How Lark pays

Lark pays people in dollars (USDG) — or in a stock they choose — from the tokenized stocks in your wallet on Robinhood Chain. It is a web page that builds one transaction for your wallet to sign. It deploys no contract, holds nothing, and charges no fee: the only contract you call is Uniswap's SwapRouter02, which was already on the chain.

Every number on the page comes from one module, js/pay.js, and the tests run that same file against the live chain. What is tested is what is signed.

The transaction

A payment is one call to SwapRouter02.multicall(deadline, steps). The steps, in order:

1. selfPermit(token, value, deadline, v, r, s) — one for each token you pay from. Robinhood's stock tokens and USDG accept EIP-2612 permits (their domain is name, version 1, chain 4663; Lark checks it against each token's own DOMAIN_SEPARATOR before asking you to sign). The permit lets the router take at most value, and expires with the transaction.
2. For each person, in turn:
   • pull(USDG, x) for the part paid from your own dollars;
   • exactOutputSingle(stock → USDG) for each stock slice: sell exactly enough to raise y dollars, spending at most its quote plus 0.5%;
   • sweepToken(USDG, amount, them) to hand over exactly their amount — or exactInputSingle(USDG → stock) with amountIn = 0 (the router's own balance), to buy the stock they asked for straight into their wallet, with a minimum of its quote less 0.5%.

Each person's dollars are gathered and handed over before the next person's are, so the router holds nothing between people and nothing afterwards. A single sale paying one person in dollars is sent straight to them. A single person paid in dollars from dollars is a plain USDG.transfer, with no router and no signature.

If any sale would cost more than its limit, any purchase would return less than its minimum, a permit is short, or fifteen minutes have passed, the router reverts and nothing moves.

Where the money comes from

With use my dollars first on, the USDG in your wallet pays first. The rest is split across the stocks you tick in proportion to what each is worth at its pool's price, so paying someone leaves the mix of your portfolio as it was. The arithmetic is in integers: the pieces add up to the amount owed to the unit (a millionth of a dollar), and a rounding remainder goes to the largest holding.

At most 97% of any holding's value is sold, which leaves room for the price to move between the quote and the transaction. A slice under $1 is not worth its gas: it is dropped and the others re-spread. If what you hold cannot cover the payment, the page says by exactly how much.

A stock that pays several people is sold in several slices, one after another. Each slice is quoted as the difference between two cumulative quotes, so the second slice pays the price the first one left behind. The fee tier (0.05%, 0.3% or 1%) is chosen once per stock, as the cheapest for the whole amount.

Limits and guards

• Slippage. Each sale may spend at most its quote plus 0.5%; each purchase must return at least its quote less 0.5%. The permits cover exactly those limits, so after a payment the router is left approved for at most the unused 0.5%.
• Robinhood's price. Robinhood publishes a price feed for 26 of the 42 stocks. Every sale and purchase is priced against it before you sign. More than 3% worse than a fresh feed is refused, naming the stock. When the market is shut the feed stops, and after 20 hours a difference only warns.
• Deadline. The transaction and every permit expire fifteen minutes after they are built, measured by the chain's own clock.
• Size. Up to 8 people and 28 steps in one transaction (a Robinhood Chain block holds 32M gas; a swap takes up to ~250k).
• Who you can pay. The page refuses a token or a Uniswap contract as a recipient: money sent there is lost.

Requests and receipts

A request is a link: /pay?to=0x…&usd=42.50&get=NVDA&note=Dinner. It holds the address, the amount (dollars and cents), what to be paid in and a note of up to 80 characters. Nothing is stored anywhere; whoever has the link can read those four things. Opening it fixes the address and the amount; the payer chooses what to pay from.

A receipt is /receipt?tx=0x…. It fetches the transaction and its logs from Robinhood Chain and shows who received what — read from the Transfer logs to the recipients the calldata names — and what left the payer's wallet.

How it is tested

The property suite (tools/test.mjs) runs the page's own js/pay.js against live Robinhood Chain state with eth_simulateV1: test wallets are funded by state override and hold real keys, so every permit is a real signature the token verifies on chain. Nothing is broadcast. Expected values are computed in the test, from balances, pool prices and Transfer logs — never by asking the module under test.

The last run: 13/13 properties and 65,729 checks passed against live state at block 75,855,589 (29 Sep 2026).

Then a sabotage sweep plants 18 bugs, one at a time, in a copy of js/pay.js — a sale that may spend without limit, a permit for the wrong amount, pieces that do not add up, a price read upside down — and requires the property named for each one to fail. 18/18 were caught.

The browser run: 7/7 journeys (31 checks) clicked through the real pages in Chrome with a test wallet, against a private copy of the live chain (29 Sep 2026).

Addresses

Every contract Lark talks to was already on Robinhood Chain (chain id 4663), written and audited by its own authors.

Stocks

Every Robinhood stock token Lark can pay from or pay in, deepest pool first: each has a USDG pool on Uniswap v3. From a scan at block 75,808,765, 29 Sep 2026. Prices are the deepest pool's; the page re-reads them live.

Risks

• Paying from a stock is selling it. The price can be worse than you expect in a thin pool; the review shows the cost of selling before you sign.
• A payment to the wrong address cannot be undone. Check it; the page shows an avatar drawn from the address to make a typo easier to spot.
• Robinhood can pause a stock token, and a paused token cannot be sold. The transaction would then revert and nothing would move.
• Lark is not audited. It deploys nothing, but the page that builds your transaction is new code. Read how it is tested.