How the MACHINES protocol works

Every 3.5 days, holders vote on a stock. The treasury buys it and puts it inside the Machines. This page describes each step, what it costs, and who is allowed to trigger it.

What this is

A Machine is an NFT that owns a wallet. Anything sent to that wallet belongs to the Machine rather than to whoever is holding it today, so when a Machine is sold, its contents go with it. The protocol spends its income on tokenized stock and puts that stock in those wallets.

The protocol token is written $TICKERNAME throughout these docs. It has one job: it is what you burn to switch a Machine on, and it is what the market prices. There is no staking contract, no lockup, and no separate governance token.

The loop

One epoch is 3.5 days. The same six steps run every epoch, in order.

1. Sync permissionless The mine closes the previous epoch and folds in Machines whose ink started or expired. Every share count downstream depends on this.
2. Open the ballot ballot manager Up to 32 stocks are put forward. A stock only qualifies if it has a live price feed, was issued by the real issuer's factory, and is routable.
3. Vote holders 48 hours. One active Machine is one vote, and a Machine votes once.
4. Finalize permissionless The tally is counted on chain and the winner is handed to the treasury. Nobody gains by being the caller, and nothing is lost if the team is asleep.
5. Buy permissionless, bounded The treasury buys the winner in chunks. The price floor comes from the oracle, not from the caller.
6. Distribute permissionless The stock is split evenly across every Machine that was active for that epoch and pushed into each Machine's own wallet.

Network

Everything runs on Robinhood Chain. The Machines, the token, the stock and the pool are all on the same chain, so no step in the loop crosses a bridge.

Machines

Ten thousand Machines exist already. Each one has a deterministic ERC-6551 account derived from its token id, which means the address is known before the account is deployed and tokens can be sent to it either way.

A Machine is in one of three states:

Ink and earnings belong to the Machine, not to the wallet holding it. Sell a Machine mid-run and the buyer gets the remaining epochs and whatever is already inside.

Ink

Ink is the activation cost, paid in $TICKERNAME. It buys 8 epochs, which is 28 days, and it cannot be refunded. Topping up early extends the run rather than restarting it.

Because the cost is a share of the epoch emission and the reward is a share of the same emission split across everyone active, the return depends entirely on how many Machines are switched on:

Emissions

800,000,000 $TICKERNAME, 80% of supply, is locked in the mine and paid out on a fixed curve. Every active Machine is one share, so an epoch's emission is divided evenly among whoever is switched on.

• Genesis: epochs 1 to 8 emit at twice the base rate.
• Taper: from epoch 9 the rate falls 1.3% per epoch, forever, approaching zero rather than ending at a cliff.

The constants are derived from the budget rather than picked, so the series sums to exactly 800,000,000 by construction. There is no halving, on purpose: a halving creates a known date to sell into.

Earnings accrue to the Machine and are claimed into its own wallet. Claiming is free beyond gas, and unclaimed earnings are not lost.

The vote

The ballot is open for 48 hours of each epoch and carries up to 32 tickers.

• One active Machine, one vote. Hold a hundred Machines and you have a hundred votes, which is the same rule for everybody.
• A Machine votes once per epoch. Recorded against the token id, so selling a Machine after voting does not produce a second vote.
• Only Machines active at the start of the epoch may vote. You cannot ink after seeing the ballot and vote in it.
• Ties break to the lower address, so the order the tickers were listed in cannot sway the result.

The tally is on chain. It is not a signature site with a multisig reporting the result, because the vote is the headline mechanic and should be the last thing running on trust.

What gets on the ballot

A stock qualifies only if all three hold:

1. It has a live Chainlink feed, fresh enough for the treasury to accept.
2. It was deployed by the issuer's own factory. This matters more than it sounds: searching the chain for Apple returns four tokens, one copying the real name character for character. Name and symbol are forgeable. The deployer is not.
3. There is an honest route to buy it, priced within tolerance of the oracle.

The treasury

Once a ballot is finalized, the treasury buys the winner. Anyone can trigger a buy and there is a small bounty for doing so, because a protocol that only works while a particular server is awake is a protocol with a single point of failure.

What the caller controls is timing and route. What the caller cannot touch is the price:

Together these bound what a hostile or bribed caller can extract to a fraction of a percent of one chunk, and they do it without anybody needing to be trusted.

Distribution

When the epoch closes, the stock the treasury bought is handed to the distributor, which divides it evenly across every Machine that was active for that epoch and pushes it into each Machine's ERC-6551 account.

Push, not claim. There is nothing to race for and nothing expires. Settlement runs in batches so ten thousand Machines clear in a manageable number of transactions, and it is idempotent: a batch can be retried or overlapped and nothing is ever paid twice.

The token

$TICKERNAME is the codename. The ticker it launches under is revealed at deployment and not before, so nothing here should be taken as the symbol to look for on an exchange. The address will be published on this site and readable from the mine contract on chain, which is the only pair of places worth trusting for it.

Fixed supply, minted once in the deploy transaction, and only ever destroyed. No mint function, no owner, no pause, no upgrade path, no blacklist.

There is deliberately no transfer tax. A fee on transfer breaks Uniswap V3's swap callback, forces an exemption list covering every router and aggregator route where one missed route is a reverting swap, and makes the token something every scanner flags. The fee is collected by the venue instead.

The starting ink airdrop

Every Machine is sent its starting ink before trading opens, straight to its own wallet. This is an anti-sniping measure as much as a giveaway: holders who arrive at an open market with no ink would have to buy some before switching a Machine on, and that is a gas war the bots win. It is pushed, not claimed, so there is nothing to race for.

Sell fee

A Uniswap V4 hook on the $TICKERNAME pool charges a fee on sells. Buying and plain transfers are untouched, and there is no exemption registry to maintain or get wrong.

Nothing trades until trading is opened. The pool can hold liquidity for days before anyone can swap against it, because every swap reverts until a single one way switch is thrown. That is deliberate: liquidity goes in early so it can be checked, and the market starts when it is meant to rather than the moment the pool exists.

The ramp starts at that switch, not at a date chosen when the contract was deployed. Its shape is immutable and nothing can change it, including the owner, so it can be checked before launch and believed during it. It ramps rather than steps, because a step creates one exact second everybody races for. There is no way to close trading again.

The resting rate is a dial, between 0% and 10%. Once the ramp is over, the owner can move the fee anywhere in that range. The ceiling is a constant in the contract rather than a promise on a page: an uncapped sell fee is the mechanism of a honeypot, where buyers can buy and never sell, and a limit written in code is the only version of "we would not do that" worth anything. There is no function to raise the cap, and no pause and no blacklist.

The split between the founders and the stock treasury can also be moved, and the founders' share cannot exceed half of any fee. The rest always buys stock.

A round trip inside the first minute returns about a tenth of what went in, which prices out flipping the launch entirely. Be clear about what it does not do: the fee is charged on the way out, so a buyer who waits out the thirty minutes leaves paying the permanent 5% like anyone else. It deters the flip, not the accumulation.

The 3.5% share is the second inflow to the treasury and the one that needs no human involvement at all: it arrives already denominated in the currency the treasury spends.

The pool

A single Uniswap V4 pool against a stablecoin quote, initialized and funded in one transaction so it cannot sit half seeded. The hook address is mined with CREATE2, because V4 encodes hook permissions in the low bits of the hook's own address and an address without the right bits is not a valid hook.

Swapping goes through a thin adapter that settles directly against the PoolManager on a plain ERC-20 approval. The stock router settles through Permit2, which ignores a plain allowance, and the treasury pattern is approve-and-call.

Attributes

Every Machine has two traits that were frozen on the NFT contract at mint and pinned to IPFS. Its headwear sets a share weight, and its body puts it on a sector desk. Both are committed on chain as one byte per Machine, high nibble for the desk, low nibble for the weight.

Weight classes

Seven classes, fixed forever in that order. The counts below are the collection as it actually is, not a plan:

Sector desks

Sixteen desks, one per ticker the collection was drawn around:

Why it is sealed before it is used

The full ten thousand byte blob is committed as a hash in the constructor, before any of it is written. Sealing recomputes the hash over what was actually stored and reverts unless it matches, and after that nothing can be written again. So the attributes are provably the ones published at deploy rather than whatever was uploaded afterwards.

It is plain storage rather than merkle proofs. Ten thousand bytes is 313 slots, which costs about a dollar to write once on this chain. Paying that once removes a proof argument from every claim, removes any off-chain data the protocol has to trust, and lets anybody read the allocation straight off the contract forever.

What a later phase could do with it

The contract can already answer "what is this Machine worth if the winning stock is on its desk", with the multiplier supplied by the caller rather than baked in, so the policy would live in the distribution contract and this one stays a record of the artwork. Nothing calls it.

Switching that on changes who gets paid what, so it is a separate module and a public decision, not a flag somebody can flip. Until that happens, the honest description of attributes is: they are art, they are provably fixed, and they pay nothing.

The keeper

The keeper is a stateless state machine. It reads the chain, decides what is due, does one thing, and reads again. It holds no state between runs, so stopping it, restarting it, or running it after a crash all behave the same way.

SYNC -> OPEN_BALLOT -> FINALIZE -> BUY -> HAND_OFF -> SETTLE

It paces itself from the epoch length, so the same binary is correct on a 3.5 day epoch and on a short rehearsal epoch.

The keeper is a convenience, not a dependency. Four of the six steps are permissionless, which means the loop can be driven by anybody if the keeper stops.

Who can do what

Nothing in the table can mint $TICKERNAME. That is not permissioned, it does not exist: the token has no owner and no upgrade path, so there is no address anywhere that can do it.

The sell fee is different and worth being exact about. The owner can move the resting rate, but only between 0% and 10%, because the ceiling is a constant in a contract that cannot be replaced. So the fee can change and it cannot be used to trap you.

Upgrades

Four contracts can be replaced by their owner: the mine, the vote, the treasury and the distributor. They hold the operating logic, and a bug in accrual or settlement needs a way to be fixed.

Being honest about what that means, because it is the price of the feature. The owner of those four could change the emission schedule, change how the vote is counted, or change where a drop is sent. Upgrading is not a way to mint supply or raise the sell fee, since neither of those lives in an upgradeable contract, but it is real power and worth pricing in.

They are UUPS proxies, so the upgrade function lives in the implementation behind an owner check, and every implementation is deployed locked so nobody can claim one and point a proxy at it. Upgrade authority is a single owner key today. Moving it to a multisig with a timelock, so a change is announced before it can land, is on the pre-launch list.

Numbers at a glance