How ZecStocks works
ZecStocks turns one shielded Zcash payment into a stock token on Robinhood Chain, delivered to an address you name. It is two rails that already exist, NEAR Intents and the chain's public pools, joined by one small contract that anyone can read and anyone can call.
What it is
You pick a stock, say how much ZEC you are sending and where the shares should go. You get a one-time Zcash deposit address. You pay it from a shielded wallet. About eight minutes later the shares are at your address on Robinhood Chain.
You never connect a wallet, the recipient address never needs gas, and nothing on Robinhood Chain links it to you, because nothing of yours ever touched that chain before the shares arrived.
The rail
1 · Zcash to NEAR Intents
The deposit address is issued by NEAR Intents through its 1Click API. It is a transparent address, used once. Paying it from a shielded wallet is a plain deshield: the amount is visible, the sender is not. Solvers then swap the ZEC for USDG.
2 · NEAR Intents to your pass
NEAR Intents pays the USDG out on Robinhood Chain directly. The destination is not ZecStocks and not your address. It is your pass, an address that belongs to your order alone.
3 · Your pass to the pool
Anyone can now call fulfil(order, pool) on the hub. The hub collects the pass, keeps half a percent, swaps the rest for the stock in the pool it was given and sends the shares to the recipient written in the order. If the swap gives fewer shares per USDG than the order allows, the whole call reverts and the USDG stays at the pass.
The pass
A pass is an address that exists before it has code. It is the CREATE2 address of a tiny contract deployed by the hub with your order's hash as the salt:
orderId = keccak256(chainId, hub, recipient, stock, minSharesPerUsdg, deadline, nonce) pass = CREATE2(hub, salt = orderId, code = ZecPass(USDG))
Nobody has a key to it. The only thing that can ever happen at that address is the hub deploying ZecPass there, and the constructor of ZecPass does one thing: hand its USDG to the hub, inside a call that is already executing your order. A second payment to the same pass is collected with flush(), which only the hub may call, and again only inside fulfil or refund of that same order.
Change the recipient, the stock, the limit, the deadline or the nonce and the address changes. So money at a pass cannot be redirected, by us or by anyone: a forged order simply points at an empty address. The order page recomputes the pass in your browser and refuses to show a deposit address if the server's answer differs.
The price limit
ZEC takes minutes to arrive and prices move. Every order therefore carries its own limit, minSharesPerUsdg, set from a live quote less the tolerance you chose: 0.5%, 1.5% or 3%.
The limit is what makes the open fulfil safe. A stranger may pick the pool, but cannot make you pay more than you agreed to: a bad pool, a fake pool or a sandwich all end the same way, with a revert. It is written per USDG, so it still holds if a different amount of ZEC arrives.
If the market is under your limit when the USDG lands, the order waits. It fills when the price comes back, or it refunds.
Refunds and deadlines
A refund sends the USDG itself to the recipient address. It never goes anywhere else: the recipient is part of the order hash. USDG that reaches a pass late, after the deadline or after the order was filled, is handled the same way.
Quotes and the board
Every number on the desk is the contract's own arithmetic. quoteFill starts a real swap in each pool and stops it inside the callback, before anything is paid, reading the exact output. Until the hub is deployed the same code runs from a scratch address through a state override, so quotes are live from day one.
The board prices each stock by quoting a 100 USDG order through all of its pools and showing the best one, fee included, then divides by the ZEC price reported by NEAR Intents. A pool too shallow to take the whole order reads as zero, because the hub never fills in part.
What is private
One thing: the link between you and the shares. An observer sees an amount leave the shielded pool, a swap on NEAR, USDG reach a fresh address and a stock reach another fresh address. None of those addresses has any history with you.
What is not private: the amounts, the timing and the final holder. Someone who knows when you paid and how much can match the two ends. Odd amounts, a recipient that has never been used, and patience before moving the shares all help. Once the recipient address is funded with gas from a known wallet, the link is made by you.
This site has no database and sets no cookies. The order lives in the page address. The server sees the recipient and refund address for the second it takes to request a deposit address, and the host keeps ordinary request logs like any web server.
The keeper
Someone has to send the fulfil transaction, and the recipient has no gas. The site runs a keeper: a key that holds a little ETH and nothing else, and calls fulfil with the best pool once USDG is at a pass, or refund once an order has expired. It acts when an order page asks it to and refuses below one USDG.
The keeper is a convenience. It has no privileges in the contract. If it is offline, connect any wallet on the order page and press the same button: the shares still go to the recipient.
Contracts
The hub has no owner over funds and holds nothing between transactions. A guardian can change one thing, the address that receives the half percent, and only through a 48 hour timelock that anyone can watch and anyone can activate.
The contract was tested against a fork of Robinhood Chain mainnet with the real USDG, the real Tesla and Apple tokens and their real Uniswap and Ramses pools: fills to the wei of the quote, forged orders, fake pools that overcharge, underpay, call back twice or not at all, second payments, refunds, deadlines and the timelock.
$ZECSTOCKS
The token is launched on Pons. The half percent the hub keeps is paid to the project treasury; the token has no claim on the contract and the contract does not need the token to work.
Risks
- Stock tokens are issued by third parties. ZecStocks does not issue, back or redeem them, and a pool price can differ from the exchange price, especially outside market hours.
- NEAR Intents is a separate system with its own solvers and its own failure modes. If it cannot complete a swap it returns the ZEC, less its network fee.
- A thin pool moves under a large order. The board quotes 100 USDG; the ticket quotes your real size. Trust the ticket.
- The contracts are unaudited. The code is short and public; read it before sending more than you can lose.
- Lose the order link before the shares arrive and you lose the status page, not the money: the order still fills or refunds to the recipient.