How Pluck works

Pluck pays anyone an exact number of dollars out of the tokenized stocks you hold on Robinhood Chain, in one transaction from your own wallet. This page is the whole of it.

What Pluck does

You type who gets paid and how much, and tick the stocks you are willing to sell. Pluck prices every pool those stocks trade in, decides how many shares of each to sell, and shows you the plan: every sale, its pool, its minimum, what each person receives, what you give up in fees and price impact, and the change you get back.

When you press Pay, your wallet signs one permit and sends one transaction. The recipients receive USDG — Global Dollar, issued by Paxos, the dollar Robinhood Chain's pools trade in.

Pluck deploys no contract and holds nothing. The page is static; the transaction goes from your wallet to Uniswap's Universal Router.

The transaction

One call to execute() on the Universal Router. In order:

1. PERMIT2_PERMIT_BATCH — your signed permit lets the router take exactly the shares being sold, of each stock, once. Left out when Permit2 already covers them.
2. PERMIT2_TRANSFER_FROM — only if you chose to spend USDG first: exactly that many dollars, into the router.
3. V3_SWAP_EXACT_IN or V4_SWAP, once per stock — each sells a fixed number of shares through one hookless pool, with a minimum, and keeps the dollars in the router.
4. TRANSFER, once per recipient — a fixed number of USDG. If the router holds a unit less, this reverts and so does everything before it.
5. SWEEP — everything the router still holds in USDG goes back to you.

Before your wallet is asked for anything, the page decodes its own transaction (assertPay in js/route.js) and refuses it unless: it contains only those commands, none allowed to fail; every sale is one you were shown, of exactly the shares shown, with the minimum shown, paying into the router; every transfer is USDG, to someone you typed, for exactly what you typed, once; the change goes back to you, last; and the minimums plus any cash add up to at least the payment. Then it simulates the transaction from your address, and only then asks your wallet.

Choosing what to sell

For every stock you ticked, Pluck quotes a tiny sale (for its price) and a sale at nine sizes around the payment — every pool, one read. From those it draws each stock's curve of shares sold against dollars received, and then:

• Cheapest (the default) cuts the payment into 40 slices and hands each to whichever stock gives up least for it next — fees and price impact together.
• Keep my mix sells the same fraction of every stock, so what is left keeps its shape.
• One stock sells only the stock you pick.

Then it quotes the exact amounts again on every pool, keeps the best pool for each, and — if the minimums would fall short of the payment — grows the sales that still have room and quotes again. It sells enough that even at your slippage setting (0.50% by default) worse than quoted, the payment is covered. Whatever the pools pay above the payment is your change.

We expected "a little from each" to be the cheap way. It isn't: at the sizes a person pays, one deep pool beats several thin ones, and on the showcase portfolio "keep my mix" cost 2.6× as much. So Pluck prices both, every time, and tells you the difference. The measurement is on the front page.

Approvals and signatures

The router takes tokens through Permit2, Uniswap's allowance contract. So the first time you sell a given stock, your wallet sends one approval: Permit2 may move that stock. That approval is for an unlimited amount — the usual Uniswap arrangement — because Permit2 itself only ever moves what you separately sign for.

Every payment then asks for one signature, a Permit2 batch permit naming each stock and the exact number of shares, for the Universal Router only, expiring in 30 minutes, usable once. The fork suite sends the same signed payment twice and requires the second to be refused, and sends one after its permit expired and requires that to be refused for the signature.

If you want to take Permit2's approval back later, set the stock's allowance for Permit2 (0x000000000022D473030F116dDEE9F6B43aC78BA3) to zero in any allowance tool.

What it costs

• The pools. Each sale pays its pool's fee and moves the price a little. Pluck shows both, together, before you sign. Selling $1,000 of the median listed stock costs 0.35%; the cheapest is 0.04%.
• The network. Measured on the real transaction, from a payer's own address on Robinhood Chain: $0.03 for a one-stock payment, $0.14 for eight stocks, $0.20 for twelve (253,043, 1,154,493 and 1,648,301 gas, permit included). The first payment from a stock adds one approval.
• Pluck. Nothing. There is no fee and no contract to collect one.

Limits, and why

• Up to 5 recipients and 12 stocks in one payment — a review screen you can actually read.
• Up to $25,000 in one payment. Above that the pools on this chain are thin enough that a quote can move between signing and landing.
• A stock is listed only if selling $1,000 of it costs within 3%, and no pool charging more than 5% is ever used — a pool is not a market above that, however happily it quotes.
• Only hookless pools. A hook is code Pluck has not read.

What was tested

• 31/31 from a payer's own address on the live chain (tools/live-pay.mjs, block 64,855,161): balances written into each token's own storage slot (found by probing, never assumed), a harness installed at the payer's address so the router sees the payer as the sender, and the payer's real EIP-712 signature checked by Permit2. The network-fee figures on this site come from here.
• 19/19 properties on Robinhood Chain itself (tools/props.mjs, block 64,837,845). 12 run a real payment inside an eth_call through a wallet the harness builds and fills with real shares; the rest are checks on the page's own transaction reader, with tampered payments that must be refused.
• 23/23 on a fork of this chain (tools/test-tx.mjs): payments signed and sent the way the page sends them, including the approvals, the batch permit, a re-used permit refused, and a price move past the floor that undoes everything.
• 2/2 fuzz seeds clean, 10/10 deliberate breaks caught (tools/fuzz.mjs). Its first replay found a flaw in the testing, not the product: the page's own reader refused five of the six deliberately broken transaction builders before any transaction existed, so the chain-side invariants were never exercised by them. The fuzz now switches the reader off for those breaks and makes the chain catch them; the reader has its own sabotage and controls.
• 16/16 sabotages of the builder caught (tools/sabotage.mjs), each by the property named for it; a builder that crashes before reaching the chain does not count as caught.
• 19/19 through the real app in a real browser (tools/e2e.mjs), against a fork, under the deployed Content-Security-Policy.

Every suite has a control that must fail: a planted tampered transaction the reader must refuse, a storage slot that must fund nothing, a permit signed by the wrong key, a colour pair that must not pass. None of this is an audit, and nobody has audited Pluck.

Addresses

Every address below was read back from Robinhood Chain (id 4663) and asked to prove what it is before it was written into js/config.js.

What it does not do

• It does not pay in anything but USDG, and it does not pay to another chain.
• It does not schedule or repeat payments. Each one is signed by you, now.
• It does not know your tax position. Selling shares may be a taxable event where you live.
• It keeps no record of your payments anywhere but the chain.

Not investment advice. Not audited. Credits.