Docs
The mechanism, the settlement procedure, the attack list and the limits. No contracts are deployed; this describes what they will do.
Scheduling a night
One transaction, and every parameter in it is immutable afterwards. Supply is fixed at 1,000,000,000 with no mint function. The creator may keep up to 5%. The term is chosen from 30, 90, 180 or 365 days — never typed, never edited. 100% of the raise goes into liquidity, locked until nightfall. The trade fee is 1% in both directions, split 40% creator, 30% morning fund, 30% protocol, and the creator’s share pays out at settlement rather than continuously.
The functions that are absent
extend, postpone, cancel, migrate, pause, setNightfall, sweep, rescue and upgradeTo are not permissioned, not timelocked and not behind a multisig. They are not written. The settlement contract has no owner variable and no proxy admin.
The fall
At the first block past nightfall: halt — transfers to and from the pool revert, wallet-to-wallet stays open forever. unwind — the LP position burns and returns tokens and USDG to the vault; the returned tokens are burned because they were the pool’s, not anyone’s. buy — the USDG buys the basket in batches, during equity market hours, each leg capped so it reverts rather than fills badly. settled — redemption opens, permanently.
Every step after the halt is permissionless and pays a bounty out of the morning fund. Nobody has to be trusted to be awake.
Leaving early, and the last hour
With x tokens and y USDG in the pool and c circulating, the morning value per token is V = y/c and the pool price is P = y/x, so a token whose pool holds 20% of supply trades at four times its settlement value. A sale into the pool near nightfall therefore extracts USDG faster than it gives up claims, which is a transfer from the people who stay to the people who leave.
The fee that would exactly neutralise it is 1 − x/c — 75% on ordinary parameters, which is a halt in costume. Instead, a holder can leave at any time for a strictly pro-rata share of the pool’s USDG at a fee starting at 50% and decaying to zero. Taking exactly your share while surrendering exactly your claim leaves V invariant, and the fee makes it accretive. Because that exit rises toward V, dumping into the pool becomes the worse of two options before the end.
Waking up
Burn the tokens, receive the Stock Tokens themselves, pro rata, in kind — not their cash value. Redemption never closes: no deadline, no forfeiture, no sweep of unclaimed funds. Every division rounds in the vault’s favour so the last redeemer is never short.
The attack list
The pre-fall dump
Selling into the pool near nightfall takes USDG out of the vault faster than it surrenders claims on it. Mitigated by an always-open pro-rata exit that is provably non-dilutive, which makes the pool sale the worse of two options in the final hours. Not abolished: irrational size can still sell badly.
Sandwiching the settlement buys
Batched legs at fixed published times, a per-leg slippage cap that reverts rather than fills, and a Chainlink deviation check. A patient searcher can still capture spread inside the cap; the cap bounds the loss rather than removing it.
Nightfall while the equity market is shut
The halt is timestamp-gated and immediate; the buy is gated on an on-chain NY market calendar. The gap is published as two timestamps before it happens.
A launcher farming fees on a short term
The creator's fee share pays at settlement, not continuously, and their kept supply cannot use the early exit. There is no horizon shorter than the term.
Rounding on redemption
Every division floors and the remainder stays in the vault. Fuzzed over random redemption orders to prove the last redeemer is never short.
Dust nights
Below a published minimum the vault holds USDG and buys no basket, because a basket too small to redeem economically is worse than none.
Bounty farming
Each step is idempotent and time-gated, pays once, and the total bounty is capped as a fraction of the vault. Zero on a dust night.
Splits and dividends
Every basket read passes through ERC-8056's uiMultiplier(). A vault holding a stock that splits would otherwise misreport every morning by exactly the split ratio, silently.
The limits
Nitefall does not protect you from a bad token. A night that trades badly settles into a small morning, and no claim is made about how large any morning will be. Liquidity thins as holders leave early, which makes small mornings more likely rather than less. A leg that never fills inside its cap settles in USDG, so a night can settle partly in cash. And nothing is deployed: there are no contracts, no scheduler, no live nights and no audit.
What you actually hold
Stock Tokens on Robinhood Chain are tokenized debt securities issued by Robinhood Assets (Jersey) Limited. They give economic exposure to a share price. They are not shares: no ownership, no votes, no direct claim on the underlying stock. They are not offered in the US, Canada or the UK. Nitefall is an independent product and is not affiliated with, endorsed by, or sponsored by Robinhood.