CANAL

THE LIQUIDITY LAYER FOR STOCKS ONCHAIN
EVERY STOCK IS AN ISLAND. CANAL CONNECTS THEM.
PAID DAILY. DUG DAILY.

CANAL Whitepaper v2.5 · September 2026 · canal.market · Robinhood Chain

This document is not an offer to invest and not investment advice. CANAL does not represent equity or debt of any company. Under public rules hardcoded in its contracts, the protocol distributes a share of its fees to CANAL holders who deposit into CrewVault, paid in SNDK and CANAL, delivered by a protocol keeper or claimed by the holder. Launch is not conditioned on a securities-law opinion (the protocol offers no legal advice; assess the risk yourself); the front end enforces geographic restrictions and self-declaration, the distribution is not offered to US persons or restricted jurisdictions, and it is not a promise of any return: on a day with no trading volume there is no distribution. Stock Tokens are issued by Robinhood Assets (Jersey) Limited and are tokenized debt securities. This paper describes the design of CANAL v2 and the constraints its implementation must satisfy; the contracts are still being written, the audit has not happened, and every number here is a pre-launch example. The onchain contracts and the audit report are the authority.

Three lines first

Every stock is an island. We dig the canal.
Paid daily. Dug daily.
Every trade pays the crew. Every trade digs the canal.

If you understand these three lines, you understand CANAL. Everything below explains why it holds up and how well it survives scrutiny.

Abstract

Robinhood Chain already carries more than a hundred tokenized stocks (Stock Tokens). Their liquidity is scattered across separate pools: a trade from one stock to another usually detours through a stablecoin, and the direct pools are rarely deep enough. The roads exist. The water is fragmented. Every stock is an island.

CANAL is a canal. It is a token launched on Pons v2, and the protocol pairs CANAL with eligible Stock Tokens, one at a time, into liquidity pools that are permanently locked — nobody can withdraw them. We call each pool a Port. The canal starts from the seven largest islands (NVDA, TSLA, AAPL, MSFT, AMZN, META, GOOGL), then works down a public market-cap queue: funded, a port opens; at most one a day. The list of the first hundred ports is public — the stocks Robinhood has already tokenized, ranked by market cap, biggest first. No votes.

Its money follows one table, in two phases. Before the hundredth port: of every $100 traded in the home pool, $3 is collected in fees — $0.30 to Pons, $1.30 streamed to the crew, $1.00 to dig ports, $0.40 to the people digging; of the fees each port earns itself, half digs, thirty percent goes to the crew, twenty percent to the diggers. From the hundredth port on, the crew and the dig swap: of every $100 in the home pool the crew takes $1.70 and ports $0.60, and of port fees the crew takes fifty percent and digging thirty; the diggers' share is the same in both phases. Dig a hundred ports. At #100, crew share goes 30 → 50. The crew's share is settled after 00:00 UTC each day and streamed over the following 24 hours to everyone on board, by time and by amount — boarding means depositing CANAL into CrewVault; deposit any time, claim any time, leave any time. You are paid in SNDK and CANAL. The port share first fills both sides of the next port to $20,000 each; anything beyond keeps deepening it — $20K is the floor, not the ceiling.

Zero team allocation. At launch the protocol buys only 35% of the supply, all of it to build ports; the other 65% is the market. The team is paid out of every trade: the bigger the canal, the bigger the wage.

Paid daily. Dug daily.

1. Stocks are onchain. Now what?

1.1 Stock Tokens arrived. The water didn't.

Robinhood Chain is an L2 built for tokenized stocks. Robinhood Stock Tokens are 18-decimal ERC-20 tokenized debt securities issued by Robinhood Assets (Jersey) Limited. They give the holder economic exposure to the corresponding stock or ETF, not legal or beneficial ownership of the underlying security. Every Stock Token has its own Chainlink onchain price feed; corporate actions such as splits are reflected through an onchain multiplier (uiMultiplier), which the feed already incorporates. This infrastructure makes "trading NVDA price exposure onchain" real.

But a price and depth are two different things. Each Stock Token's secondary market is its own pool, and most are shallow; to go from NVDA to TSLA you usually swim back to a stablecoin and across again — two slippages, two fees. Direct pools are not absent; they are not deep enough. The issuer mints and redeems; it does not provide secondary-market depth. The result: a hundred-odd islands, each with its own small patch of water. The roads exist. The water is fragmented.

1.2 The two answers on the market today

The first is the hub token with "protocol-owned liquidity": a meme token paired with each stock in a pool, fees paid out to holders. That road proved two things — people do want a canal, and they do want money in their pocket every day. But it has two structural weaknesses: the LP sits in the team's wallet, so whether it stays locked is a matter of trust; and all revenue is paid out, so every dollar distributed is a dollar that never became water — the canal stops halfway.

The second is the general-purpose DEX aggregator. It finds routes; it does not put water in them.

CANAL keeps what the first answer got right and fixes what it got wrong: the LP is locked in a contract nobody can drain; half the fees pay the crew, half keep digging; and who gets how much is computed by the contract itself — nobody can change it.

2. We dug a canal

2.1 A canal, not a pool

CANAL is a hub token. The protocol pairs CANAL with each Stock Token into a permanently locked Uniswap v4 liquidity pool; the position is held by the protocol contract CanalVault, whose implementation constraints are: no function that withdraws principal, no administrator, and no pause switch that can touch principal. Each such pool is a Port.

Ports connect to each other: between any two ports already joined to the canal there is a two-hop path through CANAL. But we do not force you through the canal — the router compares three routes, direct, stablecoin, and CANAL, and takes the best one. ANY PORT ↔ ANY PORT. BEST PATH WINS. The canal has exactly one job: dig its own water deep enough that the router picks it on its own.

2.2 Brand hierarchy: say these three things first

Supply splits, settlement formulas and contract names are "why it works". At first glance you only need the first three lines; the chapters that follow are for people who came to poke holes.

2.3 Straight talk

CANAL is not a burn token: the protocol burns no CANAL. It is not a governance token: there are no votes; new ports open automatically in market-cap order. And it is not an equity claim on any stock — the SNDK you receive is fee revenue distributed under the protocol's rules, not any company's dividend. CANAL is a machine: every fee that enters is partly streamed to the people on board and partly turned into permanent liquidity that cannot be pulled. Holding it is holding exposure to that machine — and how fast the machine turns depends on how many ships are on the canal.

3. How the canal runs

3.1 Launch and the home port (HOME PORT)

CANAL launches on Pons v2, quoted not in a stablecoin but in a Stock Token: SNDK (candidate; it must pass the pre-launch checks, otherwise the home port rolls to the next eligible Stock Token). CANAL is therefore denominated in a stock from day one, and the home port is itself a stock port.

The launch happens in a single transaction (Pons' launchAndBuy): create the token, buy 35% of the total supply for the protocol, land it directly in the reserve contract PortReserve. Nobody can front-run the protocol's purchase. The protocol's cost, the public's average cost and the graduation price are all published in advance from the Pons curve formula — we call it a Transparent Protocol Bootstrap, not a fair launch.

When the Pons curve sells out it graduates into a permanently locked Uniswap v4 pool, CANAL / SNDK: the HOME PORT. The creator tax on every home-pool trade (2%, set at launch, unchangeable for life) and the creator share of the base fee belong to the protocol's RevenueVault and arrive through Pons' sweep / escrow / claim path (§7).

3.2 Ports and the Genesis seven

A port is a permanently locked CANAL / Stock Token pool. Its fee tier is set by the external depth of the target stock (30 / 50 / 100 bps) and fixed once the port opens. Port pools are plain v4 pools with no extra tax.

In the first US trading window after graduation the protocol opens the Genesis seven at once: NVDA, TSLA, AAPL, MSFT, AMZN, META, GOOGL. The CANAL side comes from the 35% reserve; the stock side from a treasury prepared before launch. After that the daily rhythm begins.

3.3 Funded, it opens; at most one a day: THE HUNDRED

The candidate list for the first hundred ports is public: the stocks Robinhood has already tokenized (the onchain asset registry), ranked by market cap, biggest first. A dedicated ports page (THE HUNDRED) lists them row by row — rank, status, depth and volume; tokenized ETFs are not part of the hundred. A newly tokenized stock slots into the queue at its market-cap rank. The order of new ports is this ranking minus the ports already open. The ranking is posted onchain by a restricted role that can only order registered tokens, effective the next day; it cannot inject unregistered tokens and cannot reorder the same day.

To become the next island a stock must satisfy all of: registered with a Chainlink feed, external executable depth above the threshold, issuer permits contract custody and transfer, not yet open. A stock that fails is skipped with the reason recorded and stays in the queue.

At most one port opens per UTC day (the Genesis seven are the exception). A port opens only during US market hours, with a fresh oracle and the DEX price within 3% of Chainlink. On days the money isn't there, it keeps saving; on days there is more, that day's port is dug deeper. Yesterday TSM was funded, the next is SPCX, and after that the canal keeps digging. A name that fails the gate (feed, external depth, transferability) is marked SKIPPED, keeps its rank, and returns once eligible.

The hundredth port is the canal's watershed. The moment the port count (Genesis seven included, home port excluded) reaches one hundred, the contracts enter the second phase: in both the home-pool creator tax and the port fees, the crew's share and the dig share swap (§3.4); the diggers' share does not change. The switch is triggered by the onchain port count — monotonic, irreversible, and nobody can bring it forward or hold it back. Home-pool settlements lock their phase when they begin: a settlement that began before the hundredth port splits under phase one; the first settlement that begins after it enters phase two. Port fees split by the phase at the moment they are routed; fees accrued but not yet routed are not sliced retroactively. From then on the canal keeps opening ports for the hundred-and-first stock onward, in market-cap order.

3.4 Where the money goes

Every home-pool trade pays 3%: the base fee set by Pons (1% in the example) plus CANAL's own creator tax of 2%. Pons pays a single recipient address, so the creator share and the creator tax reach us as one sum; the split happens in CANAL's own vault, with three hardcoded, unchangeable ratios:

The base fee and Pons' share are Pons parameters: before launch the real values are read from the chain, published, and both sets of constants are hardcoded. If the example 0.30 / 0.70 differs from the chain, the numbers in the table change with it; the story does not (the base fee's creator share goes entirely to the crew; the tax splits 50 dig / 30 crew / 20 diggers in phase one and 30 / 50 / 20 in phase two). The phase is decided by the port count: the first settlement that begins after the hundredth port opens uses the second set of constants.

The fees each port earns itself split in the same spirit, each token separately. Phase one: 50% back into the two inventories to keep building (the stock part to the stock side, the CANAL part to the CANAL side), 30% to the crew (the stock part converted to SNDK before it enters the stream, the CANAL part in kind), 20% to the diggers. Phase two swaps: 30% build, 50% crew, 20% diggers. The protocol never converts CANAL into SNDK — that would be the protocol selling its own token.

Converting the stock tokens into SNDK uses the same safety envelope as opening a port: US market hours, a fresh Chainlink price, best of direct versus a USDG hop, slippage ≤ 1.5%, no single trade above 2% of the target pool's depth, DEX price within 3% of Chainlink. If any condition fails, it waits for the next window; nothing is forced to "pay today". Never force it.

3.5 BALANCED DEPTH: where the port money goes

Walk through two days of the example first. Day one: the home pool's dig share is $12,500 and port fees put $4,000 on each side; the settlement splits the $12,500 in half — buy TSM $6,250, buy CANAL $6,250 — and each side reaches $10,250, short of $20K, so it keeps saving. Day two: another $12,500 arrives plus $4,000 per side; the settlement halves it again and both sides reach $20,500. Funded: PORT READY, and in the next trading window $41,000 locks into #08 TSM.

That is BALANCED DEPTH. After 00:00 UTC every day, anyone can trigger one settlement. The settlement looks at three numbers:

• S: how many dollars the stock side of the next port already holds (the stock part of port fees plus earlier allocations)
• C: how many dollars the CANAL side already holds (bought-back CANAL plus the CANAL part of port fees)
• R: today's dig share of home-pool revenue

The rule:

X = clamp( (C + R − S) / 2 , 0 , R )     to the stock side
Y = R − X                                buys back CANAL

The result is that both sides are made as equal as possible, then deepen together. The new port deploys min(S′, C′, the safe deployment cap) per side; ≥ $20,000 means READY. The safe cap is set by the target stock's external depth and the oracle's state. $20K is the floor, not the ceiling.

Four cases (USD, example numbers):

Why not spend the whole dig share on CANAL? Because CANAL would pile up in the warehouse — bought back but never built out. Buying only CANAL is the logic of a price-support tool; we want ports. BALANCED DEPTH puts every dollar of the dig share onto the port-building path: level both sides as far as possible, deploy as much as is safe, and whatever cannot be deployed because of the target stock's depth, the oracle or the trading window stays in inventory until the next executable opportunity. Never force it.

3.6 Where bought-back CANAL goes

CANAL bought back by RevenueVault moves to CanalInventory within the same transaction. That contract has exactly one exit: CanalVault.openPort — into permanent port LP. No transfer, no withdrawal, no administrator. The protocol only buys. It never dumps.

The 35% reserve (THE CANAL) supplies the CANAL side of the Genesis seven; after that it only tops a port's CANAL side up to the $20,000 floor when it falls short — not a cent more, and never any deepening above $20,000. The reserve is ballast, not an accelerator.

3.7 The flywheel

FLOW → FEES → CREW PAID → PORT DUG → MORE FLOW

More ships, more fees; more fees, more for the crew and deeper ports; deeper ports, and bigger ships dare to come. Every trade pays the crew. Every trade digs the canal. By the hundredth port, port fees come from a hundred ports and have become the main source of building capital — handing that part of the home pool to the crew is the concrete form of "the canal is built; the river belongs to the crew."

4. Tokenomics

4.1 Supply constitution

At launch the protocol buys 35% of the total supply, all of it into the reserve; the other 65% is made up of public buying on the Pons curve plus the permanent pool after graduation. There is no team share, no growth fund, no reserve for anyone. Note that "the market" and "the crew" are not the same thing: the crew are the people who have deposited CANAL into CrewVault, a number that changes every day and lives onchain.

4.2 What "locked" means, and what it doesn't

Two constraints must be kept apart, and the home page and this paper both use this wording:

• Permanent LP (Permanent Liquidity): the positions inside CanalVault and the HOME PORT, whose principal nobody can withdraw. Note that the amount of CANAL inside a pool changes with trading — when someone buys CANAL the pool holds less, when someone sells it holds more. What is locked forever is the right to withdraw principal, not a particular quantity of CANAL.
• Protocol-constrained (CANAL COMMITTED): the CANAL in the reserve, the home port, the ports and the pending inventory can only be used for liquidity under protocol rules and is not at the team's discretion. This is not the same as "out of circulation".

There is no time lock, because there are no team tokens to lock.

4.3 How the builders get paid

Zero team allocation. Builders earn their pay. The team has no token allocation; its income has two sources only: $0.40 of every $100 traded in the home pool, and 20% of port fees. The CANAL side of port fees means the team will come to hold some CANAL as the canal grows — earned, not allocated, and the amount is onchain. The team has no authority over any principal, any vault or any role (§6).

5. What the crew gets, and what to watch (Holder Economics)

Directly: board, get paid. Boarding means depositing CANAL into CrewVault. After each day's 00:00 UTC settlement, yesterday's crew share — $1.30 of every $100 in the home pool, plus 30% of port fees — streams linearly over the next 24 hours to everyone on board: each moment, fees flow to you in proportion to your CANAL against everything on board; stay longer, earn more; one minute on board earns one minute's share. Settlement is not always exactly on the hour, so when a new day's money arrives before the previous stream has finished, the remainder and the new money are spread together into a fresh 24 hours — nothing lost, nothing double-counted. Share that streams while nobody is on board goes back to building: money nobody boards for keeps digging the canal. You receive SNDK (the home-pool share, plus port stock fees converted into SNDK) and CANAL (the CANAL side of port fees). There is nothing to claim: the protocol's payout keeper delivers your accrued share to your wallet every day, gas paid by the protocol; if the keeper stops, nothing is lost — the share stays in the contract and you can claim it yourself at any time. Leave any time: no lock, no fee, no expiry. Not on board, not paid: CANAL left in a wallet, on an exchange, in an LP, in a bridge or in a lending contract does not participate — not because anyone is on an exclusion list, but because the contract only counts what is deposited. Who gets how much is accumulated entirely by the contract; nobody has the power to decide the outcome, and there is no snapshot and no list. The day's total distribution, the total CANAL on board, and what 10,000 CANAL earned for a full day on board are all readable onchain and in the indexer; we only ever show "yesterday" and never annualize — the first week's numbers will look great, and then they will follow trading volume. We are saying that first.

Indirectly, three things, each a number you can verify onchain:

The protocol only buys. It never dumps. Every day's settlement spends Y dollars buying CANAL in the HOME PORT, and the only exit for that CANAL is port LP. There is no path for the team to extract it or sell it back into the market. That does not mean there is no selling in the market — it means the protocol is always standing on the buy side.

CANAL COMMITTED. An onchain snapshot of how much CANAL currently sits on the protocol-constrained path — reserve, home port, ports and pending inventory — as a share of total supply. It is not the same as out of circulation and it does not promise to rise monotonically; the CANAL inside pools moves with trading (§4.2).

PERMANENT LIQUIDITY. Two numbers need separating. LIVE PERMANENT LIQUIDITY is the real-time dollar value of the permanent LP today — "permanent" means the principal cannot be withdrawn, not that the dollar value only rises; when stocks and CANAL fall, it falls, even though not a cent of LP has left. CUMULATIVE CAPITAL DEPLOYED is the total capital ever deployed, valued at the time each port was built — that number only goes up. The home page shows the former; both count only ports that have opened, and a port that is funded but not yet open is shown separately.

Honest words, before someone else says them for us. First, the crew's money comes from trading volume, and volume fluctuates; on a day with no ships there is no distribution. Second, every dollar paid out is a dollar that did not become a port — v1 spent 100% of home-pool revenue on digging and could open a port a day; this version pays half to the crew and, in the example, opens one every two days; after the hundredth port the crew's share rises again, the home pool digs less, and the pace rests on the port fees of a hundred ports. We chose this road because a canal nobody boards is useless however fast it is dug. Third, port LP dampens CANAL's volatility: when CANAL rises, arbitrageurs buy it out of the pools; when it falls, the pools absorb it; more ports, more damping. For infrastructure that is a feature; for pure speculation it is a bug.

6. Who can touch the money? (Security & Trust)

6.1 Nobody can touch principal

The implementation constraints of CANAL v2 are: the core principal contracts must not use upgradeable proxies, must not contain any owner or admin path that withdraws principal, and must not contain any withdrawal path that a pause or a governance action could open. The pre-launch audit must verify each of these. The protocol allows exactly three restricted governance surfaces and no other administrative action — one fewer than v1, because the crew share's accounting and payout have no role at all:

The split ratios of the three vaults are constants that cannot change after deployment; no role can touch principal, inventory, the reserve, or the CANAL the crew has deposited into CrewVault.

6.2 Invariants: written into the contracts, and into the tests

The protocol specification defines the full set of invariants and the test plan maps each one to a test; the complete implementation must pass unit / fuzz / invariant / fork tests before launch. The core ones:

• SPLIT-1: every settlement, crew + dig + diggers == revenue received, in the ratios of the deployed constants for the current phase.
• SPLIT-2: the phase is decided only by the onchain port count and flips from 1 to 2 exactly once, never back (2A); each settlement's phase is locked when it begins and cannot change afterwards (2B); the split uses only the locked phase (2C); no role can set it.
• CV-1 / CV-3 / CV-4: in CrewVault, for each asset, claimed + swept + balance == inflows; deposit, withdraw and claim can never be blocked (no pause, no list, no lock); nobody but you can reduce your deposited balance.
• C-1 / C-2: bought-back CANAL never flows to the team, is never sold, never burned; CanalInventory's only exit is port LP.
• BAL-1: every settlement's stock-side allocation equals exactly clamp((C + R − S) / 2, 0, R).
• R-2: the reserve tops the CANAL side up only to $20,000, and when a backstop is used the port's depth does not exceed the floor.
• D1: the liquidity of every port position never decreases.
• Q-1': after Genesis, at most one port opens per UTC day.
• S-L: a daily settlement can never be permanently stuck — after it expires, anyone can finalize it and unspent money rolls into tomorrow.
• G-1: no administrative action beyond the three governance surfaces; no path touches principal.

6.3 Oracles and time

Stock Tokens are valued by Chainlink; Robinhood's onchain feeds already include the split multiplier, so the protocol does not apply it again. CANAL has no Chainlink feed, so a TWAP is computed from a ring buffer of onchain observations of the HOME PORT, which anyone can record. A port opens only inside US market hours, with a fresh price and the DEX within 3% of Chainlink; the conversion price used by a settlement must come from Chainlink and be no older than 26 hours; past the staleness threshold the action is deferred, never executed at a stale price.

6.4 The gate before launch

Before launch there is an automated Gate: it reads Pons' launch parameters and fee rates, the Chainlink feeds, whether SNDK can be held by a contract and transferred to an arbitrary wallet, external depth, audit status and more — over thirty items (a legal opinion is an advisory item: recorded, never blocking). Any required item that fails, or has not been verified and signed off, blocks the script outright; there is no "pass by default". The three split constants are recomputed from the on-chain fee rates and checked against the deployed values; CrewVault's 24-hour stream rate, two-asset accounting and absence of any pause path are verified item by item on a fork. After launch a self-check runs again to confirm the onchain launch parameters (creator tax 2%, revenue recipient, buyback disabled) match the design.

6.5 Audit

An independent audit is completed and its report published before launch; a bug bounty opens after launch. Pons v2's own audits were still in progress when this paper was written; the protocol's handling of that risk is an explicit, public, written acceptance or a delay — never a silent launch.

7. Standing on Pons' shoulders

CANAL is built on Pons v2 and takes several of its rules as design premises: the creator tax is set at launch and can never change afterwards (so CANAL's 2% is a constitution, not a promise); the creator tax and the creator share go to one transferable recipient address (we set it to RevenueVault), and Pons has no multi-recipient or holder-distribution feature, so the split ratios are hardcoded in CANAL's own contracts; Pons' built-in buyback is switched off for CANAL, because our buybacks go into ports rather than into a five-year lock.

The path by which home-pool revenue arrives is defined by Pons: fees accumulate on the curve or on the pool's hook, are "swept" into an escrow contract by Pons' operator or the creator, and are then claimed by the recipient. RevenueVault has a claim function anyone can call; the daily settlement looks only at balances that have already arrived, so Pons' cadence can never stall CANAL's settlement — it only affects how quickly revenue lands.

Pons retains one power: it can propose replacing the revenue recipient of any token; after a three-day wait anyone can execute the change, it expires three days after that, and Pons can cancel it during the wait; a transfer of the recipient by the creator does not cancel a pending proposal. This is the only path by which the HOME PORT's future revenue could stop flowing to RevenueVault. What that power can change is the future fee stream; it touches no principal — port LP, the 35% reserve, the pending inventory, the CANAL the crew has deposited into CrewVault and the share already streamed but unclaimed are all outside it. CANAL's principal security ≠ Pons' revenue-routing power. The protocol's indexer subscribes directly to Pons' propose / cancel / execute events, and any non-zero proposal is made public immediately.

8. What could go wrong? (Risks)

We say it first, so nobody has to say it for us.

• Regulation: the heaviest item in this version. Distributing SNDK — a tokenized debt security — to CANAL holders by holding, with the ratios in the open, is the arrangement most likely to be classified as revenue sharing. Launch is not conditioned on a written securities-law opinion (founder decision, 2026-09-07); the front end enforces geographic restrictions and self-declaration. Regulatory and geographic-access decisions belong to the deployment and front-end layer; they do not alter the frozen v2.3 protocol economics.
• Claimability of SNDK: the issuer's restrictions on transfer and on who may hold can change at any time, and any restriction hits the home pool, the ports and crew payouts at once. Transfers of SNDK to an arbitrary new wallet are simulated before launch.
• SNDK as the unit of account: CANAL's dollar price = CANAL/SNDK × SNDK/USD, carrying all of SNDK's volatility plus the mispricing of Stock Tokens while US markets are closed.
• Slower building in phase two: after the hundredth port the home pool's dig share drops from $1.00 to $0.60 and the port-fee dig share from fifty to thirty percent; the pace rests on the port fees of a hundred ports, and the protocol promises no rate of opening.
• The friction of "not on board, not paid": without depositing into CrewVault there is no share, which is one more transaction, and holders who don't know the rule will miss out. Mitigation: the home page's first screen says "board = deposit", and the ON BOARD share is public. CrewVault is itself a new custody point for user assets; it uses an audited standard pattern, has no administrator, and deposit, withdraw and claim can never be blocked.
• Pons v2 unaudited (at the time of writing) and the platform's revenue-routing power (§7: future fee flow only, never principal).
• Pace of opening: the dig share is a fraction of v1's; in the example one port every two days instead of one a day; on days without volume, ports are deferred.
• Robinhood Chain's sequencer: when the centralized sequencer is down, every permissionless action is delayed; the design has no time-critical dependency.
• Oracles: a stale or deviating Chainlink feed delays port openings and settlements; it never makes them execute at a wrong price.
• Revenue uncertainty: every distribution and every port depends on trading volume. The protocol makes no promise of any return.

9. What's next (Roadmap)

Phase 0 · Before launch: contract implementation, invariant tests, Robinhood Chain fork tests, independent audit, every Gate item passed (a legal opinion is advisory).

Phase 1 · Genesis: launch on Pons, protocol buys 35%; graduation; the seven ports open in the first trading window; the first settlement, and the first day's crew share starts streaming.

Phase 2 · PAID DAILY. DUG DAILY.: daily distribution, settlement and port opening become routine; the indexer and the home page go live on real data; the router page launches (three-route comparison); English site.

Phase 3 · Deeper: without breaking "permanently locked", research adding depth to open ports, concentrated liquidity ranges, and a more decentralized source for the ranking. Any change of mechanism is published as a new version of the specification and audited.

10. Parameters at a glance

Appendix A · Bootstrap math (Transparent Protocol Bootstrap)

Let the total supply be S, the Pons phantom quote Q₀, the starting price P₀ = Q₀ / S, the graduation retention ratio r, and the buy-side fee rate φ = base fee + creator tax = 3%. The protocol buys 35%: net spend on the curve = 0.538 Q₀ (X(b) = Q₀·b/(1−b), b = 0.35); because Pons takes fees off the input before the curve prices the trade, the actual payment = 0.538 Q₀ / (1 − φ) = 0.555 Q₀. The protocol's average curve price is 1.54 P₀; the public buys from 35% up to 1 − r to graduate; the marginal price at graduation is P₀ / r².

This assumes the protocol completes its 35% purchase first, the public then buys to graduation, and interim selling is ignored. The expressions above are continuous mathematics and ignore Solidity integer rounding; the actual launch budget is computed under Pons' onchain fee-by-fee rules and cross-checked by the pre-launch Gate against onchain parameters. The specific numbers are published before launch.

Appendix B · Glossary

• Port: a permanently locked liquidity pool of CANAL and one Stock Token.
• HOME PORT: the CANAL / SNDK main pool after Pons graduation.
• Island: a Stock Token; "joining an island" = opening a port for it.
• Crew: the people who have deposited CANAL into CrewVault; boarding = depositing, leaving = withdrawing, any time. THE CREW SHARE: the fees streamed to the crew each day. ON BOARD: the total CANAL in CrewVault right now.
• Builders / the diggers: the team, with zero allocation. THE CANAL: the 35% reserve. THE MARKET: the 65% open market.
• BALANCED DEPTH: the settlement rule that levels the dig share between the stock side and the CANAL side and deepens both together.
• CANAL COMMITTED: a snapshot of the share of CANAL currently on the protocol-constrained path (reserve, home port, ports, inventory); not the same as out of circulation, and not promised to rise monotonically.
• LIVE PERMANENT LIQUIDITY: the real-time dollar value of the two-sided liquidity the protocol cannot withdraw (open ports only; moves with prices).
• CUMULATIVE CAPITAL DEPLOYED: the total capital ever put into permanent LP, valued at the time each port was built (only goes up).
• READY / OPEN: both sides funded and waiting for a trading window / opened and permanently locked.
• BEST PATH WINS: the router never forces flow through CANAL; the best route wins.

Appendix C · The language of the canal

Every stock is an island. We dig the canal. EVERY STOCK IS AN ISLAND. CANAL CONNECTS THEM. Paid daily. Dug daily. PAID DAILY. DUG DAILY. BUY · BOARD · DIG Funded, it opens. At most one a day. Dig a hundred ports. At #100, crew share goes 30 → 50. DIG A HUNDRED PORTS. AT #100, CREW SHARE GOES 30 → 50. Short days: dig to the floor. Rich days: dig deeper. $20K IS THE FLOOR. NOT THE CEILING. The protocol only buys. It never dumps. Not on board, not paid. Money nobody boards for keeps digging the canal. Zero team allocation. Builders earn their pay. ZERO TEAM ALLOCATION. BUILDERS EARN THEIR PAY. ANY PORT ↔ ANY PORT. BEST PATH WINS. The rules are hardcoded. Go check. Every trade pays the crew. Every trade digs the canal. EVERY TRADE PAYS THE CREW. EVERY TRADE DIGS THE CANAL.

canal.market · Robinhood Chain · CANAL Whitepaper v2.5 · THE HUNDRED · September 2026