Your next move stays yours
Robinhood Chain is our sole target network — the Undertow identity, ocean narrative, logo and UTOW name remain
Private intent, gradual execution
Undertow Network is a private strategy engine for traders and AI agents — plans are encrypted in your workspace and each executed batch follows your committed limits
Two trading paths are available in the workspace — batch accumulation through the configured venue and private limit orders through the dark pool pilot
The first product path is encrypted batch accumulation from USDG into WETH — ETH pays network fees
Wallet sign-in, live balances, encrypted planning, recovery, live quotes and wallet-signed batch execution are available — bounded automatic execution is available to the restricted pilot wallet
Hedging and agent coordination on the homepage remain concept experiences
Approval and swap are separate wallet transactions — refresh the quote after an approval is finalized and review the next request
A verified successful swap receipt unlocks the next due batch — finality continues in the background and every new request rechecks pending receipts against the canonical chain
After an interrupted wallet request, recover its transaction hash from wallet activity — unresolved requests are never resubmitted automatically
Robinhood Chain and UTOW
Robinhood Chain is an Ethereum-compatible Arbitrum Layer 2 — mainnet uses chain ID 4663 and testnet uses 46630 — both use ETH for gas
Network configuration follows the official Robinhood Chain documentation
Balances query native ETH, USDG and WETH — each response uses a single block number from a chain-checked RPC endpoint and reports read failures explicitly
Token addresses follow the official token contracts
UTOW is planned as an independently issued ERC-20 token on Robinhood Chain — no UTOW contract is deployed — supply, allocation, vesting, minting permissions and issuance timing remain to be decided
UTOW carries no required payment, staking, governance or access role — product permissions come from the user and execution contracts, while gas uses ETH
Four core modules
Private strategy room
Names, budgets, schedules and slippage settings are encrypted on the user device with AES-256-GCM — Supabase stores ciphertext rather than future strategy plaintext
Wallet sign-in and decryption are separate — recovery keys remain with the user and cannot be recovered by resetting a login
Fresh nonces and authenticated metadata bind the owner and vault — encrypted export and backup recovery preserve the original plan identifiers
Strategy compiler
Deterministic rules divide USDG budgets into ordered batches using integer base units — automatic authorization commits each batch amount, minimum output and execution window
RH plans carry a separate network and format version — incompatible network backups are rejected rather than reinterpreted
Bounded execution
Deployed immutable Solidity vaults enforce approved assets, total budgets, per-batch limits, the owner recipient, expiry and ordered batch execution
A dedicated executor can submit only committed batches — sign-in signatures do not authorize spending and token allowance does not enlarge a funded plan budget
Manual trading and the bounded automatic pilot use the deployed Uniswap V3 router — one immutable vault isolates each automatic plan budget
Strategy overview
View actual input, WETH received, remaining budget, average entry and executed batches as soon as a successful onchain receipt is matched — chain finality is tracked separately and unfinalized totals can change after a reorganization
Transaction recovery
Check onchain status and recover a finalized original or replacement hash from wallet activity — supported replacements preserve the request or cancel it with an empty zero-value same-nonce transfer to your own address
Missing transactions and expired deadlines never unlock a batch automatically — speed-up and cancellation stay in your wallet
Private receipt view
The workspace matches transaction hashes to the current batch and displays actual USDG spent, WETH received and network fees from chain receipts
Quotes are not fills — prepared, unresolved, submitted, included, finalized and reverted transactions remain distinct
Disclosure boundaries
Device encryption protects saved plan contents — the storage service can still see account identity, save times and ciphertext size
RPC providers, quote services and trading contracts can observe current addresses, assets, amounts and timing
Transactions and fund flows on Robinhood Chain remain public — gradual disclosure does not provide anonymity or erase historical correlations
Automatic handoff encrypts the full schedule for the selected executor, which decrypts it to run the plan — executor-blind future batches are not implemented
Permissions and user exits
The deployed vault checks approved venue routes, recipients, committed amounts, minimum outputs, time windows and ordered batch identifiers
The vault builds the approved swap call and checks actual asset changes — arbitrary external calls and arbitrary recipients are not supported
Funded automatic plans expose Pause plan, Resume plan and Cancel and refund in the workspace — each action requires an owner wallet transaction and works independently of the execution service
Automatic pause and cancellation take effect onchain — a batch can execute before the owner transaction lands, but cannot execute while the vault is paused or cancelled
Cancellation is permanent for the same plan identifier, including restored backups — confirmed trades cannot be reversed and a pending transaction can race with an onchain revocation
Vaults are immutable — the executor pays batch gas and the owner pays control transaction fees — cancellation returns unspent USDG to the owner and leaves previously received WETH untouched
Resuming preserves the original time windows and minimum outputs — missed windows are not extended automatically
Owner transaction hashes are saved before reconciliation — the workspace checks canonical receipts, actual refund transfers and current chain state rather than treating a wallet click as completion
Recovery without the encryption key
Sign in with the original owner wallet — the wallet overview automatically finds funded plan contracts from factory creation events without unlocking an encrypted vault
Each contract is checked against the factory and wallet owner before its controls are shown — a known contract address can also be opened directly
Recovery restores access to onchain funds and controls only — encrypted names and private schedules still require the original recovery key
Cancellation returns the remaining USDG to the owner after its transaction succeeds — owner transactions require ETH for gas and wallet confirmation
Why a batch is waiting
Automatic plan details explain time windows, fixed minimum output, executor fee caps, low executor gas, pending transactions and recovery conditions
Worker reasons show the last observed condition — delayed heartbeats are labelled and do not imply that a new quote was checked
Wallet sign-in and balances
EIP-6963 and injected Ethereum wallets are supported — users approve the connection, switch to Robinhood Chain and sign an expiring sign-in message
Supabase verifies the signature and site domain — trusted identity records establish ownership and editable profile metadata is not used as proof
The balance API verifies the session and registered wallet before reading RH mainnet — cross-account requests are rejected
ETH, USDG and WETH use integer precision — failed requests display unavailable rather than zero and native ETH is counted separately from WETH
Balances are read at the latest observed block and are not labelled finalized — supported token addresses and decimals are checked against the configured contracts
Use a browser wallet extension or a mobile wallet browser — QR wallet connection is not available
First use and unified overview
The workspace guides you through wallet sign-in, vault protection, plan creation, private orders and transaction records — returning users can reopen or skip the guide
The wallet overview separates wallet balances from automatic contract deposits, actual USDG spent, WETH bought and USDG returned — historical flows are not added to wallet balances
Wallet totals cover all funded automatic plans owned by the signed-in wallet at the deployed Undertow factory — each contract is counted once across encrypted vaults
Discovery and plan funds share a checked block — incomplete discovery, missing reads or a changed canonical block withhold full totals rather than reporting zero
Filter wallet plans by state and expand a contract for execution receipts and owner controls — reads refresh every minute while visible and never prepare or send trades
Names and full schedules stay encrypted — unfunded drafts and manual plans remain in their private vaults — the private vault view is a separate subset and must not be added to wallet totals
Wallet activity and attention
Sign in to view activity for your funded automatic plans and private dark pool orders — no vault unlock or vault switching required
Open plan reveals its contract and owner controls — Open order reveals its signed terms and outcome — View funds focuses the corresponding record and receipt links open the actual transaction
Automatic plan activity refreshes every 60 seconds and dark pool checks every 20 seconds while visible — notifications are in-app and are not background push messages
Read markers stay in this browser and are scoped to your wallet — unavailable reads remain explicit and a changed receipt is flagged for rechecking
Manual plan activity remains inside its encrypted vault — private names and draft schedules are not exposed in the wallet view
Undertow Guard
Undertow Guard is the product name for the spending limits, execution conditions and owner controls in our bounded automatic execution pilot — it is not a separate protocol or an insurance fund
A SAFU mindset
Explicit limits, isolated budgets, owner-controlled exits
SAFU describes the mindset here — Undertow has no affiliation with Binance SAFU and does not provide loss coverage or a guarantee of fund safety
What the contract enforces
Each funded automatic plan has a fixed total budget, a maximum batch amount, committed minimum WETH outputs and execution windows — the selected executor cannot change the committed schedule or send purchased WETH to another recipient
Each plan has its own contract balance — this separates plan budgets but does not remove risks shared by the contract code, chain, tokens or trading venue
The owner can pause eligible future execution or cancel and withdraw the unspent budget — a batch may execute before that owner transaction lands — completed trades are not reversed
What you review
The draft review shows the planned budget, batch amounts, recipient and expiry — exact minimum WETH outputs are fixed later at authorization review using live quotes
Before funding, Your protection settings shows the committed budget, maximum batch amount, recipient, expiry and every batch minimum — saving the draft alone does not activate these contract controls
Current scope
Automatic execution remains a restricted mainnet pilot — the contracts have not received an independent audit — these controls do not guarantee execution, returns or recovery of losses
Manual plans use separate wallet confirmations and per-transaction limits — they do not deposit the full budget into an automatic plan contract
Review before saving
Plan creation shows a final review of total input, exact batch amounts, local execution times, fill conditions, wallet prompts and who pays network fees
Saving only encrypts a draft — no funds move and no wallet signature is requested — automatic minimum WETH outputs are set later from live quotes at the separate funding review
Automatic drafts include an execution window for each batch and show the proposed expiry — the funding review carries this window forward and still requires review before any deposit
Network fees are not guessed at draft creation — the wallet estimates owner transaction fees before each confirmation and actual fees are recorded onchain
Encrypted plans and controls
Create a vault, save its recovery key, then define a USDG budget, batch count, interval, first execution time and slippage cap
The schedule conserves every base unit of the budget — saving a plan does not spend funds or start a trade
Cloud saves use revision checks and fresh encryption nonces — a stale edit must reload before replacing a newer vault
Manual plan controls are stored against the owner and plan identifier — automatic plan controls instead change the funded vault onchain and restoring a backup cannot undo them
Vercel hosts the app and API and invokes the executor every minute — Supabase persists encrypted handoffs, transaction records and fenced concurrency locks
Accepted automatic plans continue while the browser is closed — persistent user-controlled runners remain a future direction
Production execution stack
The production wallet stack uses Ethereum signatures on Robinhood Chain mainnet — chain ID 4663 and gas ETH
Live quotes query deployed Uniswap V3 pools on RH mainnet — the router code, factory, token addresses, token decimals and pool assets are checked before a wallet request is prepared
Only Robinhood Chain is supported by the production account and trading interface
Fund the connected wallet on Robinhood Chain — the workspace does not bridge tokens or convert assets from other networks
Vercel hosts the website and execution APIs — Supabase stores encrypted plans and orders, durable execution records and concurrency locks
Delivery roadmap
RH accounts and encrypted planning / Available
Ethereum wallet sign-in, RH balances, encrypted batch plans, backup recovery and saved-plan pause, resume and cancellation
RH quotes and manual trading / Available
USDG to WETH quotes compare supported direct fee tiers — exact batch approvals, minimum output, swap deadlines and wallet signatures constrain each request
Limited authorization / Mainnet pilot
The first version uses one immutable vault per funded plan — exact USDG budget, committed batch limits, owner-set minimum WETH output, expiry and owner-controlled cancellation with withdrawal
The executor pays gas and cannot withdraw funds or change the recipient — dynamic market-relative slippage protection requires a separately reviewed price source
The immutable factory is deployed on Robinhood Chain — access is restricted to the pilot wallet and the contracts have not received an independent audit
Read the bounded execution contract specification
Completed plan receipts / Available
Completed plans show actual fills, receipt links and separate swap, approval and failed transaction fees — finality continues in the background and receipt rollback reopens the completion state
Automatic batch execution / Pilot service deployed
The production runner uses Vercel minute scheduling with Supabase persistence and fenced concurrency locks — encrypted handoff, nonce recovery and receipt reconciliation support the funded mainnet pilot
Persistent agents and multiple strategies / Future
General agent coordination, user-hosted runners and multi-venue hedging are future work — isolated budgets are already implemented by the automatic plan vaults
UTOW issuance remains a separate workstream and is not a prerequisite for any product milestone
Owner controls passed a funded mainnet run — pause and resume were included onchain, then cancellation returned all 2 USDG before either batch executed
View the mainnet refund receipt
Dark Pool / private limit orders
Mainnet pilot deployed — private order submission is enabled for configured pilot wallets when the matching service passes its live availability checks
Place a whole-order USDG and WETH limit order from your account
Buyers set a maximum USDG spend and sellers set a minimum USDG receipt
The exact WETH quantities must match and settlement uses the signed seller price
From signature to settlement
Review the amount and expiry, sign the order and approve the outgoing token if needed
Your encrypted order is stored privately and matching continues with the browser closed
Assets exchange directly between both wallets in one atomic transaction
Privacy with a clear boundary
No public order book is exposed and orders are encrypted before upload
The matching operator can decrypt orders
Matched order terms, wallet addresses and transfers become public onchain
Control and fees
Funds stay in your wallet until a match settles
Approval and onchain cancellation cost ETH gas
The matcher pays settlement gas and no protocol fee is charged
No matching order means no fill — execution is not guaranteed
Cancel through your wallet to invalidate the signed order onchain
A settlement already in flight may arrive before your cancellation
A missing approval or insufficient balance keeps an order from matching
Before signing a private order
Review checks read your token balance, settlement allowance, ETH balance, current open limits and the latest matcher heartbeat — unsigned review terms are encrypted to the matcher and are not saved as an order
Checks use a canonical block and expire after 30 seconds — signing triggers a fresh check and material changes require another review
Insufficient token funds, unavailable approval fee estimates, insufficient approval gas and an unavailable matching service prevent a new order signature
Existing orders share your wallet balance and token allowance — combined limits can exceed available funds because a review does not reserve tokens
Approval fee estimates include a buffer — the wallet shows the final network fee before confirmation
Understanding waiting and service interruptions
A recent ready heartbeat means the service completed a cycle — it does not prove a counterparty exists or guarantee a fill
The order center distinguishes waiting for a compatible order, tracking an earlier settlement, fee-limit pauses, recovery and stale service checks
Service status refreshes every 20 seconds while the page is visible — a completed heartbeat older than three minutes is treated as delayed
During interruptions, saved orders remain active until expiry or confirmed onchain cancellation — keep pending transaction receipts and avoid duplicate orders
Wallet order center
Sign in to see your private orders, receipt amounts and order notifications across this wallet — no vault unlock is required
Open buy limits and sell quantities are not reserved balances or deposits
Filled totals are historical flows based on verified settlement receipts and must not be added to your wallet balances
When an order does not fill
A different wallet must submit the identical WETH quantity at a compatible price
Whole-order matching does not support partial fills or guarantee liquidity or timing
The order center checks your current token balance, allowance, expiry and nonce
Add the required token, review a bounded approval or cancel the order from its detail view
Several open orders can compete for the same funds and allowance
Cancellation requires an onchain wallet transaction and ETH gas
A settlement already submitted may arrive first
Expired and cancelled orders do not trigger refunds because the protocol never deposited the order principal
Release evidence and next work
These records describe completed pilot transactions — they are historical receipts rather than live balances or a performance guarantee
Automatic execution
The immutable factory is deployed at the Undertow factory on Robinhood Chain
A funded plan executed two 1 USDG batches — the second broadcast required operator assistance during the pilot — this is not evidence of uninterrupted unattended reliability
First automatic batch receipt / Second automatic batch receipt
Dark pool settlement
The deployed settlement contract exchanged 0٫0001 WETH for 0٫25 USDG between two pilot wallets — both token transfers were matched to the settlement receipt
Settlement contract and verified source / First matched trade receipt
Not part of this release
Automatic execution and dark pool access remain restricted — neither contract system has received an independent security audit
Dark pool matching currently requires identical WETH quantities and compatible prices — partial fills and guaranteed liquidity are not supported
UTOW has not been issued and is not needed to use the workspace — there is no token sale, staking flow or insurance fund in this release
Next work focuses on independent security review, broader pilot readiness and reliable liquidity access — no launch date is promised