SEAT Protocol Documentation
SEAT
Copy desks for programmable capital.
SEAT is a copy-desk protocol on Robinhood Chain. A desk is a USDG-denominated vault that copies the trades of an opted-in leader across a small set of verified official Stock Tokens. Depositors hold seat shares — a pro-rata claim on desk equity (NAV). A keeper observes leader fills, evaluates them against deterministic on-chain risk rules, resizes or skips them, and executes permitted copies through a restricted swap adapter. SEAT is experimental, unaudited, and not affiliated with Robinhood Markets.
Architecture at a glance
Current status
Phase 0 — paper copy Implemented
Deterministic risk pipeline and paper executor. Shipped; no funds move.
Phase 1 — testnet desks (46630) Implemented
Factory + cash vault deployed, USDG deposit/redeem in the blotter. Live swaps fail closed (no cited 46630 router).
Capped mainnet desk (4663) Planned
Wired in code with cited MAG7 tokens, feeds and SwapRouter02. Broadcast is guarded by CONFIRM_MAINNET; $50k deposit cap per desk.
Phase 2 — $SEAT, staking, open desks Experimental
Code shipped and tested. TGE requires CONFIRM_MAINNET + CONFIRM_SEAT_TGE; no $SEAT contract is deployed yet.
Buyback-and-burn, bond slashing, Phase 3+ Not implemented
Named as later work in the litepaper. No code exists for these items.
Read the docs
Introduction
What is SEAT?SEAT is a copy-desk protocol on Robinhood Chain — USDG vaults that copy the Stock Token trades of an opted-in leader under deterministic on-chain risk rules.Why SEAT?The problem with wallet copy-trading and the gap a pooled, risk-boxed copy desk fills on Robinhood Chain.How It WorksThe SEAT copy lifecycle end to end — from a leader's fill to vault accounting and NAV per share.Architecture OverviewThe major components of SEAT and how they connect — contracts, keeper, application and SDK.QuickstartClone, install, test, and run the paper-copy engine — the fastest path to seeing SEAT work.Project StatusHonest, component-by-component implementation status — what is shipped, what is experimental, what is only planned.RoadmapThe phase model — Phase 0 paper copy, Phase 1 testnet desks, Phase 2 open desks and $SEAT — and what is explicitly later.
Concepts
Concepts OverviewThe SEAT vocabulary at a glance — every term, plain English first, with links to the deep pages.Copy DeskThe core SEAT primitive — one leader, one vault, one risk configuration.Leaders & FollowersWho leaders and followers are, what each controls, and how the binding between them works.USDG & Stock TokensThe two asset types a desk touches — the USDG accounting asset and the official Stock Tokens it may hold.Seat Shares & NAVHow desk ownership is measured — seat shares, NAV, and NAV per share.Fees & High-Water MarkPerformance fee above the high-water mark, the time-based AUM fee, and the 70/20/10 split. No volume fee, by design.Keeper (Concept)The off-chain operator that observes leader fills and triggers vault copies — what it is, and what happens when it stops.Risk Engine (Concept)The deterministic, fail-closed rule set every copy must pass — twice.Market SessionsThe US equities session clock that scales copy size — and why after-hours copies are deliberately smaller.
User Journeys
Protocol Architecture
System OverviewHow the contracts, keeper, application and SDK compose into the SEAT system — with the trust and data-flow boundaries.DeskFactory (Architecture)How desks are created — the owner path, the bonded listing path, and the one-vault-per-leader invariant.DeskVault (Architecture)The heart of the protocol — custody, share accounting, fee liabilities, the withdrawal queue, and the single copy entry point.RiskModule (Architecture)The deterministic decision contract — pure evaluation, per-desk configuration, and why it is the enforcement layer.SwapAdapter & ExactInputRouter02 (Architecture)The restricted execution surface — why the vault never touches a DEX directly.FeeModule (Architecture)Pure fee math — high-water performance fee, time-based AUM fee, and the 70/20/10 split.NavLib & ChainlinkOracle (Architecture)The valuation stack — fixed-point NAV math and the feed-backed price oracle the vault trusts.SeatToken, StakingPool & LpLocker (Architecture)The Phase 2 token suite — fixed-supply $SEAT, USDG fee staking, and the 12-month LP lock. Code shipped; not deployed.Keeper (Architecture)The keeper's internal architecture — small modules, one pipeline, and a hard boundary between paper and live.Application (Architecture)The desk blotter — a read-mostly Next.js front end with direct-to-contract writes and an honest paper fallback.SDK (Architecture)Why the SDK exists — one registry and one NAV definition shared by keeper, app and docs.
Smart Contracts
Smart Contracts OverviewThe contract inventory, deployment status, inheritance, and the access-control matrix.DeskVaultThe desk itself — USDG custody, seat-share accounting, oracle NAV, fee liabilities, withdrawal queue, and the keeper-only copy entry point.DeskFactoryDeploys and registers one DeskVault per leader; custodies $SEAT listing bonds for permissionless listings.RiskModuleDeterministic, fail-closed risk checks for copy trades — the evaluate() reference.SwapAdapterThe restricted swap surface — no arbitrary calldata, one owner-set router, allowlisted tokens only.ExactInputRouter02The thin, immutable adapter from IExactInputRouter to Uniswap's SwapRouter02 — so SwapAdapter never sends arbitrary calldata.FeeModulePure fee math — high-water performance fee, time-prorated AUM fee, and the leader/protocol/staker split.ChainlinkOracleThe vault's price source — an owner-curated map from token to Chainlink AggregatorV3 proxy.NavLibThe fixed-point NAV library — one definition of desk equity shared by the vault, the SDK and the keeper.SeatToken$SEAT — fixed 1B supply, 18 decimals, minted once at deploy, no mint after. Code shipped; not deployed.StakingPoolStake $SEAT, claim pro-rata USDG from desk fee harvests — accumulator accounting, no rebase.LpLockerA timelock for a Uniswap v3 position NFT — minimum 365 days, withdraw only to the beneficiary.InterfacesThe contract boundaries — IDeskVault, IRiskModule, ISwapAdapter, IExactInputRouter, IScaledUIAmount, IStakingPool, AggregatorV3Interface.
NAV & Accounting
NAV & AccountingHow SEAT values a desk — USDG base units, balanceOfUI, oracle prices, and the exact NAV formulas.Deposits & WithdrawalsShare minting on deposit, instant vs queued redemption, and the FIFO withdrawal queue.Fees (Accounting)Exactly when fees accrue, when they are paid, and where every USDG of fee goes.
Risk Engine
Risk Engine OverviewThe fail-closed philosophy, the two enforcement layers, and the full rule inventory.Risk ParametersEvery knob in the risk engine, its default, and where it is set — with source citations.Decision FlowThe exact evaluation order every copy passes through — with the reason strings you will see on the tape.
Keeper
Keeper OverviewWhat the keeper does, how it is configured, and the guarantees it does and does not provide.The Keeper Pipelinenormalize → session → risk → execute → record — the exact path every fill takes.Fill SourcesWhere the keeper gets leader fills — the static fixture source and the live chain indexer, with current limitations.Execution ModesPAPER vs LIVE — the full guard matrix that stands between a signal and an on-chain transaction.The Fill TapeThe keeper's public record — schema, source labelling, and how the app serves it.
SDK
SDK Installation & SetupInstall @seat/sdk, understand what it contains, and make your first registry and NAV calls.Registry APIThe official Stock Token registry — verification states, lookups, and trade eligibility.NAV Math APIcalculateNav, valuePosition, navPerShare and the normalization helpers — bigint fixed-point, mirroring NavLib.Constants & ErrorsThe CHAIN constant, NavError codes, and the shared types — the small print of @seat/sdk.
Application
Application OverviewThe desk blotter — what it shows, what it writes, and how it stays honest when nothing is deployed.Application ConfigurationEnvironment variables, the generated address book, and the write-gate logic.Application APIThe single API route — GET /api/fills — and the RecordedFill shape it serves.
Development
Development SetupRequirements, installation, build, test, and lint — the exact commands from the repository.Environment VariablesEvery environment variable in the repository — what it does, who reads it, and safe defaults.CommandsEvery Makefile target and package script — what each one actually runs.TestingWhat is tested, how, and what the tests prove — Foundry suites, invariants, keeper guards, site number tests.
Networks
Networks OverviewRobinhood Chain mainnet 4663 and testnet 46630 — what is deployed where, and what is not.Mainnet (4663)Robinhood Chain mainnet — verified token registry, Uniswap addresses, and SEAT deployment status.Testnet (46630)Robinhood Chain testnet — the deployed Phase 1 contract set and its live addresses.Token RegistryThe SDK's chain-scoped token registry — eligibility, decimals, feeds, and how to query it.
Deployment
Deployment OverviewThe three deployment scripts, their guards, and the order of operations.Deploy to TestnetReproducing the Phase 1 testnet deployment on 46630.Deploy to MainnetThe capped Phase 1 mainnet desk on 4663 — guards, defaults, and what the script refuses to do.Deploy Phase 2 (TGE)SeatToken, StakingPool, LpLocker, multi-desk wiring — the token-generation deployment and its double confirmation.Recording AddressesHow write-addresses.ts turns broadcast logs into the app's address source of truth.
Operations
Keeper OperationsStarting, stopping, and supervising the keeper in paper and live modes.MonitoringWhat to watch — logs, the fill tape, on-chain state, and health signals.Failure ModesWhat breaks, how it presents, and what to do — keeper, RPC, transactions, execution, risk halts.Emergency ProceduresPause semantics, owner powers, and recovery — what you can and cannot do in an incident.
Security
Security ModelTrust assumptions, privilege boundaries, and dependency risks — the actual model, not a marketing one.Known LimitationsThe honest list — what the system does not do, cannot do yet, or deliberately refuses to do.Reporting IssuesHow to report bugs and security concerns — and what process does not exist yet.
Economics
Fee EconomicsThe two fees, the high-water mark, and where every bip goes — Phase 1 vs Phase 2.The SEAT Token$SEAT — fixed supply, allocation buckets, and the critical fact that it is not deployed.Staking & Listing EconomicsStakingPool rewards, the listing bond, and LP locking — the Phase 2 incentive machinery.
Reference
Runbooks & Papers
SEAT — LitepaperThe SEAT litepaper: desks, accounting, sessions, components, roadmap.Phase 1 runbook — testnet desks (46630)Phase 1 runbook: testnet desks on Robinhood Chain 46630.Phase 1 live copies — facts (46630 + 4663)Cited 4663 facts: Stock Tokens, Chainlink feeds, SwapRouter02, the $50k cap.Phase 2 — Open desks + $SEATPhase 2: open desks, fixed-supply $SEAT, 70/20/10 fees, stake-to-list.Mainnet day — Phase 2 TGE + desks (4663)The Phase 2 mainnet-day checklist for broadcasting on 4663.RiskRisk disclosure: fail-closed rules, market, copy, contract and operational risk.Asset Allowlist & VerificationAsset allowlist and the verification promotion process.Not AffiliatedSEAT is independent and not affiliated with Robinhood Markets.
Source of truth
Every page cites the file it was checked against. Where documentation and code disagree, the code wins — and the disagreement is called out, not hidden. The canonical runbooks are rendered directly from the repository's docs/ folder.