Methodology and integrations

VonzyProtocol is a tokenized-equity pool scanner, route simulator and execution interface for Robinhood Chain. Its workflow is fixed: discover verified pools → compare prices of the same token contract → construct a cyclic route → calculate costs → simulate the transaction → review and sign → verify the receipt. Each step checks the one before it.

Displayed spreads are signals, not executable returns. Most of the time no route is eligible — an efficiently arbitraged market is the normal state, and the interface says so. It has a token, $VONZY, whose contract address is published on this site once it is live (CA: Soon until then) — and the app does not use it for anything: no staking, no treasury, no yield, no fee discount or reward, and no promise of profit. There is no launchpad or lending feature.

ScannerRoutesActivityNetwork status

Blocks arrive about every 0.1 s. Cross-chain routes are out of scope: a cycle across two chains cannot be atomic. “Robinhood Chain” is used only as the network name; VonzyProtocol is independent software with no affiliation.

Assets. The asset list is the issuer’s Stock Token registry (https://api.robinhood.com/rhj/assets) — 195 tokens at block 71,231,041. Each address must also be an ERC-1967 beacon proxy of the issuer’s beacon 0xe10b6f6B275de231345c20D14Ab812db62151b00 with matching symbol()/decimals(). Settlement assets: USDG 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 (6 dp) and WETH 0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73 (18 dp).

Pools. factory.getPool for every Stock Token × {USDG, WETH} × fee tier (0.01%, 0.05%, 0.3%, 1%), factory.getPair for V2, plus WETH/USDG connectors — asking the canonical factory is the membership proof. Stock/stock pools come from a bounded PoolCreated log scan; every entry is re-validated with getPool at run time.

Manual inspection. Any address pasted into the scanner is read live: the V3 pool and V2 pair interfaces are probed, the factory is asked whether it returns that very address, and token facts come from the registry or, when a token is not a registry asset, from the contract itself — labelled unverified. Pools that fail either check are inspected only, never routed.

Depth probes. A V3 position one tick wide reports huge liquidity and fills almost nothing. Every pool above the dust floor (25 USDG of +1 % depth) is probed with a real quote of up to 1000 USDG that must fill within 3% impact beyond its fee. Pools that fail are shown as hollow and excluded from spreads and routing.

Uniswap v4. v4 pools between verified assets are listed from a PoolManager census as an unsupported venue. They are never priced or routed: Uniswap v4 adapter not implemented: hooks can change fees and pricing, and the executor cannot settle v4 swaps.

Matching tickers do not establish asset equivalence. Route discovery compares the exact same token contract on the same chain: a cycle’s legs chain by contract address, and two pools are “the same asset” only when both hold the identical registry address. Wrapped or differently issued look-alikes are excluded — there is no conversion adapter, so none is assumed. The chain carries many tokens with a Stock Token’s symbol; the beacon check above is what separates them.

• All pool state in a comparison is read in one multicall pinned to one block; the block and the retrieval time travel with the data to the screen, and every table shows their age.
• Indicative price (V3 from sqrtPriceX96, V2 from reserves): spot, before price impact — not an exchange price, not an oracle, and never an executable quote. Concentrated-liquidity pools are never quoted from a reserve ratio.
• Executable quote for a size: QuoterV2 (0x33e885eD0Ec9bF04EcfB19341582aADCb4c8A9E7) runs the real pool swap inside an isolated, gas-capped eth_call; V2 hops use the constant-product formula on same-block reserves.
• Gross spread — dearest vs cheapest verified pool of an asset — is a signal, never a result. Estimated net exists only after fees, price impact and converted gas.
• Quotes expire after 20 s. A scan may be shown up to 90 s old while it refreshes — every row shows its age, and the workspace always re-quotes at the newest block. Missing data is shown as unavailable, never as zero.

A cycle starts and ends in one settlement token. Candidates of 2–4 distinct, depth-verified pools are generated (two-pool cycles by default; three and four on request), ranked by spot edge, and the best 48 are quoted hop by hop at sizes of 5%, 15%, 40%, 100%, 250% of the route’s shallowest depth. Malformed pools, unsupported tokens, repeated pools and routes that cannot be quoted are excluded, and each exclusion is reported with its reason.

Every candidate carries exact token and pool addresses, ordered legs, input amount, per-leg quoted output, final output, DEX fees, flash-liquidity fee (if used), a gas estimate, slippage constraints, quote block and expiry, and gross and net estimates. An estimate whose gas cannot be converted is marked incomplete and is never ranked as profitable.

All token amounts are integers (bigint) in base units with the token’s own decimals; rounding is down for amounts you receive and up for costs. The contract-enforced surplus is denominated in the settlement token and does not account for wallet-paid gas: the contract cannot see ETH spent on gas, so the interface values gas separately and lets you set the floor at or above it.

A quote is a price calculation. A transaction simulation is different: “Simulate exact call” runs executeFunded(hops, amountIn, minProfit, deadline) or execute(…) in an eth_call at the latest block, from your address (a placeholder before you connect), with your real balance and allowance, and estimates its gas. The response echoes the exact calldata. A route is labelled Transaction simulation passed only after that call succeeded for the same entry point, route, amount, minimum, deadline window, wallet, chain and contract; changing any of them, letting it age past 30 s, or getting within 20 s of its deadline invalidates it. Deadlines (30–600 s) are measured in chain time.

Statuses: awaiting quote · quote available · quote expired · insufficient balance · approval required · simulation pending · simulation passed · simulation failed · execution unavailable · unsupported. When a prerequisite is missing the status says which one; nothing is marked passed without the actual call.

While no executor is deployed, the same compiled bytecode is injected at a scratch address with an eth_call state override and run against live state — labelled preview. Only the flash-funded path can be previewed this way (a wallet-funded call needs an allowance to a contract that does not exist yet). A preview shows what the contract would do; there is nothing to sign.

A successful simulation is a point-in-time result, not a promise: state changes about ten times a second, other traders see the same pools, and a reverted transaction still costs gas.

Reading the chain…

Wallet-funded (default). executeFunded pulls exactly amountIn of the settlement token by an exact-amount approval, swaps it through every pool exact-input with the amounts actually received, and returns principal + surplus after the protocol fee in the same transaction. If the principal does not come back in full, or the surplus is below your minimum, the whole call reverts and nothing leaves your wallet.

Flash-funded. execute calls swap on the first pool; Uniswap sends the output first and calls back (uniswapV3SwapCallback / uniswapV2Call). Inside the callback the remaining hops run, the first pool is repaid, and the surplus is the increase of the contract’s settlement balance. You supply no tokens and grant no allowance. The verified providers are the canonical Uniswap V2 / V3 pools themselves; no other flash-loan source is integrated.

• Every hop must be the pool the immutable V2/V3 factory returns for its tokens and fee; no arbitrary call targets, no caller calldata.
• Callbacks are accepted only during a cycle, only from the single pool expected next, once; the flash payload is hash-pinned; a reentrancy guard covers both entry points.
• Balances already in the contract cannot subsidise a cycle or leak: payout is the measured increase, principal is checked first, and a non-increase reverts.
• Received amounts must equal what was reported or requested (fee-on-transfer and rebasing tokens are rejected); partial fills revert; tokens are allow-listed; 2–4 hops; deadline; per-cycle minimum surplus; immutable fee cap; the contract never holds a caller’s tokens between transactions and never approves anyone.
• Owner can: allow/disallow tokens, change the fee recipient, pause new executions, sweep non-fee balances. Owner cannot: change the fee or factories, redirect a caller’s principal or surplus, take user tokens, or upgrade (not a proxy).

Tested with unit tests on real Uniswap V2/V3 bytecode (both funding modes, slippage, deadlines, unauthorised callbacks, invalid pools and tokens, reentrancy, principal preservation, unrelated balances) and mainnet-fork tests on real Stock Token pools; counts are in the repository README. Not independently audited. Local test fixtures never touch production configuration.

Before your wallet opens, the call is re-quoted and simulated again on the server and from your browser; the wallet receives exactly those bytes. Approvals are exact-amount, never unlimited, and are never requested by merely connecting. States are driven only by real events: re-simulated → awaiting wallet → submitted → pending → confirmed or reverted (plus rejected, replaced and cancelled). Success exists only after a receipt with status success; the result shown is decoded from its CycleExecuted event, never the quoted output.

Activity rows come from CycleExecuted events and receipts: hash, network, time, status, funding mode, settlement token, input amount, actual result, protocol fee, gas used and paid, explorer link. Each carries a confirmation state from the node’s block tags — included on L2, batch posted to L1 (safe), or finalized on L1 — and the last 256 blocks are re-scanned on every pass so a reorganised execution disappears. Net profit is shown only when result and gas are in the same asset; otherwise both are shown separately. Reverted calls are read from the explorer; transactions this browser submitted are tracked by receipt. CSV export writes exact base units.

The full record — sources, dates, method and open dependencies — is in docs/INTEGRATIONS.md in the repository; pnpm verify:registry re-checks the typed registry (src/config/registry.ts) against its sources and the live chain.

$VONZY is the VonzyProtocol token. Its contract address is published in exactly two places and nowhere else: the Token section of the landing page and GET /api/token. Both read the server-side setting VONZY_TOKEN_ADDRESS, which pnpm token:ca 0x… sets only after the contract has been checked on Robinhood Chain (bytecode, name, symbol, decimals, total supply). Until then every surface shows $VONZY·CA: …; an address quoted anywhere else is not ours.

The app does not use the token for anything. Scanning, quoting, simulation and execution never read a $VONZY balance; there is no staking, no treasury, no yield, no fee discount, no reward, no governance and no promised value. Once live, the site shows only what the chain reports at a stated block: the contract facts and, if a canonical Uniswap V2 / V3 pool against USDG or WETH holds liquidity in range, that pool’s spot price and +1 % depth with its venue and fee tier — indicative, before the pool fee and price impact. When there is no such pool, it says so.

• A web interface is slow next to a co-located bot. Expect opportunities to vanish before inclusion; reverts cost gas.
• The +1 % depth figure is an indicator; probes verify only up to 1000 USDG.
• Sizes come from a five-step ladder, not a continuous optimiser.
• The public RPC throttles and is not archival; the last good read stays on screen, marked stale, with the real error.
• Stock Tokens can be paused, block-listed or upgraded by their issuer; a cycle touching one then reverts.
• Uniswap v4 pools are listed but never quoted or executed; the testnet has no verified venue.

struct Hop { address pool; address tokenIn; address tokenOut; uint24 fee; uint8 kind; } // kind 0 = V2, 1 = V3

// wallet-funded: pulls amountIn by allowance, returns principal + surplus
function executeFunded(Hop[] calldata hops, uint256 amountIn, uint256 minProfit, uint256 deadline)
  external returns (uint256 userProfit, uint256 protocolFee);

// flash-funded: borrows amountIn from the first pool, repays it inside the callback
function execute(Hop[] calldata hops, uint256 amountIn, uint256 minProfit, uint256 deadline)
  external returns (uint256 userProfit, uint256 protocolFee);

event CycleExecuted(address indexed caller, address indexed settlementToken, uint256 amountIn,
  uint256 grossProfit, uint256 userProfit, uint256 protocolFee, address[] pools, bool funded);