What it is

$MAG7 is an ERC-20 token whose supply is a pro-rata claim on a basket of seven tokenized stocks that the contract physically holds. It is not a synthetic, not a perpetual, not a price feed wrapped in a token. If you own 1% of the supply, the vault is holding 1% of every one of those seven balances on your behalf, and you can take them out.

The seven are, NVIDIA, Microsoft, Apple, Alphabet, Amazon, Tesla and SpaceX, in their tokenized form on Robinhood Chain. The vault holds them at equal weight: every leg targets one seventh of net asset value.

The basket

Why equal weight and not market-cap weight. Cap weighting needs a current share count for each issuer. There is no honest way for a contract to know that: share counts change through buybacks, issuance and splits, and nothing on chain reports them. A contract that claimed to be cap-weighted would be trusting an off-chain number that someone has to keep updating, and could stop updating, or update wrongly.

Equal weight needs nothing but the vault's own balances and seven price feeds. Every claim this product makes about its own composition is checkable by anyone with an RPC endpoint. That is worth more than matching an index methodology nobody on chain can verify.

The basket is fixed at deployment. There is no function to add, remove or swap a constituent. If the seven should ever change, that is a new vault and a migration people opt into, not a transaction someone can send against the one holding your money.

Minting

mint(usdgIn, minShares). You approve USDG, call it, and get $MAG7. In order:

1. Checks. Minting is not paused, the amount is inside the per-transaction cap, and every one of the seven feeds has published recently. If any feed is stale the call reverts here.
2. Fee. 1% comes off the top, split 50/50 between the PRINTER buyback reserve and the treasury.
3. Split. What is left is divided into seven equal slices. The integer-division remainder, at most six millionths of a dollar, rides along with the first leg, so the vault is never left holding stray USDG that NAV cannot see.
4. Seven swaps. Each slice is swapped to its stock through PrinterDexRouter. Each swap carries a minOut derived from that leg's own Chainlink price, less the router fee and 1.5% of slippage tolerance. Never zero.
5. Pricing. The vault reads its NAV before the swaps and after, and mints you shares for the difference, the value that actually arrived.

Worked example

A $700 mint, with all seven pools filling exactly at their feed price (the unit tests assert this to the wei):

  700.000000 USDG in
-   7.000000   1% vault fee  → 3.50 buyback / 3.50 treasury
= 693.000000   split 7 ways  → 99.000000 per leg
-   0.990000   router's 1% on each leg
=  98.010000   reaches each pool

7 legs × $98.01          = $686.07 of stock acquired
shares minted            = 686.07 MAG7   (first mint: 1 share = $1.0000)

On the real pools this lands slightly lower, the mainnet-fork rehearsal measured each leg filling 8 to 57 basis points away from its feed, which is where the 150 bp slippage guard comes from.

Redeeming

There are two exits, and the second one is the important one.

redeem(shares, minUsdgOut), out to USDG

The vault works out your pro-rata slice of each of the seven balances, burns your shares, sells each slice through the router, takes 1% off the proceeds, and sends you the rest. Requires fresh feeds, same as minting.

redeemInKind(shares), out to the stocks themselves

Same claim, paid in NVDA, MSFT, AAPL, GOOGL, AMZN, TSLA and SPCX rather than in USDG. The 1% fee is charged in kind at the same rate, so this is an exit and not a way to dodge the fee.

This path reads no price feed and calls no router. It is pure arithmetic over balances. That means it still works if every Chainlink feed has stopped, if a pool has been drained, or if the router has been bricked entirely.

NAV & decimals

NAV is the sum of each leg's balance multiplied by its Chainlink price. Share price is NAV divided by supply. Both are readable by anyone at any time; neither is reported by an operator.

Three different decimal conventions meet inside that calculation, and mixing them up is the single most likely way a vault like this breaks:

Every internal value is normalised to 18-decimal US dollars through a single pair of helper functions, and nothing else in the contract is permitted to do the conversion. There is exactly one place a decimals bug could live, and the test suite asserts the resulting arithmetic to the wei rather than to a tolerance band, precisely so that a slip cannot hide inside a rounding allowance.

A companion contract, IndexNavFeed, republishes NAV per share in Chainlink's shape so the rest of the platform can consume it without learning a new interface. Its updatedAt is the stalest of the seven constituent feeds, never block.timestamp, reporting “now” would launder a weekend-old basket into a fresh-looking price, which is the exact lie a staleness check exists to catch.

Rebalancing

Stocks do not move together, so the weights drift. rebalance() sells a slice of the most overweight leg and buys the most underweight one. It is permissionless, anyone can call it, which is safe only because three independent limits bound what any single call can do:

• A band. Nothing happens unless a leg is more than ±20% away from its one-seventh target. Below that the call reverts.
• A notional cap. At most $200 of value moves per call.
• A cooldown. Both legs it touches are frozen for 24 hours afterwards.

Both swaps pay the router's 1% fee, so a full-size rebalance costs the vault roughly 2% of $200 - about $4. That is the deliberate ceiling on what rebalancing can cost per leg per day, and it is what makes poking thin pools with a stale feed unprofitable rather than merely discouraged.

A keeper calls it once each weekday afternoon, while US markets are open and the feeds are awake. If the keeper stops, nothing breaks, the function stays open to everyone.

Fees

Where mint and redeem fees go

Split exactly 50/50. Half goes to the PRINTER buyback reserve, which market-buys $PRINTER and holds it as a protocol reserve - nothing is burned. The other half goes to the treasury.

The streaming fee is dilution, not a withdrawal

It never touches the basket. On every interaction the vault mints itself a small number of new shares to the treasury, proportional to supply and to the time since it last did so. Your share count does not change; the total does, so your fraction of the vault shrinks very slightly. That is why the fee needs nobody to call anything and cannot be outrun by not trading.

What a round trip actually costs

In and straight back out is four 1% bites, mint fee, router on the way in, router on the way out, redeem fee, which is 0.99⁴ = 96.06% before pool costs. The mainnet-fork rehearsal returned $668.86 on $700, or 95.55%, with the gap being pool fees and the pools' basis to the feeds.

Safety rails

The pools underneath hold $10,000–50,000 each. Every limit below exists because of that number.

Feed staleness deserves a note. Tokenized stock feeds only publish while US equity markets are open, so for most of any given week they are stale by design. During those hours the vault refuses to mint or redeem for USDG. redeemInKind stays open the whole time, because it does not consult a price to be right.

What the owner can and cannot do

Being specific about this matters more than any assurance about intent. The owner key is a two-stepOwnable2Step role.

Can

• Pause minting.
• Change mint and redeem fees, capped at 2% each. Change the streaming fee, capped at 2%/yr.
• Change the per-transaction mint cap, the slippage tolerance (max 5%), and the rebalance band, notional and cooldown, all within hard-coded bounds.
• Change the staleness bound between 10 minutes and 7 days, or override it entirely, for a feed that has genuinely stopped publishing, where the alternative is a vault nobody can use. Every change emits an event.
• Change the treasury and buyback addresses.
• Announce a rescue of a non-constituent token and, three days later, execute it.

Cannot

• Cannot pause redemption. There is no function. A vault whose owner can close the exit is not a vault.
• Cannot touch the basket. The rescue hatch reverts on any of the seven constituent tokens and on the share token itself. There is no path from the owner key to the holdings.
• Cannot change the router. It is immutable. The vault grants it approvals, so a settable router would be a drain switch.
• Cannot change the basket. No add, no remove, no substitute.
• Cannot mint shares to anyone. Shares come from deposits and from the streaming fee accrual, nothing else.
• Cannot upgrade the contract. It is not a proxy. The code that is deployed is the code, forever.

Market price vs NAV

Once $MAG7 trades in a pool, its market price and its NAV are two different numbers. Mint and redeem are what tie them together: if the market price rises far enough above NAV, minting at NAV and selling is profitable, and that pushes the price back down. If it falls far enough below, buying and redeeming is profitable, and that pushes it back up.

The word doing the work is far enough. With 1% in and 1% out, arbitrage only becomes worth doing after roughly a 2–3% gap. So expect the market price to wander a few percent either side of NAV, and treat that as normal rather than as a fault. The published NAV on the holdings page is always the honest number.

redeemInKind makes the arbitrage cleaner than it would otherwise be: an arbitrageur can take the underlying directly and unwind it wherever they like, rather than being forced through the vault's own router path.

Risks

Read this part twice.

• Smart contract risk. The contracts are tested, 42 unit tests asserting the arithmetic to the wei, plus a nine-test rehearsal against a mainnet fork with the real tokens, feeds, pools and router. They have not been through a third-party audit. Assume bugs are possible.
• Oracle risk. NAV is only as good as seven Chainlink feeds. A wrong feed produces a wrong NAV, and the staleness check catches a feed that has stopped, not one that is publishing a bad number.
• Liquidity risk. The underlying pools are small. Large mints and redemptions move them, which is why the mint cap exists, but the cap limits damage, it does not remove it.
• Underlying asset risk. Each leg is a tokenized stock issued by a third party. It carries that issuer's counterparty, custody and pause risk, none of which this vault controls or can insure against. The real tokens have pause switches. If one is paused, that leg cannot be traded.
• Market risk. It is seven technology names. They are correlated, they are concentrated in one sector, and equal weighting does not diversify away a sector-wide drawdown.
• Fee drag. 1% a year, plus roughly 4% for a round trip.
• Regulatory risk. Tokenized equities are a young and unsettled area.

Contracts

Robinhood Chain mainnet, chain ID 4663. Everything is verified on Blockscout.

Built by MACHINES on printer.fun, the platform whose router executes every swap this vault makes.

Source, tests and deployment scripts: github.com/btcmachineordinals/mag7. Live balances: the holdings page.