1 Introduction

Tokenized equities have moved from proof-of-concept wrappers to production instruments. Several issuance models now coexist: tracker certificates issued by Jersey SPVs, omnibus-pool notes, platform-internal derivatives, and, in a smaller number of cases, instruments that attempt closer legal proximity to the underlying share. The dominant institutional pattern in 2026 remains the debt-claim model: an offshore special-purpose vehicle purchases and custodians the shares and issues tokens that represent a contractual claim on that vehicle.

RHJ Stock Tokens belong to that family. They are debt securities. They are collateralized by the shares. They are not the shares. Dividends are not paid in cash to token holders; they are reinvested and expressed as an increasing multiplier on the token. Prices are published on-chain via Chainlink. Primary issuance is restricted to authorized participants. Secondary trading and composition occur on-chain.

rNOTE does not attempt to change that legal object. It adds a second domain of claims on top of it. A vault contract on an Ethereum rollup accepts Stock Tokens (initially a single-name or small basket, with NVDA used as the running example). Against that vault it issues two perpetual share classes:

• rNOTE — the senior claim. It absorbs losses last and is intended to track a high fraction of the collateral NAV after fees and haircuts.
• LNT — the junior / first-loss claim. It absorbs mark-to-market declines, multiplier shortfalls, and residual operational dust first.

The dual-domain construction is deliberate. Legal title, custody, and insolvency treatment remain off-chain and governed by Jersey and New York law and the security-agent arrangements. Economic allocation, pricing, minting, redemption, and composition occur on the rollup. The two domains are coupled only through attested custody balances, Chainlink prices, the published multiplier, and the bankruptcy waterfall that the legal documents already define.

This paper is a specification, not a marketing document. It states what the tokens are, what they are not, how NAV is computed, how claims rank, and which failures the system cannot prevent.

2 Motivation and Design Goals

Equity exposure that is both legally clean and on-chain-composable remains scarce. Direct share tokenization that confers beneficial ownership and voting rights faces transfer-agent, CSD, and securities-law constraints that have not been solved at retail scale on public rollups. Pure synthetic perps and CFD-style tokens introduce counterparty and basis risk that many allocators reject. The RHJ model occupies a middle position: real shares exist, a regulated issuer stands between the holder and those shares, and the token is an ERC-20 that wallets and contracts already understand.

That middle position creates a new problem. Once Stock Tokens exist, they become collateral that can be structured. Unstructured holding of a single Stock Token simply replicates the issuer's credit and operational risk at 1:1. Structured holding allows different risk appetites to coexist against the same pool:

• Capital that wants tight tracking and seniority can hold rNOTE.
• Capital that wants leveraged residual exposure can hold LNT.
• Protocols that need a senior claim as margin or as a building block can integrate rNOTE without taking first-loss equity risk.

Design goals that follow from this observation:

1. Preserve the legal characterization of Stock Tokens as debt claims on RHJ.
2. Never represent rNOTE as a claim on NVDA Inc. or any other corporate issuer.
3. Make the bankruptcy waterfall explicit and mechanically consistent with the on-chain NAV.
4. Compute NAV from observable inputs (Chainlink price, published multiplier, vault balances, pending exits) rather than from discretionary administrator marks.
5. Accept that the rollup sequencer, the allowlisted validator set, the seven-day exit, and the Security Council are residual trusted parties, and document their failure modes.
6. Keep the junior tranche thick enough, under normal parameterizations, that rNOTE can remain fully collateralized through plausible single-name drawdowns.

3 Legal Object and Claim Hierarchy

3.1 What a Stock Token Is

A Stock Token is a tokenized debt security issued by Robinhood Assets (Jersey) Limited (RHJ). Each unit is intended to be collateralized by one share (or the fractional equivalent after multiplier adjustments) of a referenced U.S. equity or ETF held with a licensed U.S. custodian. The token does not constitute:

• legal title to the share,
• beneficial ownership of the share,
• a direct claim against the corporate issuer (NVDA Inc., etc.),
• voting rights, appraisal rights, or other shareholder remedies,
• a deposit or a custody receipt issued by the custodian to the token holder.

The holder's rights are contractual rights against RHJ, secured (to the extent the security package is perfected and enforceable) by the pool of shares and related assets. Dividend treatment is handled by the multiplier: cash dividends received by the custodian are reinvested in additional shares; the on-chain multiplier is increased so that one token continues to represent a claim on a larger economic quantity of the underlying.

3.2 What rNOTE Is

rNOTE is a claim on the vault's holdings of Stock Tokens (and any cash or residual assets the vault is permitted to hold). It is not a Stock Token. It is not a share of NVDA. It is not a direct claim on RHJ. In an enforcement or insolvency scenario the rNOTE holder looks first to the vault, then through the vault to the Stock Tokens, then through the Stock Tokens to RHJ, and only then, via the security agent, to the sale of the underlying shares.

This stacking is intentional. It keeps the on-chain instrument from accidentally becoming an unregistered security that purports to be the equity itself, and it keeps the rollup contracts from having to interpret Jersey insolvency law.

3.3 Explicit Bankruptcy Waterfall

The legal documents and the on-chain accounting are required to implement the same priority:

In narrative form:

1. Upon an enforcement event (RHJ default, specified insolvency proceedings, or security-agreement trigger), the security agent takes control of the custodied shares.
2. The agent sells the shares in the cash market (or otherwise realizes them according to the security documents).
3. Sale proceeds, after costs of enforcement, are applied to satisfy claims of Stock Token holders according to the RHJ issuance documents. Because Stock Tokens are the debt claims on RHJ, this is the first monetary recovery that token holders receive.
4. Recoveries that are attributable to Stock Tokens held by the vault are paid into the vault (or to a successor account controlled for the benefit of vault claimants).
5. Vault assets are applied first to rNOTE according to the then-prevailing senior NAV and outstanding rNOTE supply.
6. Any remainder is applied to LNT.
7. Anything left after LNT is residual dust (unallocated fractions, dust from rounding, unclaimed fees, or assets that cannot be economically distributed). Dust is not a third tranche with rights; it is the accounting remainder.

The on-chain NAV function is constructed so that, in the absence of oracle failure or multiplier error, the marked values of rNOTE and LNT sum (approximately) to the marked value of the vault's Stock Tokens. In a true enforcement the marks are replaced by actual sale proceeds; the ordering of claimants does not change.

3.4 Consequences of the Hierarchy

• A collapse in NVDA's share price reduces the value of the collateral that ultimately stands behind both Stock Tokens and rNOTE. It does not by itself change the legal identity of the claim.
• An RHJ insolvency is a claim-on-RHJ event, not a claim-on-NVDA event. Recovery depends on the security package, the quality of custody, and the speed and honesty of the security agent.
• A custodian failure is a realization-risk event. If shares cannot be produced or sold cleanly, the waterfall still applies to whatever is recovered.
• rNOTE holders cannot jump the queue and assert a direct right against NVDA Inc. or against the custodian. Any attempt to market rNOTE as “tokenized NVDA” or “on-chain NVDA shares” is inconsistent with the legal object.

4 Dual-Domain Architecture

Domain A — Legal / Custodial. RHJ issues Stock Tokens. The custodian holds shares. The security agent holds (or can obtain) enforcement rights. Multipliers are published when dividends are reinvested. Authorized participants mint and redeem Stock Tokens in the primary market subject to KYB and cut-off times. This domain does not run at block speed.

Domain B — Rollup Execution. An Ethereum rollup (optimistic, BoLD-enabled, validator set allowlisted) hosts:

• the Stock Token contracts (bridged or natively issued as ERC-20s),
• the vault,
• rNOTE and LNT share-class contracts,
• the NAV module,
• the exit queue,
• Chainlink aggregators for the referenced equity prices,
• a multiplier oracle or attested publisher for the RHJ multiplier.

The two domains communicate through a narrow interface: custody attestations or reserve proofs, the Chainlink price, the official multiplier, and, in stress, instructions from the security agent or an appointed administrator. The rollup does not “own” the shares. It owns Stock Tokens that represent claims on the party that has arranged for the shares to be held.

“Dual-domain tranching” means that risk allocation (senior versus junior) is performed in Domain B while the collateral that makes the allocation meaningful remains a Domain A instrument. The tranche tokens never become the legal shares; they become prioritized claims on the Domain A instruments that the vault holds.

5 Vault, Tranches, and Parameterization

The vault is a single-asset or tightly constrained multi-asset container. In the base specification it holds one Stock Token series (e.g., the NVDA Stock Token). Extensions to a basket are possible but increase oracle and correlation risk and are left to a later parameterization.

Let:

• S = quantity of Stock Tokens held by the vault
• m = official multiplier (shares-equivalent per Stock Token)
• P = Chainlink price of the referenced equity
• H = protocol haircut (a number in [0, 1)) applied for NAV conservatism
• Q_r = outstanding rNOTE supply
• Q_j = outstanding LNT supply
• E = value of assets already in the exit queue (marked, not yet paid)

A simplified collateral value used for day-to-day NAV is:

where E_adj is the portion of pending exits already reserved at the senior or blended mark, depending on implementation.

Senior and junior NAVs are not independent marks. They are a partition of V subject to a target senior coverage ratio κ (for example 1.05 to 1.25 depending on volatility of the name) and a minimum junior thickness.

In normal operation:

• rNOTE is intended to trade and redeem near a target of 1.00 in the vault's unit of account after fees, provided junior capital is sufficient.
• LNT NAV is the residual: V − NAV_r · Q_r, divided by Q_j.

When V falls, LNT NAV falls first. Only after LNT is written to a floor (zero, or a small dust floor) does rNOTE NAV decline. That is the on-chain reflection of the legal waterfall's “rNOTE before LNT” ordering, applied to mark-to-market rather than to enforcement proceeds.

Minting and redemption are asymmetric. New rNOTE can be minted only when post-mint senior coverage would remain above κ. LNT can be minted more freely because it is first-loss. Redemptions of rNOTE enter the seven-day exit queue; LNT redemptions may be processed faster when surplus junior capital exists, or may also be queued when the vault is stressed. Exact queue rules are parameters, not invariants of the legal waterfall.

6 NAV Function

The NAV function is the only pricing primitive the vault is allowed to use for share-class accounting. It must be deterministic given a set of on-chain inputs and a small number of attested off-chain inputs.

6.1 Inputs

6.2 Validity Gates

Before a NAV update is accepted:

• τ must satisfy now − τ ≤ θ. Otherwise the function returns the last valid NAV and sets a stale-oracle flag that can freeze mints and, depending on parameterization, freeze senior redemptions or switch to a more conservative haircut.
• m must be monotonically non-decreasing except for documented corporate actions (splits, etc.) that are handled by a separate migration path.
• S must match the token balance of the vault; a mismatch freezes the function.

6.3 Core Computation

Define raw collateral mark:

Define conservative vault value:

Define maximum senior value that respects coverage:

(If κ = 1, this collapses to V. Values of κ > 1 leave a junior buffer even when LNT NAV is still positive.)

Then:

(The “1” is a unit-of-account convention; implementations may use a different numeraire.)

If V < V_r after a severe move, NAV_r is reduced below 1 and NAV_j = 0. That is the mark-to-market analogue of junior exhaustion.

6.4 Multiplier Interaction

Because dividends increase m rather than distributing cash, an increase in m increases C and therefore V without a corresponding increase in token supply. Both NAVs rise, with the senior class capped by the coverage rule and the convention that NAV_r does not systematically trade above 1 in the base parameterization (excess is absorbed by junior or by a fee sweep). An incorrect UI multiplier — displaying m′ ≠ m — does not change the on-chain function, but it will cause users and integrators to mis-estimate economic exposure. The threat model treats that as a distinct operational risk.

6.5 Path Dependence and Fees

Fees are accrued in the same unit as V and subtracted before the split. Performance or management fees that are junior-first versus pro-rata are a parameterization choice; the specification only requires that they not invert the waterfall. Path dependence appears when exits are reserved at a prior NAV: a subsequent drop can leave the remaining pool thinner than a naïve mark would suggest. The R term exists to prevent that leak from being ignored.

6.6 Worked Sketch

Suppose S = 10,000, m = 1.04, P = 120, H = 0.02, f = 0, R = 0, Q_r = 1,000,000, Q_j = 200,000, κ = 1.10. Then C = 1,248,000, V = 1,223,040, V_r^max ≈ 1,111,855, NAV_r = 1 (capped), V_r = 1,000,000, V_j = 223,040, NAV_j ≈ 1.115. A 20% drop in P with no change in supplies writes LNT down sharply and, if the drop is large enough relative to junior thickness and κ, begins to impair rNOTE. That is the intended behavior.

The full formalization, including rounding rules, decimal scales, and freeze semantics, belongs in the implementation repository and in appendix-level specification. The function above is the economic core.

7 Threat Model

The threat model is not a claim of security. It is a list of failures the designers already know are possible.

7.1 Sequencer Reordering, Including FCFS Limitations

The rollup sequencer can reorder, delay, or drop transactions even under a first-come-first-served policy. FCFS limits some forms of priority-gas auctions; it does not bind the sequencer to inclusion, nor does it prevent the sequencer from stalling a redemption transaction while including a mint or a liquidating trade that moves vault composition. An honest-but-overloaded sequencer produces the same user-visible result as a malicious one: a transaction that should have entered the exit queue at time t enters at t + Δ or never enters.

Consequences for rNOTE: NAV can be computed on a state that a user reasonably believed they had already left; sandwiching around a large Stock Token transfer into or out of the vault can change junior thickness; emergency parameter changes can be front-run if they are themselves sequenced.

Mitigations are partial: application-level commit-reveal or delay for large vault movements, public mempool monitoring, and the seven-day exit as a backstop rather than as a substitute for fair ordering. They do not eliminate sequencer discretion.

7.2 Allowlisted BoLD Validators

BoLD provides bounded-time dispute resolution and, in its permissionless configuration, allows any bonded party to challenge. This deployment keeps validators allowlisted. The allowlist is a trusted set. If the set colludes, goes offline, or is captured, invalid state roots can be proposed and, in the limit, confirmed. Permissioned BoLD still shortens certain delay-attack windows relative to older challenge protocols; it does not convert the validator set into an untrusted public.

A dishonest allowlist can freeze or rewrite vault accounting, suppress a legitimate challenge, or delay the posting of a correct assertion long enough to interact badly with the seven-day exit and with off-chain enforcement clocks.

7.3 RHJ Insolvency

rNOTE's collateral is a claim on RHJ. If RHJ is insolvent, holders of Stock Tokens become creditors in a Jersey (and possibly cross-border) proceeding. The security agent's ability to sell shares quickly, free of competing claims, is the practical recovery mechanism. Insolvency of the issuer is not insolvency of NVDA; it is a distinct credit and legal event. On-chain NAV will continue to print numbers derived from P and m until someone stops the function or the tokens are frozen. Those numbers may cease to be realizable.

7.4 Custodian Failure

Shares are held by a licensed U.S. custodian. Operational failure, legal attachment, reconciliation breaks, or fraud at the custodian can mean that the security agent cannot produce the inventory the issuance documents describe. Reserve attestations can lag. A “1:1” representation is a claim about a process, not a cryptographic guarantee that a specific share certificate is locked to a specific token id.

7.5 Stale or Deviating Chainlink Prices

NAV is a function of P. If the feed is stale beyond θ, the validity gate should reject updates. If the feed is timely but wrong — deviation from the cash market, manipulation at the source venues, or aggregator failure — the vault will mint, redeem, and report NAVs against a false mark. Dual-domain design does not help here: Domain A's shares trade at the cash price; Domain B's tranches trade at the oracle price. Basis between them is an economic leak that junior capital is supposed to absorb until it cannot.

7.6 Incorrect UI Multiplier

The official multiplier m is an RHJ publication. Front-ends, integrators, and even some contracts may display or cache a different figure. Users then believe they have more or less share-equivalent exposure than the vault's NAV function is using. This is not an oracle-price problem; it is a disclosure and interface problem. It can induce mistaken leverage, mistaken hedging, and mistaken redemption sizing. The protocol can publish m on-chain; it cannot force every wallet and dashboard to read that value.

7.7 Seven-Day Exit Delay

Withdrawals from the rollup to the parent chain, and in this design many senior redemptions from the vault, are subject to a delay on the order of seven days (challenge period plus operational buffer). During that window:

• P can move,
• RHJ or the custodian can enter distress,
• the Security Council can upgrade contracts,
• the sequencer can fail to include the message that starts the clock.

The delay is a security feature against invalid withdrawals. It is also a liquidity and gap-risk feature. rNOTE is not a same-block cash instrument.

7.8 Security Council Upgrade Risk

A Security Council (or equivalent upgrade executor) can change rollup parameters, pause contracts, replace the NAV module, change the allowlist, or migrate the vault. That authority exists because unfixable bugs and regulatory orders are worse than a trusted upgrade path — until the council itself is the failure. An upgrade can be the correct response to a threat listed above; it can also be the threat. Users of rNOTE accept council risk as a condition of using an upgradable rollup deployment.

8 Mitigations That Do Not Remove the Threats

Haircuts, coverage ratio κ, junior thickness targets, stale-price freezes, attested reserves, allowlisting, and the Security Council are controls. They change probabilities and loss-given-default; they do not convert rNOTE into a risk-free claim on NVDA shares. Any integration that treats rNOTE as cash, as a share, or as a bankruptcy-remote pass-through of the equity issuer is misusing the instrument.

9 Governance and Parameter Changes

Mutable parameters (H, κ, θ, fee rates, queue duration inside the rollup's constraints) should move slowly and with notice. Changes that alter claim priority are not “parameters”; they are changes to the product and should be treated as requiring the same gravity as a legal-document amendment. The Security Council's emergency powers sit outside that cadence by design.

10 Conclusion

rNOTE is a structured claim on a structured claim. The inner claim is a debt instrument issued by RHJ and collateralized by real shares. The outer claim is a senior tranche of a rollup vault that holds those instruments. Dual-domain tranching exists so that legal reality and on-chain composition can occupy the same product without pretending to be the same thing.

The NAV function is the daily language of that product. The bankruptcy waterfall is its last language. The threat model is the list of reasons both languages can fail at once. Builders who integrate rNOTE should read all three. Holders who want NVDA itself should buy NVDA, not a note on a note on a Jersey debt security that happens to move with NVDA's price.

A Notation Recap

B Waterfall Restated

Stock Tokens are debt claims on RHJ, collateralized by underlying shares; they are not the shares themselves. rNOTE holders have claims on the Stock Tokens, not directly on the underlying issuer such as NVDA Inc.