Docs
How it works, and where it breaks.
The mechanism
A Robinhood Stock Token is an ERC-20 with 18 decimals behind a beacon proxy, all 194 of them pointing at one shared implementation verified on chain. It carries an ERC-8056 multiplier: effective holding = raw balance × uiMultiplier() ÷ 1e18.
A corporate action moves the multiplier instead of minting. So a dividend is a scalar bump that a contract can read, which is the entire reason Koupon can exist without a custodian.
Stripping deposits a token and issues equal PRICE and KOUPON keyed to (underlying, maturity). Rejoining burns equal amounts of both and returns the token — permissionless and fee-free. At maturity KOUPON stops accruing; PRICE redeems 1:1 forever, with no deadline.
The classifier
updateMultiplier() carries no reason code, and UIMultiplierUpdated(old, new, effectiveAt) has no action type. Nothing on chain distinguishes a dividend from a split. The only signal is the size of the move, so the classifier sorts into three bands and only the outer two resolve on their own:
- Coupon — 1.0 < r ≤ 1.005. Released after a timelock and a second source.
- Ambiguous — 1.005 < r < 1.20. Never auto-releases. Held until an external feed confirms an ex-date and a matching size. A timeout is not evidence, so held value is never routed to PRICE by default.
- Capital — r ≥ 1.20. Credited to PRICE, never to KOUPON, and no confirmation can promote it.
The bands come from measured data. Every coupon-shaped move on this chain is at or below +0.2211%; every split is +100% or more. Two orders of magnitude of daylight is what makes a band classifier viable at all — and CCL’s +2.1486% is what makes the middle band necessary.
This is a trust assumption. Koupon cannot classify a corporate action from chain data alone, so it depends on an off-chain source to pay a coupon. It is not trustless at the moment of classification and it does not claim to be.
Attack surface
| A split misclassified as a coupon | Catastrophic — a 2-for-1 would hand KOUPON holders half the company. Three-band classifier, a hard sanity bound, a sweep halt above threshold, and a required second source. The capital band credits PRICE by default, so the failure direction is toward the holders of the corpus. |
| A coupon misclassified as a split | The inverse and cheaper: KOUPON is underpaid and the value accrues to PRICE. Still theft from one leg to the other, so ambiguous moves hold rather than resolving to either side. |
| Duplicate event emission | Observed on chain. WEEK and CRWD each emitted the same action twice. Accretion is computed from observed state transitions rather than event deltas, so a repeat is a no-op. |
| Multiplier reversal | Observed on chain. WEEK went 2.0 to 1.0, 122 blocks after doubling. Treated as a halt, never as a negative accretion, and never clawed back from a holder who already drew. |
| effectiveAt skew | Observed on chain. One action was emitted three days before it took effect. Accrual keys to effectiveAt, not to the block timestamp. |
| Ex-dividend front-running | Strip before the ex-date, take the KOUPON, rejoin after. Rejoining needs both legs and the KOUPON is worth roughly the coupon, so it is close to neutral — but rounding favours the vault everywhere, which closes the gap it would otherwise leave. |
| Sweeping into a shut market | Accretions are sold during market hours only. Tokenised equities trade around the clock; the things they track do not. |
| Dust maturities | A minimum strip size, and a ladder capped at four maturities. MU accreted +0.0075%: on $100 that is three quarters of a cent. |
| Oracle failure on the multiplier | An unreadable multiplier reverts. Never 1.0, never cached, never defaulted. CRWD reads 4.0, so a fallback would be a fourfold mispricing. |
| A market with no pool | An accretion that cannot be sold is a claim that cannot be paid. Markets open only where USDG depth exists — and SGOV, the best coupon here, may fail that test. |
| Impostor underlyings | At least five contracts share the symbol USDG and four have more holders than the canonical one. Underlyings resolve by registry address, never by symbol. |
| Issuer burn and pause | adminBurn, pause and pauseOracle let the issuer destroy or freeze the vault's collateral. There is no architectural mitigation. It is disclosed on the homepage. |
| Rounding | Always toward the vault. The last redeemer is never short. |
What is not built
Almost all of it. There are no contracts deployed: no vault, no PRICE token, no KOUPON token, no claim pool, no sweep, and no corporate-action feed selected. The classifier above is specified and unit-tested against the real event log, and it has never run against a real vault because there is no real vault.
What is real: the multiplier readings, the registry addresses, and the 9 coupon-shaped accretions in the history — read at block 51,114,258 on 2026-08-31.
There is also no token. PRICE and KOUPON are the products. A third protocol token was considered and rejected: the only defensible design is burning it to open a market, and that prices market creation in something nobody needs to hold for any other reason. Declining a token is easier to trust than forcing one.
Risks
KOUPON captures dividends if and when they are declared and reflected in the token's multiplier. That is not the same thing as a shareholder's dividend. A company can cut its dividend to zero, and KOUPON goes to zero with it.
Robinhood Stock Tokens are tokenised debt securities issued by Robinhood Assets (Jersey) Limited. They give economic exposure to a share price. They are not shares: no ownership, no voting rights, no claim on the underlying company.
Stock Tokens are not offered in the United States, Canada or the United Kingdom. Koupon is not available to residents of those countries, and there is no workaround.
Splitting a security-linked instrument into two tradeable claims and selling them separately is, in most jurisdictions, the creation of two new derivative instruments. The mitigation is architectural — non-custodial, permissionless, no discretion, no promise of a payout — and it has to actually be true. Koupon will not deploy a vault against a real coupon without a securities opinion first.