How Posy works

A pot's life

1 · open

open(recipient, deadline, goal, slippageBps, stems[], title). Each stem is a stock, the fee tier of its USDG pool on Uniswap and its share of the pot in basis points; the shares must add up to exactly 100%. The contract refuses a pool that does not exist, a repeated stock, a deadline in the past or more than a year out, and a slippage limit above 15%. The goal is only for the progress bar.

2 · chip in

contribute(id, amount, note) after approving USDG. Allowed until the deadline second. The note (64 bytes at most) is emitted in the Chipped event and shown on the pot's page.

3 · close

close(id, minOut[]). The organiser may close at any time; after the deadline, anyone may. The pot's USDG is split by weight — each stock gets floor(raised × weight / 10,000) and the last takes the remainder — and each part is swapped with exactInputSingle, recipient fixed to the pot's recipient. Each leg must return at least its minimum, and each minimum must clear the price guard below.

4 · or cancel, and refund

cancel(id) by the organiser while the pot is open, or by anyone once 30 days have passed after the deadline without a close. Then refund(id) pays each contributor exactly their total, once.

The contract

Reading Robinhood Chain…

PosyPots has no owner, no fee, no upgrade and no pause. Its only state-changing functions are open, contribute, close, cancel and refund. Every address it calls is a constant in its code, so it has no constructor arguments.

Check it is this code

Nobody holds a key to PosyPots, including us, so it is deployed by its first user: the Start a pot page sends salt ++ initcode to the deterministic-deployment proxy, which creates it at keccak256(0xff ++ proxy ++ salt ++ keccak256(initcode)). Anyone can repeat that arithmetic and compile the source themselves:

solc 0.8.26 · optimizer on, 200 runs · evmVersion cancun
keccak256(initcode)            = 0xae8508b90c6e15f8aff88864af98c9e55689005f7a5cee7dd9cae4ef5ce2feb8
address                        = 0xDc17e535370512Ea8d47CDFF0927B3e67be98788
keccak256(eth_getCode(address)) must be 0x2c17f9046d2cee1bd5b9ee5a13602ff6dc7c1e3972a77d0a4c1984498881c0e4

The pages check the last line before they read anything: an address holding different code counts as "not deployed". The build refuses to publish if a fresh compile of the source moves any of the three.

The price guard

Whoever closes a pot chooses the minimum each stock must deliver — the page takes Uniswap's live QuoterV2 quote and asks for at least 99% of it. On its own that would let a closer set minimums of zero and trade against the pot in the same transaction. So the contract also computes each leg's value at the pool's 30-minute time-weighted average price (Uniswap's own observe()) and refuses any minimum below that value less the pot's slippage limit. A price pushed around inside the closing transaction does not move a 30-minute average.

What the limit means in the worst case: someone entitled to close could push the pool against the pot and fill it right at the floor — the 30-minute price less the limit — so the limit is the most a pot can lose to its closer, and the pool's own fee comes out of the same margin. Keep it small: the page suggests 3% and refuses a limit that a pool's fee alone would use up.

Measured at block 71,647,327, the gap between each giftable pool's current price and its 30-minute average had a median of 4 basis points (largest 38). The suggested limit is 3%.

A pool needs 30 minutes of recorded prices for this. 3 pools with a USDG pair keep too few observations today (TSLA, NU, RIVN), so the pages do not offer those stocks. What the guard does not do: it cannot tell whether the pool's price itself is fair compared with the stock market — it protects the pot from the person closing it, not from the market.

Refusals

Every refusal is a named error, and the pages translate it before your wallet opens.

Show all 22

Stocks a pot can buy

39 of the 42 Robinhood stock tokens with a USDG pool on Uniswap, scanned at block 71,647,327. Prices are the pool's, per share.

Show all 39

Tests

Everything below ran against Robinhood Chain's live state — the real USDG, the real stock tokens and the real Uniswap pools — through the node's eth_simulateV1, with PosyPots deployed through the real proxy inside the simulation. Nothing was broadcast.

• Properties: 10/10 pass, 525 checks. Each refusal must be the specific named error; each amount is checked to the unit against numbers computed in the test from what the people in it typed. The re-entrancy lock, which no real sequence can reach (USDG makes no callbacks), is tested with one eth_call that installs the runtime by state override and sets the lock's slot, found by name in solc's storage layout.
• Fuzz: 8 seeds, 126 operations (79 landed), each held against an independent model after every step (what the contract holds is tracked from USDG's own Transfer logs) and every pot and every person's record read back at the end. Each seed ends with one of four fixed scenarios — several friends chip in and the organiser closes; refused refunds and cancels, then exact refunds; a stranger refused before the deadline and closing after it; a minimum one unit under the floor refused by name, then cancel and refund — and the run fails unless all four ran and every operation landed.
• Sabotage: 31 deliberate bugs planted in the contract and the page's transaction builder; 31/31 were caught by the property named for them. None was missed.
• In a browser: 7/7 journeys, 37 checks — a first user deploys the contract from the page, an organiser opens a pot, two friends chip in from separate wallets, the pot closes and the recipient's balances rise; and a pot is cancelled and refunded.

Risks, plainly

• Not audited. The contract is small and tested, and it holds contributors' USDG until a pot closes or is cancelled.
• The recipient's address is final. A mistyped address receives the shares and nobody can take them back.
• Robinhood controls the stock tokens. They can pause a token or block an address; a pot whose purchase or delivery is blocked cannot close, and can be cancelled and refunded.
• Prices move. The pot holds dollars until it closes; the recipient gets what those dollars buy then.
• A pot nobody closes can be closed by anyone after its deadline, and cancelled by anyone 30 days later.

Older gift links

Before 25 September 2026 Posy sent single gifts as links holding a key. Those links still open at /claim; nothing about them depends on PosyPots.