Trust & disclosures
Trust what you can verify.
Token Index is operated by one person — and says so. Every power the operator holds is disclosed here and bounded by contract code, not by promises. This page states exactly what the operator can and cannot do, and every assumption you are trusting, before you hold anything.
The operator's powers — and their hard limits
The operator CAN
6 bounded powersRebalance the basket — through allow-listed DEX routers only
Swaps go from one registered basket asset to another, through a router the controller has allow-listed (PulseX-style V2 or SwapRouter02-style V3). The vault measures its own balance before and after and reverts unless the output meets the minimum it was told; approvals are set exactly and zeroed again in the same transaction; every call carries a deadline (checked by the vault on V3 legs, by the router on V2 legs). Output can only land back in the vault.
Change basket membership
Add any token contract as a basket asset (it then joins every future in-kind mint and redemption). Remove one only while the vault holds none of it — an asset with a balance cannot be dropped, so nothing a holder is owed can vanish from the pro-rata claim.
Tune the collar dials — inside immutable bounds
The mint premium and redeem discount launched at 1% / 1% and are owner-tunable live, but only between 0.50% and 5.00% — the bounds are baked into the vault. Take effect on the next mint/redeem.
Pause minting and rebalancing
The controller (or the guardian) can pause the mint door and the rebalance function; only the controller can unpause. Redemption has no pause switch at all — see the other column.
Allow-list or delist routers, appoint roles
Router allow-list changes are instant. The deed claimant appoints a delegate (day-to-day operator), a guardian (pause-only) and a rebalancer (rebalance-only), and can re-point where the treasury leg of the tax pays.
Transfer or burn the deed
Control is an NFT. The holder can hand it to a new wallet (the new holder must claim, which evicts the previous delegate) or burn it — a provable, irreversible renunciation after which the protocol runs owner-less with its final settings.
The operator CANNOT
no exceptions, no overrideTake assets out of the vault
There is no withdraw, sweep, rescue or emergency function. Vault assets leave in exactly two ways: pro-rata to a redeemer who burns tokens, or as one leg of a rebalance whose output must return to the vault above the minimum.
Pause or block redemption
In-kind redemption is unpausable by construction: any holder can burn tokens and receive their pro-rata slice of every basket asset at any time. Even a paused mint door does not touch this.
Change the transfer tax rate
Every transfer between two wallets pays 0.5%. That number is a compile-time constant in the token — no setter exists, and the contracts are not upgradeable. Mints and redemptions are supply operations, not transfers, and are untaxed.
Mint outside the vault's rule, or exempt anyone
New tokens exist only when the vault mints them against a pro-rata deposit at NAV +1%. The token has no owner, no pause, no blacklist, no permit and no fee exemptions — the operator's wallets pay the same tax as everyone.
Upgrade or replace the contracts
The token, vault, zapper and deed are plain non-upgradeable contracts wired to each other at deploy (the vault's minter binding and the deed's token binding are immutable). New behaviour means a new deployment, disclosed as such.
Push a rebalance below its floor
A rebalance names a minimum output. If the router returns less — a thin pool, a bad price, a hostile router upgrade — the whole transaction reverts and nothing moves. The public quote tools also mark both legs at discovered market prices and refuse trades that lose more than the operator's own limit.
How the limits work — every rule above is a contract check, not a policy. NAV is not posted by anyone: it is computed on the fly as vault holdings ÷ token supply, so there is nothing to manipulate and nothing to go stale. Minting costs NAV +1% and redeeming pays NAV −1% (both dials movable only inside 0.50–5.00%), so the vault gains on every entry and exit; transfers pay a fixed 0.5%. If a bounded power is misused, the worst case is a paused mint door or a reverted rebalance — never a drained vault and never a blocked exit.
The tax split — The 0.5% transfer tax is split 60% burn / 40% treasury on the current (v2) token, where the split is a constant. The next token version (v3, built and tested, not yet deployed) keeps the tax rate fixed but lets whoever holds the deed — the holder alone, at any time, never the delegate — set the split anywhere from 100% burn to 100% treasury, effective on the next transfer. v3 also lets the deed holder point control (the claimant — routers, basket, dials, roles, payout, delegate) at any wallet at any time without parting with the deed; doing so evicts the sitting delegate. When v3 is live this page will state the current split and that both can change.
Disclosures
- 01
One person operates this system. Control sits with a single deed NFT held by a cold wallet; day-to-day actions are signed by a delegate wallet the claimant appointed. There is no multisig and no timelock — changes the operator is allowed to make take effect immediately.
- 02
The contracts are unaudited canary software. They were built and tested by the operator, exercised on a mainnet fork and then deployed live with small money. Treat every figure and every promise accordingly.
- 03
Contract source is not yet published (deliberate: the deployment is kept low-profile). Everything this site shows is read straight from the chain, and anyone can inspect the bytecode; a source publication is an operator decision, not a contract guarantee.
- 04
The token pays a fixed transfer tax on every wallet-to-wallet transfer, including DEX trades. Part of it is burned, part goes to the operator's payout wallet — that treasury share is operator income, disclosed as such.
- 05
The operator supplies almost all of the pool liquidity today and runs an arbitrage bot with its own capital against the same pools and doors everyone else can use. The bot holds no protocol role and cannot touch vault funds; it competes on equal terms.
- 06
Redemption returns basket assets in kind. Converting them to a stablecoin goes through DEX pools that can be thin; the zapper's quote shows what a route pays before you sign, and the direct in-kind door never depends on any pool.
- 07
Nothing here is a financial claim, an offer, or advice. Numbers marked live are chain reads; everything else on this local preview is simulation.
Contracts
| Contract | Role |
|---|---|
| Deed | 1-of-1 ERC-721 that IS control: whoever holds it can claim, appoint the delegate/guardian/rebalancer, re-point the payout, tune the collar, allow-list routers — and, on v3, set the tax split by possession alone. Transferable; burnable for a provable renunciation. |
| IndexToken | ERC-20 with the fixed 0.5% transfer tax. No owner, pause, permit, blacklist or exemptions. Only the vault can mint or burn on redemption. Treasury recipient (and, on v3, the split) writable only through the deed. |
| IndexVault | Custody + the two doors: in-kind mint at NAV + premium, unpausable in-kind redeem at NAV − discount. Router allow-list, basket membership, collar dials, V2 and V3 rebalance with a measured-delta minimum. No withdrawal path. |
| Zapper | Disposable convenience periphery: turns DAI into the basket and mints, or redeems and turns every slice back into DAI, in one transaction. Holds nothing between transactions and only ever moves the caller's own funds; this site offers it routes only through routers the vault allows. |
| ArbExecutor (bot lane) | Not part of the protocol. The operator's own immutable arbitrage periphery, funded only with the operator's money; it holds no vault role and can only use the public doors and pools like anyone else. |
The four protocol contracts deploy together in one fixed order and are wired to each other at deploy; none is upgradeable. Live addresses appear on the pages that read them, so what you see is always the contract the site is actually talking to.
Safety architecture
Redemption cannot be paused
The exit door has no switch. Every holder can burn tokens for a pro-rata slice of every basket asset at any time, regardless of what the operator does with the mint door.
Swap-only custody, measured on chain
Vault assets can only be exchanged through allow-listed routers, and only for at least the minimum output named in the call — checked against the vault's own balances, not the router's word. Nothing can be sent anywhere else.
Immutable collar bounds
The mint premium and redeem discount can move, but only between 0.50% and 5.00% — limits fixed in the vault at deploy. Every entry and exit is priced off NAV inside that band.
Fixed tax, no exemptions
0.5% on every transfer, for everyone, with no code path to change the rate. Only where the treasury share goes (v2) — or how big it is (v3, deed holder's call) — is a deed-level decision.
Control is one NFT, and it evicts on hand-over
All admin authority resolves through the deed. When a new holder claims, the previous delegate is evicted automatically — no operator key survives a change of ownership by accident.
Non-upgradeable, wired at deploy
No proxies, no admin swaps. The vault's minter binding and the deed's token binding are immutable. If behaviour has to change, a new system is deployed and announced as such.
Credits
The charts on this site are drawn with TradingView Lightweight Charts™ — the charts include software developed by TradingView, Inc., used under the Apache License 2.0.