YieldFlow: a Dividend Routing Layer for Tokenized Stocks

01Background: stocks on Robinhood Chain

Robinhood Chain is a public Arbitrum Orbit L2 that carries tokenized exposure to listed equities. The stock tokens are ordinary transferable ERC-20s issued by a regulated issuer, each backed by underlying share exposure and traded against USDG, the chain's dollar token, in standard AMM pools.

The key detail is their “scaled amount” design: a holder's raw balance stays fixed while a contract-level uiMultiplier sets how many shares each token stands for. Price feeds quote the multiplier-adjusted price, and every change to the multiplier emits a public UIMultiplierUpdated event.

02The invisibility problem

When a company pays a cash dividend, the issuer reinvests it in more underlying shares and raises the token's multiplier. The design is tidy, since tokens track total return, but it has a cost: dividends on Robinhood Chain cannot be seen. They arrive as an accounting change, not a payment. Holders cannot see them, spend them or direct them.

The thesis of YieldFlow: the income part of a tokenized stock should be as visible and programmable as the principal. A holder should be able to keep full price exposure and still receive the dividend part as money they control.

03The harvest mechanism

Each supported asset has its own vault. Depositors receive a 1:1 flow block and keep their full share exposure. When a verified dividend raises the multiplier, the vault realises only the increment:

vault holds T tokens at multiplier M0  →  exposure = T × M0
dividend lifts the multiplier to M1     →  exposure = T × M1
harvest sells ΔT = T × (1 − M0 / M1) tokens for USDG
remaining: (T − ΔT) × M1 = T × M0        →  the original exposure

Exposure is kept by arithmetic rather than by promise; a property test on the vault requires that no harvest exceeds the increment by a single wei. Because harvests are sized by dividends, typically 0.1 to 1% of vault value a quarter, normal pool depth is enough to run them in chunks, bounded against the oracle price, and to defer them to a later epoch when depth falls short.

Entry and exit. Most people hold crypto rather than stock tokens, so entry is a two-leg atomic zap: USDG or ETH buys the stock token (leg one), which is locked in the vault to mint flow blocks one for one (leg two), in one transaction that fully reverts on any failure. Exit runs the same path backwards. Fees are itemised per leg (the pool fee and a 0.10% wrap fee) with a 0.50% slippage bound.

A vault keeps share count, not value. Price, issuer and liquidity risk stay with the holder, and phrases such as “principal-protected” are not used anywhere in the product.

04Corporate-action safety: two sources must agree

A multiplier change alone is ambiguous: a 2% jump could be a dividend, or one leg of a split whose price adjustment lands in the same window. Harvesting a split would sell principal. An event therefore counts as harvestable only when two independent sources agree: a declared cash dividend with a matching ex-date and amount, and an observed multiplier move of about amount ÷ price with the oracle price continuous across it.

Splits fail by construction and are recorded as re-basings; events that cannot be classified freeze the vault until resolved. The issuer's own pause windows for large corporate actions are treated as automatic harvest freezes, as are market closures. On top of that, harvesting is capped at 5% of vault value per epoch whatever the classification, a hard ceiling on the damage any mistake can do.

05Yield sources and accounting rules

Every unit of yield carries one of four tags, kept apart in the ledger and never blended in display:

• Native: harvested dividends of the depositor's own asset. The only source that may be called a dividend.
• Network: payouts from the optional cross-asset pool (section 06).
• Protocol: wrap and routing fee revenue shared with network members.
• Sponsored: streams from prefunded escrows, shown with the sponsor, the reserve left and the end date.

06Network economics: sharing without draining

Naive cross-asset pooling fails in a predictable way: if assets that pay nothing are funded from the income of assets that pay, the payers leave and the pool collapses. The network pool is therefore two buckets with separate funding and separate rules.

Bucket A · dividend share. Network vaults contribute 10% of harvested dividends. Payout weight is 70% dividends contributed and 30% time-weighted value, so the bucket mostly flows back to contributors; the shared slice is deliberate, visible and capped at 3× what any vault put in.

Bucket B · activity yield. Funded by protocol revenue and all sponsored campaigns, never by depositors, and paid by time-weighted value with a small lock boost (×1.0 rising to ×1.3 at 90 days). Assets without a dividend earn here.

Worked example (illustrative): $10,000 each in SPY, NVDA and TSLA for one year, trailing yields of about 1.2%, 0.03% and 0%, a 5% protocol share, the 10% dividend share, and $65 of protocol and sponsor flow in Bucket B.

Read it honestly: SPY beats native mode only because Bucket B exists. With no sponsors and no protocol revenue, network mode costs contributors about 2.6% of their dividend, a trade-off the interface must show at opt-in.

07The router and settlement

Holders split each settlement across four destinations, reinvest, network pool, another asset or USDG to the wallet, in any mix that adds up to 100%. The rules are the holder's; the protocol takes no discretion and no performance fee. Yield builds continuously and settles weekly. A leg that cannot execute settles as USDG to the user, a vault paused mid-epoch accrues rather than loses, and dust rolls into the next epoch.

08Architecture

Offchain, an indexer serves history for display only, while all money maths stays on live reads. Settlement is triggered by a keeper but becomes permissionless after a grace window, so the operator cannot hold the protocol hostage.

09Risk model

• Misclassification, the worst case: selling principal on a split. Countered by the two-source rule, issuer pause windows and the 5% epoch ceiling.
• Market microstructure: sandwiching and thin pools. Hard slippage bounds, chunked sells, deferral below depth thresholds.
• Oracle failure: staleness windows and pool-price cross-checks pause conversions; withdrawals never wait on the oracle.
• Issuer control: the stock tokens can be paused, burned and upgraded by their issuer. This is disclosed, not engineered away.
• Governance: the only instant power is pause; everything else waits in a 48-hour public timelock.

10Legal posture

Wrapping third-party security tokens and passing on dividend-derived value touches securities, fund and e-money rules in many places. The approach is sequencing: the observatory runs today because it holds nothing and offers nothing, while deposits, network pooling and campaigns launch only in structures cleared by counsel. The stock tokens exclude US, UK, Canadian and Swiss persons, and YieldFlow will enforce the same.

11Status and roadmap

Now: observatory. Live multipliers, supply and wallet reads over real chain data; real EIP-6963 wallet connection, read-only; every undeployed action shown and disabled. Next: contracts. Vault, harvester and registry, tested against the live chain, then a capped private pilot. Then: launch. Public native vaults and the router after audit and legal review.

Disclaimer. This paper describes a protocol design. It is not an offer, a solicitation or financial advice, and no figure in it is a promise of yield. Illustrative numbers are labelled. The contracts in sections 03 to 08 are not deployed; nothing in the current product can accept deposits or move funds. YieldFlow is independent and not affiliated with the stock token issuer or with Robinhood Chain. © 2026 YieldFlow.