On one weekend in August, the same company's stock had two prices on-chain — one 4.6× the other. Both were tokenized HIMS. Only one of them tracked the equity. The difference was not the asset. It was the design.
On Sunday 30 August 2026, a tokenized share of Hims & Hers traded at $132.64 on Robinhood Chain. The company's actual shares had closed on Friday at $28.84 and would not trade again until Monday. A memecoin held 53% of the token's float. Roughly $206,000 of volume was enough to do it.
Through the very same weekend, Ondo's competing wrapper for the very same stock traded at $29.44 and tracked the equity the entire way.
That is the whole argument in one comparison. This is not a story about tokenization being unsound, or about crypto being crypto. Two products referenced one company through one closed market, and one of them held while the other went to 4.6×. What separated them was architecture — how supply is created, who can create it, how much liquidity stands behind the float, and whether anyone is watching.
Nobody is watching. That is the gap this piece documents, using only primary sources: contract state read directly from the chain, and Robinhood's own prospectus, Final Terms, and disclosure API.
Robinhood runs two different tokenized-stock products, and they are not the same instrument. The one on Robinhood Chain is issued by Robinhood Assets (Jersey) Limited under a Base Prospectus dated 25 June 2026, approved by the Financial Market Authority of Liechtenstein and passported into 29 EEA states. The instruments are tracker certificates — type 1300 of the Swiss Derivatives Map — as ledger-based securities under Article 973d of the Swiss Code of Obligations.
They are, in the prospectus's own words, "secured, limited recourse obligations of the Issuer." And:
The Issuer itself is not regulated by the FMA.Base Prospectus, 25 June 2026. Jersey COBO consent, it adds, "does not give an issuer 'regulated' status."
The older EU-app product is blunter still. Its PRIIPs Key Information Document describes a "US-listed Share / ETP Derivative" in which "you enter into a financial derivative contract with Robinhood Europe." Holding it "does not mean you own any shares" and "does not allow you to redeem it for shares." Risk class 7 of 7. And a line that deserves more attention than it gets: "The product is not covered by an investor compensation or deposit insurance scheme."
The prospectus commits to an attestation published "within three (3) months of Issuer's financial year end." That is once a year. There is no proof-of-reserve feed, no continuous attestation, no Big Four auditor, and — as of this writing — no attestation has been published.
Two further conditions qualify the backing. The Final Terms permit the underlying shares to be lent to a Prime Borrower, at which point the products "will, to a greater extent, not be backed or secured by the relevant Underlying themselves" and the lent shares "shall be released from the Security." Robinhood itself flags resulting under-collateralisation "particularly over weekends." No Prime Borrower has been appointed — the mechanism is authorised, not activated.
Meanwhile the retail-facing FAQ says: "Every single Stock Token in circulation is backed 1:1."
Settlement is cash only — "Investors are not entitled to physical delivery of the Underlying." The primary market is restricted to a single Authorised Participant, Bitstamp Global Ltd, which Robinhood owns. Retail holders can redeem directly with the Issuer only under Condition 9.6(D): if every Authorised Participant becomes insolvent or resigns and no replacement is appointed within 30 days, or if the Issuer voluntarily publishes a notice enabling it. The retail FAQ omits this condition entirely. The Issuer may also force-redeem any series that "is no longer consistent with the Issuer's commercial objectives."
None of this is unusual for a structured product, and none of it is hidden — it is in a prospectus that was approved and passported properly. The problem is the distance between that document and the one-line claim a retail holder reads, and the fact that no continuous, independent check exists to close it.
Read the contracts and the picture sharpens. Every Robinhood stock token on chain 4663 is a beacon proxy of roughly 250 bytes. The beacon address sits in the standard EIP-1967 beacon slot and is compiled into the bytecode as an immutable. Each token calls implementation() on that beacon and delegates every call to whatever comes back. Nothing here is hidden or unusual — it is a conventional beacon proxy, and any standards-aware tool finds it in one read. The point is not that it is obscure. The point is what it can do.
All of them point at the same beacon.
| Address | Role | Type | Nonce | Timelock |
|---|---|---|---|---|
| 0xe10b6f6B…62151b00 | Shared beacon / AccessControlsRegistry | Contract | — | None |
| 0xb35490d6…eb64c5ae2 | Implementation (all tokens) | Contract | — | — |
| 0x074377a7…b4f491279 | Root DEFAULT_ADMIN_ROLE | EOA | 20 | None |
| 0xd6f8378f…dfd55b66d | Granted DEFAULT_ADMIN_ROLE | EOA | 2 | None |
| 0x2b94105f…8fc5c3a87 | MINTER_ROLE | EOA | 64,723 | None |
A single transaction from one role holder rewrites the code of every Robinhood stock token simultaneously. The Upgraded event has fired twice — at block 7,796 and again at block 657,134 — so this is an exercised power, not a dormant one. The beacon has emitted 274 events in total, of which 16 are RoleGranted and 3 are RoleRevoked.
All three privileged addresses are externally owned accounts. Not multisigs. Not timelocks. The minter is a hot operational wallet with more than sixty-four thousand transactions.
Mint, burn and pause are normal for a regulated tokenized security — you need them for creations, redemptions and corporate actions. And these keys are plausibly fronted by institutional MPC or HSM custody, which is standard practice at a firm this size.
The criticism is the absence of a timelock. There is no notice period and no window in which a holder could see an upgrade coming and exit before it lands. For a regulated security, that is the distance between "custody is probably fine" and "adoption-grade."
There is no on-chain proof of reserve. Nothing binds outstanding token supply to custodied shares. Supply is discretionary and unverifiable, and the tokens themselves carry no transfer restriction — no allowlist, no on-chain KYC, only an administrative blocklist. So a permissioned, discretionary-supply instrument trades freely in permissionless automated market makers. That combination is the entire manipulation surface.
The pools are thin to a degree that is difficult to convey without the numbers. Across the three tokens examined, roughly 5% of outstanding supply has any on-chain market at all. One of them has none.
Liquidity is also fragmented across fee tiers. NVDA has four pools; two are empty or dust. At the time of reading, the two live tiers quoted prices 0.13% apart — a small number that is nonetheless a live, measurable divergence within a single asset on a single chain.
From that, the cost of moving the price follows arithmetically.
For scale: Uniswap's own published figure for moving USDC/WETH 20% is on the order of $709 billion across two consecutive blocks. Here, low six figures moves a tokenized megacap 5%.
But the number that matters is the one beside it. Every one of these pools has its liquidity posted inside a band of ±4.5% to ±12.7%. Within that band the price is genuinely defended. One step outside it, the defence is gone — there is no liquidity above the highest initialized tick, so the remaining distance is close to free.
TSLA's band is narrower than the move being costed. Its posted liquidity is exhausted at ±4.5%, so the figure above is not what it takes to move the price 5% — it is what it takes to consume the entire defended range, after which nothing is posted at the current tick and the rest is unpriced. Roughly $189,000 does not move tokenized Tesla five percent. It removes the floor.
That is the structural trap, and it is now measured rather than asserted. Work on the cost of manipulating AMM-based oracles shows that liquidity providers on a mean-reverting, oracle-anchored asset are rationally incentivised to concentrate tightly around the reference price — that is where the fees are. These LPs have done exactly that. Tight concentration is what makes the cliff edge so close. The rational LP posture and the safe LP posture are opposites, and no individual LP is paid to fix it.
An earlier version of this piece put these figures roughly 26–54× too low — at $7,427 for a 5% move in TSLA rather than $191,169 — and described them as upper bounds. They were computed from the pools' token balances. That is the wrong quantity: in Uniswap v3 the depth resisting a trade is the virtual reserve implied by active liquidity, not the tokens sitting in the contract. The figures above are recomputed from liquidity() and each pool's implied range.
The error ran in the dangerous direction — it made manipulation look cheaper than it is. The correction does not soften the argument: the liquidity bands are narrow enough that a move of 6% or more leaves the defended range entirely, which is the point the original numbers were reaching for by accident rather than by measurement.
Robinhood publishes a price-deviation feed. It is a real, public endpoint, and it is the mechanism by which a holder is supposed to learn that a token has come unmoored from its underlying.
$ curl https://api.robinhood.com/rhj/price-deviations
{"rows":[]}Empty. It was empty through the 610% AMC dislocation, through the HIMS weekend, and through Labor Day. The reason is in the threshold: disclosure requires a deviation of 5% or more, sustained for seven consecutive business days, on a trailing average.
Every documented dislocation to date has occurred overnight or across a weekend and resolved within hours. The disclosure mechanism is not failing. It is working exactly as specified, and the specification is structurally blind to the only events that have actually happened.
| Date | Instrument | Peak | Reference | Mechanism |
|---|---|---|---|---|
| 3–4 Sep | AMC | $18.04 | $2.54 | Opened the 11pm ET hour at the exact NYSE close, printed 610% within the hour on $10.2M volume. No halt. Float expanded 157,844 → 1,499,255 tokens in 18 hours — the AP minted 9.5× with the window open and could not stop it. |
| 30 Aug | HIMS | $132.64 | $28.84 | Sunday. Memecoin held 53% of float on ~$206k volume. Window closed, so float could not expand. Ondo's wrapper held $29.44 throughout. |
| 2 Sep | FAMI | +45% | Nasdaq | A counterfeit token with no issuer. 37.43M supply minted in one transaction by a wallet retaining 38%, running a contract named PoolRepricer. $131.4M volume across 126,565 transactions. |
| 29 Aug–2 Sep | Labor Day | $1.41B | 89.5 hrs | Volume across the closure exceeded Friday's $1.02B open-market session. NVDA tokens held $229–233 against a $230.36 close; NVDA reopened and closed $225.96. |
None of this is new. It is a very old problem wearing new infrastructure.
In 2003, Eric Zitzewitz documented what happened when US mutual funds struck their 4pm net asset value off Tokyo and London closes that were six to fifteen hours stale. Arbitrageurs who traded against those known-stale prices earned between 35% and 70% per year. Dilution of long-term holders rose from 56 to 114 basis points annually. The mechanism was simple: the fund was, in effect, a push oracle with a once-daily heartbeat that would mint or redeem at that stale price on demand.
The industry's answer was forward pricing — Rule 22c-1, adopted in 1968. You do not get to trade at a price that already exists. Orders are filled at the next computed value, not the last published one.
A tokenized equity that trades continuously against a reference price frozen at Friday's close does the opposite. It is not a novel crypto failure mode. It is the pre-1968 mutual fund, rebuilt, with the stale window widened from fifteen hours to eighty-nine and the arbitrageur's capital requirement reduced to five figures.
Chainlink's Tokenized Asset schema carries price and tokenizedPrice as two separate fields, and its documentation states plainly that price does not update on weekends while tokenizedPrice keeps moving with on-chain trading. The divergence is not treated as an anomaly. It is a documented, structural property of the data model — and nobody surfaces, indexes, or alerts on the difference between the two fields.
There is a second trap for anyone integrating these feeds, and it resolves in the wrong direction. A correct staleness guard — reject a price older than an hour — bricks every tokenized-equity integration every weekend, because those feeds publish no updates at all, not even heartbeats, while the market is closed. So integrators widen the tolerance to seventy-two hours or more, which is precisely the stale window an arbitrageur wants. Safety and liveness are in direct conflict here, and liveness wins, because a bricked product is visible and a stale price is not.
Purser Report keeps an independent record of the tokenized equities on Robinhood Chain. It exists because every fact in this article was available to anyone with an RPC endpoint and a prospectus, and none of it was being collected, dated, or published.
A genuine Robinhood stock token is a beacon proxy whose bytecode contains the shared beacon address. A counterfeit is not. This is a cryptographic test, it costs nothing to run, and it would have flagged the Farmmi token before the first of its 126,565 transactions. Every token we cover carries a verdict: issuer token, counterfeit, or unaffiliated token using a ticker.
Because there is no timelock, an upgrade lands with no notice — but the transaction is visible the instant it is mined. We monitor beacon upgrades, role grants and revocations, pause state, supply changes, corporate-action multiplier changes, and every nonce increment on the three privileged accounts. An admin address that moves is an alert before it is an incident.
Real-market reference against on-chain price, per token, continuously — including through the closed sessions when the reference is frozen and the token is not. Cross-fee-tier divergence. Depth, coverage ratio, and a standing cost-to-manipulate figure for every pool we cover.
An argument that another party's records are unverifiable collapses if our own are. The design commits a Merkle root of every observation to a registry contract on chain 4663 on a fixed cadence, so any figure we publish can be checked against an on-chain root by anyone, without asking us.
That registry does not exist at time of writing. Until it does, our own record is exactly as unverifiable as the thing this piece criticises, and you should weigh what we publish accordingly. It is the next thing being built, and saying so here rather than letting the paragraph above read as a description of something already running is the minimum this argument requires of us.
We do not custody assets, take positions, or issue a competing product. We are funded by trading fees on our own token, and the treasury address and operating ledger are published on the same dashboard as everything else — because a monitor whose funding is opaque has no business auditing anyone.