anything outside it before a human sees the result. The projection is verifiable by a third party reading the factory's allowlist, and it composes with the containment argument of §6.3, which needs only that the admitted set is fixed and public.

3The Map From a Sentence to a Basket

3.1 Definition

Let $A$ be the allowlist, a fixed finite set of tokenised equities, $|A|=194$. A theory is a triple $(t,S,w)$ where $t$ is a natural-language thesis, $S\subseteq A$ is a support with $5\le |S|\le 12$, and $w$ assigns to each member of $S$ a weight in basis points with $\sum w_i=10,000$ exactly. Each holding additionally carries a rationale $c_i$, one sentence stating why that instrument belongs in this thesis. A theory is published when its creator signs the transaction that deploys its vault, and the vault contract is thereafter both the custodian of the basket and the ERC-20 token representing claims on it.

3.2 The pipeline

The map is a composition of four operations applied in a fixed order.

Generate. The selector is handed the full contents of $A$ as part of its input and asked for candidates with reasoning. It is given the universe rather than asked to recall it, which removes the recall problem and leaves only the selection problem.

Project. Addresses are attached afterwards by lookup against the same list. Any candidate without a match is dropped before the result is displayed, so a reference to an instrument that does not exist on this chain cannot reach a creator, let alone a vault.

Concentrate. The result must rank. A returned vector within rounding of equal weight is rejected and the selector is asked again, on the grounds established in §4.1 that such a vector carries no information about the ordering of its own holdings.

Commit. The creator connects a wallet, reviews the basket and its rationales, and signs once. The factory deploys a vault, records the creator as its owner, and emits the theory as an on-chain event. Ownership of the revision right follows the signature, so the right to change the basket belongs to the person who published it.

3.3 How much of the sentence survives

The pipeline is lossy and the loss is measurable. Printed English carries on the order of 1.0 to 1.5 bits per character under Shannon's estimates [12], and a fifteen-word thesis of roughly ninety characters therefore carries around 112 bits at the middle of that range. The basket it produces carries ${\log }_2\left(\genfrac{}{}{0ex}{}{194}{8}\right)=45.3$ bits in the choice of support and, at a 250 basis point weight grid coarse enough that two adjacent vectors are economically indistinguishable, a further ${\log }_2\left(\genfrac{}{}{0ex}{}{39}{7}\right)=23.9$ bits in the weights, for a total of 69.2 bits.

The basket therefore retains about 61% of the sentence. The 43 bits that do not survive are the part of the thesis that explains why, and a weight vector has no place to put them. This is the argument for the per-holding rationale, which the interface requires: it is where the residual is stored, it is what a reader uses to judge whether the selector understood the sentence, and it is what makes a revision legible when the creator changes their mind.

4Selection

4.1 Proposition 1: equal weight is orthogonal to every thesis

Fix a support $S$ of size $n$ and a weight vector $w$ on it. Let $z$ be any cross-sectional signal, standardised over the universe, whose values on $S$ are $z_1\dots z_n$. Under a linear forecast $E[r_i]=\mathrm{IC}\cdot {\sigma }_x\cdot z_i$, the basket's expected return separates exactly:

where ${\bar{z}}_S$ is the mean signal on the support and $a$ is the vector of active weights. The first term depends only on which names are in $S$. The second is the only term that depends on how they are ranked against one another.

The statement is stronger than an observation about diversification. It does not say an equal-weighted basket is poorly ranked, or approximately unopinionated, or unlikely to express a view. It says the ranking component of its expected return is identically zero for every signal that could have been used to build it, including the correct one. A selector that returns equal weights has produced a set of instruments and has declined to say anything further, and this can be established at the moment of publication without waiting for returns.

The entropy characterisation is the same fact in a second language and is the one worth reporting on a product surface. For the declining conviction vector Theory's interface treats as a reference shape at eight holdings, entropy is 1.936 nats against a maximum of $\ln 8=2.079$, so the basket carries 0.144 nats of ordering and has 6.93 effective names against a nominal eight. A published theory that reports 8.00 effective names against eight holdings is reporting that its creator's model declined to answer the question.

4.2 Proposition 2: selection dominates weighting by an order of magnitude

Proposition 1 says the ranking term can be zero. It does not say how large that term is when it is not. The honest answer is that it is small, and a paper written by the team that enforces the concentration rule should say so first.

Calibrate a standard cross-sectional model to single-name annual return dispersion ${\sigma }_x=35\%$ and an information coefficient $\mathrm{IC}=0.05$, which is a defensible figure for a skilled discretionary forecast and a generous one for an automated selector. Draw the signal over 194 names, take the top $n$ as the support, and evaluate the two terms of Eq. 1 separately.

Three readings follow, and the third is the one that governs the design.

The first reading is that the entire portfolio-construction industry addresses the small term. Optimisers, covariance shrinkage and rebalancing schedules operate on $a$. They are worth having, and they are worth roughly a twelfth of what the selector is worth.

The second is that the allowlist is therefore the binding design decision in this protocol. Selection quality is bounded above by what is in $A$, and a thesis whose natural expressions are absent from the universe cannot be expressed at any weighting. Section 6.1 states what the allowlist admits and Appendix D gives the authority that maintains it.

The third is that Theory's concentration requirement cannot be justified as a return enhancement, and is not. Moving from equal weight to the reference conviction shape raises expected active return by 8.2% at eight holdings, from 3.70% to 4.00% a year, which is real and modest. The requirement is enforced because a selector that will not rank its own picks has usually failed to resolve the sentence, and refusing the flat vector is the cheapest available test of that. Concentration is a diagnostic applied to the model, and its return contribution is a secondary benefit.

5Concentration

5.1 Why the holdings count has an interior optimum

Write the return of the $k$-th ranked candidate as a loading on the thesis plus noise, $r_k={\beta }_{k}F+{\epsilon }_k$, with $F$ the thesis factor normalised to unit variance and ${\epsilon }_k$ independent with volatility ${\sigma }_{\epsilon }$. Candidates arrive in descending order of relevance, so $\beta$ declines in rank. Model the decline geometrically with a decay length $\kappa$ measured in names:

A decay length of four describes a thesis with four or five genuine expressions and a long tail of loosely related names. A decay length of ten describes a thesis with a dozen roughly equivalent ways to own it. Both are common and the distinction is a property of the sentence.

For an equal-weighted basket of the top $n$ candidates the thesis share of basket variance is

which is increasing in the single quantity $n{\bar{\beta }}^2$. That quantity rises at small $n$, because averaging independent noise over more names dominates, and falls at large $n$, because $\bar{\beta }$ is dragged down by candidates the thesis barely reaches. The maximum is interior.

5.2 Proposition 3: the optimum, and where the deployed band comes from

This is the derivation of a contract constant. The factory requires between five and twelve holdings and hard-caps at twelve, and the band is the span of the optimum across the range of relevance decay a thesis can plausibly have. Five is the optimum for the sharpest thesis worth publishing. Twelve is one name below the optimum at the most generous decay length considered here, which makes the cap a mild constraint at the permissive end and no constraint at all in the middle of the range.

The asymmetry in Table 4 is the operationally useful part. Undershooting is punished hard and quickly: a three-name basket keeps 76.1% of the achievable thesis exposure and a single name keeps 34.8%, which is the arithmetic behind the floor of five. Overshooting is punished gently at first and then steadily, so a twenty-name basket still keeps 68.6%. The cap at twelve therefore costs a permissive thesis very little, and the floor at five is doing the more important work.

Section 4.2 and Proposition 3 point in the same direction from different premises. Selection is where the return is, and a basket wide enough to dilute selection has given away the only large term it had.

6Containment

6.1 The allowlist is a projection, applied after generation

The factory holds an allowlist of tokenised equities that its authority has admitted. At the current deployment every tokenised equity on the chain is admitted, 194 of 194, established across five allowlist batches at a total protocol deployment cost of 0.00347 ETH, which works out at 17.9 micro-ETH per admitted name. Admission is a statement that the instrument exists on this chain and is an equity or fund token. It carries no view on the instrument's merit.

The allowlist is applied as a projection after the selector has produced candidates, and this ordering is deliberate. A model instructed to restrict itself to a list can fail to comply, and compliance is difficult for a third party to verify. A lookup performed against the on-chain list either matches or does not, and a reader can check the list themselves.

6.2 The arithmetic of referential failure

Let $p$ be the probability that any single name an unconstrained selector emits refers to an instrument that exists in the intended universe. The probability that a basket of $n$ names is wholly valid is $p^n$, and the compounding is unforgiving at the holdings counts §5 argues for.

A per-name validity of 0.97 is a demanding standard for open-ended generation over a niche universe, and at eight holdings it still leaves better than one basket in five carrying an instrument that does not exist. The table is arithmetic and makes no claim about any specific model. Its purpose is to establish that referential correctness at basket level cannot be reached by improving the generator, because the required per-name rate rises as $n$ grows while the generator's rate does not.

6.3 Proposition 4: the reachable state space and the loss bound

The safety property a holder actually needs is not that the creator is trustworthy. It is that the set of things the creator can do is small enough to reason about. Theory makes that set explicit.

The bound matters because of what it excludes. What destroys holders of creator-controlled on-chain products is a portfolio pointed at an instrument whose supply the creator controls, after which the claim is a claim on nothing. A bad portfolio costs a holder money; that path costs them everything. It requires the vault to be able to hold an arbitrary token, and Theory's vaults cannot. What remains is equity risk, which is unbounded in the ordinary sense that equities fall and bounded in the sense that matters: it is the same risk the holder took when they read the thesis, priced by a market the creator does not operate.

Two consequences follow for how a holder should read a theory. The revision right is wide, 62 bits of it, so a creator can change the character of a basket substantially without leaving the reachable set, and a holder who has not read the changelog does not know what they own. And the allowlist authority is the single most consequential role in the protocol, because admitting an instrument extends $A$ for every vault at once, including vaults deployed before the admission. Section 12 places that role in the threat model and Appendix D names the address that holds it.

7The Two Clocks

7.1 A basket that never closes, priced by feeds that do

Tokenised equities transfer at any hour because blocks do not stop, while the reference feeds that price them publish on a 24/5 schedule and hold their last print outside it [3]. For roughly 48 hours of each week, plus market holidays, a Theory vault's holdings continue to trade while the marks used to value them are frozen. Independent indexing of the tokens' first week found 46% of stock-token transfers settling outside regular session times, so the window is populated rather than dormant [2].

For a lending protocol this is a solvency problem, because liquidation is priced off the frozen mark. For a vault that holds equities outright the exposure is narrower and worth stating precisely: the frozen mark can only mis-price entry. A depositor minting shares against a stale net asset value pays or receives the mark error. A holder leaving through in-kind redemption receives a slice of the actual holdings and is unaffected by what any price feed says, because no price enters the computation.

7.2 The basket cuts the tail by more than half

Size the entry exposure under the gap model appropriate to tokenised equity collateral: a 3% weekend diffusion, an event of intensity 2% per weekend whose magnitude is drawn around 14% with 6% dispersion and is adverse in 60% of cases, with cross-name correlation $\rho$ applied to both the diffusive and the jump component. The quantity of interest is the absolute error between a vault's marked net asset value at the moment of a weekend mint and the value implied by where its holdings are actually trading.

At a cross-name correlation of 0.5, holding eight names rather than one cuts the mean mark error from 2.62% to 1.88% and the 99th percentile from 14.00% to 6.36%. The tail improves by more than the mean because single-name gap risk is dominated by idiosyncratic events, and a basket dilutes exactly those. This is a structural advantage of the basket form over the single tokenised equity, and it survives across the correlation range: even at $\rho =0.7$ the eight-name tail is close to half the single-name tail.

7.3 Why in-kind redemption is the load-bearing decision

Table 6 quantifies an exposure that the protocol chooses to accept on entry and eliminate on exit.

The consequence is that mark error, quote staleness, pricer failure and operator failure are all confined to the entry path. A holder who does not like the state of the world at any moment does not have to negotiate for a price. They exercise a claim on assets that are already in the contract. This is what makes the pricer a convenience rather than a trust assumption for exit, and it is the specific property that §12 leans on when bounding the damage a compromised pricer key can do.

8Revision, and What a Creator Is Charging For

8.1 The revision right is a switching option

A creator may rewrite their basket at any time into any allowlisted support satisfying the holdings and weight constraints. They are never obliged to. That is a perpetual American option to switch into the best reachable basket given the information available at the moment of exercise, and it is the entire economic content of what a creator sells.

The reading is direct. A creator whose view of the world barely changes between revisions is exercising an option worth 37 basis points and is permitted to charge up to 200 for it. A creator whose view genuinely turns over is exercising an option worth several hundred. The fee cap does not distinguish between them, and the changelog is the only instrument that does.

8.2 The break-even information coefficient

Fees are levied against the same expected active return the creator's skill produces, so the two can be equated. Under the fundamental law, information ratio is $\mathrm{IC}\cdot \sqrt{B}R$ with $\mathrm{BR}$ the number of independent decisions per year [5, 6], and expected active return is that ratio scaled by active risk. Taking the active risk of an eight-name thematic basket against the broad tape at 18%, a creator breaks even when

An information coefficient of 0.069 sustained across a stock universe is a demanding standard. Published estimates for skilled discretionary managers sit in the range 0.05 to 0.10, so a creator charging the cap and revising quarterly is asking to be believed at the upper end of professional skill. A creator charging nothing and letting the protocol take its 50 basis points needs 0.014 at the same cadence, which is a much easier claim to sustain.

The protocol's own fee is deliberately on the easy side of that line. Fifty basis points against four revisions a year requires a break-even information coefficient of 0.014, and the protocol does not select anything, so the fee is a charge for the factory, the allowlist and the accounting rather than for skill. Setting the creator cap at 200 basis points reflects a judgement that a creator who genuinely maintains a thesis can clear it and that one who does not will be visible in the changelog for failing to try.

9Protocol Specification

9.1 The factory

TheoryFactory is the registry, the allowlist and the vault deployer in one contract. It holds the set of admitted instruments, validates a proposed theory against the holdings band and the weight constraint, deploys the vault, records the signer as its owner, and emits the theory as an event. It was deployed at block 52,540,542 for 4,612,112 gas and its address is in Appendix D.

Publishing a theory costs no protocol fee at launch. The economic gate on publication is the minimum genesis deposit of 0.005 ETH, which exists for the accounting reason given in §9.3 rather than as a price.

9.2 The vault is the token

Each theory deploys one contract that is simultaneously the custodian of the basket and the ERC-20 representing claims on it. There is no separate share contract, no wrapper and no registry entry mediating the relationship. A holder's balance is their claim, transferring the token transfers the claim, and any venue that can hold an ERC-20 can hold a theory.

The consequence worth stating is negative. Because there is no share class, there is nothing to redeem into except the holdings themselves, which is why in-kind redemption is the primitive and any cash-settled exit is a convenience built on top of it by whoever wants to offer one.

9.3 Genesis, and the donation defence

An empty vault is the classic attack surface. A first depositor who mints one share and then transfers assets directly to the contract inflates the exchange rate so that a second depositor's deposit rounds to zero shares, and the second depositor's assets accrue to the first [9, 10, 11]. Theory closes this at genesis: the first deposit mints at par and a fixed allocation of shares is permanently locked, so total supply is bounded away from zero for the life of the vault and the exchange rate has no singular point to be pushed through.

The minimum genesis of 0.005 ETH is sized against the same rounding. Across the maximum twelve legs it leaves $4.167\times 10^{14}$ wei per leg at 18 decimals, and the floor-toward-vault convention of §9.4 loses at most one wei per division, so the worst-case genesis rounding loss is twelve wei, or $2.4\times 10^{-13}$% of the deposit. The floor exists to keep that ratio irrelevant rather than to raise revenue.

9.4 Issuance never dilutes

Every division in the accounting floors toward the vault. Shares minted for a given deposit round down, assets released for a given redemption round down, and the residue accrues to the vault and therefore to the remaining holders. The property this establishes is monotonic: no deposit, at any size, at any exchange rate, can reduce an existing holder's per-share claim on any holding. The Foundry suite fuzzes this directly, which is the appropriate way to test a property that is quantified over all deposit sizes.

9.5 The pricer signs, and never spends

Entry pricing needs a net asset value, and a net asset value needs marks for instruments whose feeds keep exchange hours. Theory separates the two roles cleanly. The pricer is a key that signs NAV quotes. It holds no funds, has no spending authority, and cannot move a token. A quote is accepted only if it is signed by the pricer for this specific vault and presented within its validity window; the end-to-end test in the suite constructs a forged quote and confirms rejection.

What a compromised pricer key could do is mis-price entries, minting shares against an incorrect NAV and diluting existing holders. What it could not do is take anything out. That asymmetry is the reason the role exists as a separate key at all, and §12 carries it as the protocol's principal residual risk.

9.6 The keeper is caged

The keeper exists to convert between the sleeve asset and the basket holdings once a venue exists. Its authority is bounded on four axes simultaneously. It may trade only the sleeve asset, only against an instrument published in this vault's own basket, only if that instrument is on the factory allowlist, and only through the single allowlisted router address. Every trade is validated by measuring balance deltas before and after rather than by trusting what the route reports, so a route that returns a favourable value while delivering nothing fails the check.

The sleeve asset is WETH and it is never itself a basket holding. Keeping the two roles disjoint means a basket can never quietly become a WETH position through a sequence of legal keeper actions.

9.7 Redemption in kind

redeem(shares):
    for each holding h in basket:
        amount[h] = balanceOf(h) * shares / totalSupply    // floors toward the vault
        transfer(h, msg.sender, amount[h])                  // pay first
    burn(msg.sender, shares)                                // burn second

The loop reads balances and supply. It calls no oracle, verifies no signature, consults no keeper and checks no pause flag. The ordering pays before it burns, so a failure between the two cannot destroy a claim that has not been settled. This path is the protocol's floor: whatever else is broken, a holder can leave with exactly what they own.

9.8 Fees are pull-accrued

The protocol fee is 50 basis points and the creator fee is set per theory by its creator, capped at 200. Both accrue and are claimed by their recipients rather than being pushed on each interaction. The reason is a liveness property: a fee recipient whose address reverts on receipt, whether through a contract bug, a blocklist or deliberate griefing, cannot block anybody's deposit or redemption, because no user-facing path transfers to them.

9.9 Invariants

The following are stated in a form suitable for formal verification, and are the properties the test suite exists to defend.

10What Is Actually Deployed

Sections 3 through 8 describe how a thesis should be resolved into a portfolio. This section describes what is running, which is narrower.

10.1 The router is the zero address

Robinhood Chain has no exchange. There is no venue on this chain through which a keeper could convert the sleeve asset into basket holdings, and Theory's router is therefore set to 0x0000000000000000000000000000000000000000.

This is a deliberate configuration rather than an oversight, and it is worth more than a policy statement. A protocol that promises not to trade asks a reader to trust an intention. A protocol whose router is the zero address has no venue to trade through, and a reader confirms it by reading one storage slot. When a venue exists the address will be set, and setting it is a visible on-chain change that any holder can observe and act on before it matters to them.

10.2 What a vault holds today

A theory published today is a signed, on-chain, immutable-until-revised statement of a support and a weight vector, together with a vault that holds the sleeve asset. The basket definition is complete and public. The conversion into the legs is pending the chain having somewhere to convert. In-kind redemption works throughout, returning a pro-rata slice of whatever the vault actually holds, which today is the sleeve and after conversion is the legs.

A reader should size this correctly. The instrument is currently a published, enforceable portfolio definition with an ETH position behind it, and the equity exposure it describes begins when a venue exists. Describing it as a live equity basket today would be inaccurate, and the paper does not.

10.3 Status and tests

The Foundry suite is 39 tests, including fuzz tests for the no-dilution property of invariant 5 and an end-to-end run establishing that the contract, the pricer signature and the vault all agree on a valuation and that a forged quote is rejected. Thirty-nine tests is a reasonable suite for a protocol of this size and it is not an audit, and §12 does not pretend otherwise.

11Verification

Every claim in §9 and §10 is checkable without asking us. The addresses are in Appendix D and the chain's explorer is public.

A reader can establish today that the factory exists at the stated address and was deployed in the stated transaction at the stated block; that its allowlist contains 194 instruments and which ones they are; that the router it configures is the zero address; that the pricer address holds no funds and has no spending role in the deployed bytecode; that each published theory's support, weights and rationales are recoverable from factory events; and that each deployed vault's holdings are a subset of the allowlist.

What a reader cannot establish from chain state is that the selector will continue to select well, or that any given creator will maintain their theory. Those are judgements about future behaviour, and the protocol's answer to both is to make the record legible rather than to make a promise: the changelog records every revision as an on-chain event, and §8 gives the arithmetic for pricing what that record shows.

12Threat Model

13Limitations

The equity exposure is not live. The router is unset because the chain has no exchange, so a published theory today is a signed portfolio definition backed by a sleeve position. Everything in §4 through §8 describes how the basket should be built and none of it has been tested against realised returns on this chain.

No audit. Thirty-nine tests, no third-party review. The deployment is young and the caps on individual behaviour are correspondingly conservative.

The selection model is not evaluated here. This paper specifies what a good selector must do and gives the arithmetic for judging one. It reports no out-of-sample evidence that any particular model achieves an information coefficient of 0.05 on this universe, and a reader should treat that figure as the assumption it is. Every result in §4 and §8 scales linearly in it.

The universe is small and concentrated. With 194 admitted instruments, many published theories will overlap heavily by construction. Fourteen theories at eight holdings occupy 112 slots, which under uniform selection would cover 85 distinct names, or 43.9% of the universe. The realised overlap is the honest measure of whether different sentences are producing different portfolios, and it is published on the site rather than asserted here.

The empirical prior is unfavourable. The thematic-product literature summarised in §2.1 finds roughly 30% risk-adjusted underperformance over five years, concentrated in launch cohorts. Theory reduces the cost of launching a thematic basket to a gas fee. A reader should hold the view that this makes the documented failure cheaper to reproduce unless the revision behaviour of a specific creator says otherwise, and §8 is the tool for forming that view.

The relevance decay model of §5 is a modelling choice. Geometric decay is a convenient one-parameter family and the holdings band follows from it. A reader who prefers a different decay shape will get a different band, and Appendix B gives the grid so the substitution can be made.

14Roadmap

A venue, then a router. When an exchange exists on Robinhood Chain, the router is set and the keeper begins converting sleeve into legs under invariant 10. This is the change that turns a published portfolio definition into a live equity basket, and it lands as a visible on-chain transaction that any holder can see coming.

Audit before scale. A third-party review precedes any relaxation of the operational limits. Raising limits first would invert the risk.

Revision analytics. The changelog exists; the arithmetic of §8 applied to it does not yet. Publishing realised signal persistence and revision cadence per creator turns Table 7 from a formula into a screen, and it is the most useful thing the protocol can build for holders.

Universe growth. The allowlist tracks the chain. Every tokenised equity that exists is admitted, so the investable universe grows as the chain does, and each admission is an event that widens the reachable set for every vault.

15Conclusion

A thesis is a sentence and a portfolio is a vector, and the map between them has parts that can be measured separately. Doing so produces an ordering that inverts the conventional one. The choice of holdings carries roughly twelve times the expected active return of the choice of weights across them, so the allowlist and the selector are the load-bearing components and the optimiser is a refinement. The equal-weighted basket has a ranking term of exactly zero for every view that could have produced it, which makes refusing the flat vector a test that can be run at publication instead of after a year of returns. And the number of holdings has an interior optimum that moves from five to twelve as a thesis goes from sharp to broad, which is where the contract's band comes from.

The protocol built on that analysis is deliberately small. A creator writes a sentence and signs once. The vault is the token, so there is no share class and no manager. Redemption in kind is never pausable, so the exit never depends on a price, a signature or an operator. And the reachable state space of any vault is 4.49 × 10¹⁸ subsets of a single public allowlist, which bounds what a creator can do to a holder without requiring the holder to trust the creator.

What is running is narrower than what is specified. The router is the zero address because the chain has no exchange, the deployment is unaudited, and no claim in §4 through §8 has been tested against realised returns here. Those facts are in this document because a protocol that is early is better served by being legible than by being impressive. The analysis is what we think is true about turning sentences into portfolios. Sections 9 through 12 are what we have actually built. Both are checkable, and being checked is the point.

References

1. [1] I. Ben-David, F. A. Franzoni, B. Kim, R. Moussawi. Competition for Attention in the ETF Space. The Review of Financial Studies, 36(3), 987–1042, 2023. Specialised exchange-traded funds lose approximately 30% in risk-adjusted terms over their first five years, roughly −6% annually for the launch cohort against −0.24% for broad-based funds; underlying indices run up before launch and reverse afterwards.
2. [2] Subsquid (SQD). Tokenized Stocks on Robinhood Chain, 2026. Chain ID 4663; ERC-20 stock tokens with 18 decimals; 46% of first-week stock-token transfers settled outside regular exchange session times.
3. [3] Chainlink Documentation. Data Feeds: tokenised equity reference feeds; 24/5 publication schedule with no heartbeat during off-hours and last price held; L2 sequencer uptime feeds, 2026.
4. [4] EIP-4626: Tokenized Vault Standard. Method set, preview and convert semantics, and the rounding conventions requiring every operation to favour the vault.
5. [5] R. C. Grinold. The Fundamental Law of Active Management. Journal of Portfolio Management, 15(3), 30–37, 1989.
6. [6] R. Clarke, H. de Silva, S. Thorley. Portfolio Constraints and the Fundamental Law of Active Management. Financial Analysts Journal, 58(5), 48–66, 2002. Introduces the transfer coefficient as the correlation between realised and unconstrained-optimal active weights.
7. [7] A. F. Perold. The Implementation Shortfall: Paper versus Reality. Journal of Portfolio Management, 14(3), 4–9, 1988.
8. [8] G. P. Brinson, L. R. Hood, G. L. Beebower. Determinants of Portfolio Performance. Financial Analysts Journal, 42(4), 39–44, 1986. The allocation and selection decomposition of active return.
9. [9] OpenZeppelin. ERC-4626 inflation attack mitigation: the decimals-offset virtual shares defence, and Exchange Rate Manipulation Risks, 2023–2025.
10. [10] Euler Labs. Euler Vault Kit whitepaper, 2024. Exchange rate computed over a virtual deposit; internal balance tracking so a donation cannot move the share price.
11. [11] Zellic. Risk of ERC-4626 inflation attack, security research publication, 2024.
12. [12] C. E. Shannon. Prediction and Entropy of Printed English. Bell System Technical Journal, 30(1), 50–64, 1951. Estimates of 1.0 to 1.5 bits per character for printed English.
13. [13] Robinhood Markets. Robinhood Chain Mainnet, 2026. Ethereum layer two on the Arbitrum Orbit stack, ETH as the gas token, chain ID 4663.
14. [14] ERC-8056: Scaled UI amount extension, used by tokenised equities to reflect corporate actions while preserving raw transfer values.
15. [15] EIP-6963: Multi Injected Provider Discovery, the wallet discovery interface the interface uses.

AAppendix A: Proof of Proposition 1

Let $S$ have size $n$, let $w$ be a weight vector on $S$ with $\sum w_i=1$, and write $a=w-1/n$. Since both vectors sum to one, $\sum a_i=0$. Under the linear forecast $E[r_i]=\mathrm{IC}\cdot {\sigma }_x\cdot z_i$,

which establishes Eq. 1. The first term depends on $S$ alone and is invariant to any reweighting; the second is the whole of the dependence on the ordering within $S$.

Proof. If $w=1/n$ then $a=0$ and $⟨a,z⟩=0$ for every $z$, without any assumption on the signal.

Uniqueness. Suppose $a\ne 0$. Because $\sum a_i=0$ there exist indices $i$ and $j$ with $a_i>0>a_j$. Take $z=e_i-e_j$. Then $⟨a,z⟩=a_i-a_j>0$, so the ranking term fails to vanish for at least one signal. Hence $w=1/n$ is the unique weight vector on $S$ for which $⟨a,z⟩=0$ holds for every $z$. □

The entropy characterisation. Maximising $H(w)=-\sum w_i\ln w_i$ subject to $\sum w_i=1$ gives $w_i=1/n$ by the stationarity condition, and the maximiser is unique because $H$ is strictly concave on the simplex. The two characterisations therefore pick out the same vector by different routes, one about expected return and one about the shape of the vector alone. The second is the one an interface can check without a return model, which is why the concentration test is stated in entropy terms on the product surface: at eight holdings the reference conviction shape gives $H=1.936$ nats against a maximum of 2.079, and $\exp H=6.93$ effective names.

On the transfer coefficient. Clarke, de Silva and Thorley define the transfer coefficient as the correlation between realised active weights and the active weights an unconstrained optimiser would hold [6], interpretable as the fraction of unconstrained active return achieved. At $a=0$ the correlation is formally undefined, since the zero vector has no direction. The achieved fraction is unambiguously zero, and we adopt the convention $\mathrm{TC}=0$ in this degenerate case, which is the reading the statistic is designed to support.

BAppendix B: The Holdings-Count Optimum

With ${\beta }_k=e^{-(k-1)/\kappa }$, the mean loading over the top $n$ candidates is a geometric sum,

and the driver of Eq. 3 is therefore

The bracket increases and saturates at $1/(1-e^{-1/\kappa })$, while the prefactor decays as $1/n$. The product rises while the bracket is still growing quickly and falls once saturation dominates, giving a single interior maximum whose location grows with $\kappa$.

Table 12 is the same result in the units a holder cares about. At the middle calibration an eight-holding basket delivers 74.2% of its variance from the thesis and the remainder from single-name noise, against 50.0% for a single stock and 66.4% for twenty holdings. The peak is shallow, which is the honest reading: the difference between five and twelve holdings is around one point of thesis share, and the difference between either and a single name is more than twenty.

CAppendix C: Parameters and Sensitivity

The two results that carry no fitted parameter are Proposition 1, which is an identity, and Proposition 4, which is a count over a set fixed on chain. Everything else in this paper is a calibrated statement and should be read as one.

DAppendix D: Deployed Reference