Skip to main content
Capital secures capital — $WOOD is the stake behind every guardian verdict.
Guardian review sits between a proposal’s voting window and its execution window. Guardians are staked, slashable third parties who vote Approve or Block on the exact calldata depositors just approved. An Approve is underwriting: it locks WOOD behind the proposal and that lock is what a block or a conviction burns. Vault owners can post an optional, slashable WOOD stake before the factory creates their vault; it is required for the owner emergency settle and burned if guardians block it. See Owner stake.

​
Where it sits in the lifecycle

  • Guardians cannot act before voting ends; they review calldata that has already passed the depositor vote.
  • The owner’s vetoProposal is limited to Pending. Once in GuardianReview, only the block quorum can reject.
  • After execution, unstick re-runs the pre-committed unwind calls with no review; custom settlement calldata goes through a separate, block-only review window (see Settlement).
  • After settlement, a 14-day challenge window lets anyone bond a challenge against the approvers. Filings are paused until the juror reserve is 30 days old (see Challenge window).

​
Becoming a guardian

StakedWood.stakeAsGuardian(amount, agentId) is permissionless: no cap, no allowlist, only a stake floor. A guardian is active while stakedAmount > 0 and no unstake is pending. requestUnstakeGuardian zeroes the guardian’s vote weight at once and starts the cooldown; claimUnstakeGuardian pays out after it, and reverts CoverageStillOpen while the guardian still has an open or frozen coverage lock. A stake top-up re-anchors the stake age to the stake-weighted average. Stake age. Review votes use raw stake (getPastStake). Stake age matters only in TokenCourt, where a juror’s weight is getPastVotes: raw stake times an age factor that starts at ageFloorBps and rises linearly to par at maturationPeriod, then stays flat (StakedWood._ageFactorBps). The deploy values are 2,500 bps (25%) and 30 days (RobinhoodParams.sol: AGE_FLOOR_BPS, MATURATION); read the live values from StakedWood.ageFloorBps() and maturationPeriod(). Age only shrinks weight, never adds to it, so freshly staked WOOD cannot swing a verdict at full weight.

​
Guardian economics

  • A slice of both protocol fees. Guardians receive 20% of every management fee and 25% of every performance fee, paid onchain in the vault asset to guardiansFeeRecipient and distributed off-chain, weekly, via Merkl as WOOD. The governor’s GuardianFeeAccrued event marks each delivery, and the payout is attributed per approver from the registry’s approver views (getApproverWeights, getApproverCoverage). The management leg matters most: it is charged at every settlement, including flat and losing ones, so the review layer stays funded when the performance leg pays nothing. See Economics.
  • No onchain reward pool and no staking emissions. Slashed WOOD is burned, never redistributed.
  • You only lose stake for approving. Blockers are never slashed; approvers lose their lock when the cohort blocks or a challenge convicts.

​
How a review runs

A review nobody opens is a proposal that executes unreviewed. voteOnProposal reverts ReviewNotOpen until openReview lands, and resolveReview returns cleared for a review that was never opened. Blocking is two transactions: openReview from voteEnd, then the vote. Both are permissionless, so a guardian that only watches for opened reviews cannot be the one that opens them.
Review timing is explained in Governance timing. Block quorum. A review resolves blocked when blockStakeWeight × 10_000 ≥ blockQuorumBps × denominator, with blockQuorumBps 3,000 (30%) at launch and both sides measured at snapshotAt. Stake checkpointed before the propose block counts in the denominator whether or not it votes; stake added in that block or later neither votes nor moves the bar. There is no cohort-size floor: only a zero denominator fails open, because nobody could have reviewed. Approve needs a price; Block does not. An Approve calls ExposureLedger.recordApproval unwrapped, so it reverts with the ledger’s ApproveLockBelowFloor, NoWoodPrice, StalePrice or CoverageHorizonExceeded. A Block reads no price and keeps working through a feed outage. See Coverage for the lock rules.
Don’t poll a proposal’s state to detect Rejected. After voting ends the state reads GuardianReview until resolution; subscribe to GuardianReviewResolved, or call resolveReview yourself. Timing is fixed at propose: reviewEnd = voteEnd + reviewPeriod, executeBy = reviewEnd + executionWindow. A registry pause defers open windows; the governor keeps the proposal in GuardianReview until the review resolves.
Guardian vote enum is separate from the governor’s VoteType: guardians vote { None, Approve, Block }, and a review resolves to { Unresolved, Cleared, Blocked }.

​
Vault-owner stake

minOwnerStake is 0 on Robinhood Chain (open onboarding), so the owner stake is optional. A creator who wants one prepares it with StakedWood.prepareOwnerStake before createSyndicate, and the factory binds it to the new vault; a creator who never prepared binds a zero bond. There is no top-up after binding. The emergency settle needs requiredOwnerBond, which floors at MIN_OWNER_BOND_FLOOR of 1,000 WOOD unconditionally (no TVL scaling). The bond must be live for the vault to propose or execute (OwnerBondNotLive); liveness is keyed on the owner, not the amount, so a zero bond is live. requestUnstakeOwner is refused while the vault has an open proposal (VaultHasActiveProposal) and pays out after the 7-day cooldown. The stake exists to make the emergency-settle path costly to abuse; it is the one place an owner can supply arbitrary calldata against fund capital, so it is bonded and guardian-gated.

​
Slashing

Slashing is onchain and final: slashed WOOD is burned to 0x…dEaD, not sent to a treasury.
  • Approvers slashed when a review resolves blocked. For each approver the registry asks StakedWood for ceil(lockBps × severity / 10_000), where lockBps is the approver’s lock over its stake and severity is a deterministic ramp of how decisively the cohort blocked, clamped into the [minSlashBps, maxSlashBps] envelope snapshotted at open. Severity is minSlashBps when the block side only just reached the quorum, maxSlashBps once it reaches a two-thirds supermajority (6_667 bps), and lo + (hi − lo) × t² in between. Guardians do not choose the penalty, and a tiny lock still costs at least minSlashBps of the guardian’s stake.
  • Challenge conviction (slashVerdict) burns each approver’s lock, clamped into the same envelope, anchored at the stake the guardian held at executedAt.
  • Owner stake slashed when an emergency-settle review resolves blocked: burned in full, and the bond slot is deleted. The burn sticks only through the permissionless GuardianRegistry.resolveEmergencyReview(governor, proposalId), callable by anyone once the window has ended. A blocked finalizeEmergencySettle reverts and rolls its own burn back (see the Finalize row below). There is no re-bond path for an existing vault, so a vault whose owner bond was burned cannot propose or execute again.
  • Approver slashing is bounded by the 100-slot cap to keep gas deterministic; blockers are uncapped, since capping honest defence would be a griefing vector.

​
Emergency-settle review

When a strategy’s pre-committed unwind calls are broken, the owner can submit custom settlement calldata, but only through a bonded, block-only review. The owner can self-recall with cancelEmergencySettle before the window closes, with no slash. See Settlement — Settlement paths.

​
After execution: the challenge window

Every executed proposal stays challengeable for challengeWindow (14 days) after executedAt + strategyDuration. ChallengeGame.file is permissionless and bonds 1.5% of the cohort’s liability in WOOD; a filing freezes the approvers’ locks and starts a 7-day autoSlashDelay. Silence convicts: the approvers’ locks are burned, the proposer bond is forfeited (20% to the challenger, the rest burned) and the adapter pair is demoted. A counter-bond that fills the pool sends the case to TokenCourt, a single WOOD-vote with a 5-day window where the accused, the challenger, the proposer and the counter-bond contributors cannot vote. Juror weight is age-weighted sWOOD at executedAt − 1; a juror whose raw stake grew over the 30 days before that votes at most its weight from 30 days earlier, and an address with no stake then cannot vote.
Filings are paused (ChallengeGame.filingsPaused). The deploy script pauses them until the fleet’s juror reserve is 30 days old: before that, one aged outsider, or 7 days of silence after a filing, could convict every approving key. Every court path is unreachable until the protocol multisig calls setFilingsPaused(false), so approvers carry review-path slash risk only, and proposer bonds on settled proposals are released once the 14-day window has run. The owner stake, the guardian locks and the review quorum are unaffected. See Challenge window.

​
Appeals

Slashing is final at the protocol layer; appeals are reserve-funded refunds, not onchain reversals. The registry owner can call refundSlash from a dedicated slash-appeal reserve, capped at 20% of the reserve per epoch (MAX_REFUND_PER_EPOCH_BPS, RefundCapExceeded) so a compromised multisig cannot drain it in one call. Anyone can top the reserve up.

​
Parameters (launch values)

These are initialization parameters set by the deployment, not contract defaults. All are owner-instant (no onchain timelock; the owner multisig enforces its own delay); the GuardianRegistry and StakedWood setters emit ParameterChangeFinalized(paramKey, old, new). Load-bearing constants: the two-thirds supermajority (6_667 bps) for the severity ceiling, the 20% per-epoch cap on appeal refunds, and a 7-day deadman (DEADMAN_UNPAUSE_DELAY) that lets anyone unpause the registry if the owner goes silent. The pause freezes voting and review resolution; it never freezes stake, unstake or claim, so positions are always exitable.

​
Thin cohort

There is no minimum cohort stake. Any positive at-open stake decides its own reviews, however small. Only a zero denominator fails open: if nobody held stake at the snapshot, the review is not blocked. The cohort at launch is operator-run, so the review is a security service over proposals submitted by vault owners, not a check on the operator.

​
Known limitations

  • Blockers have no stake at risk. Slashing only hits approvers, so a large-stake party could block proposals at the cost of capital alone. stakeAsGuardian is permissionless, so a third party can also raise the denominator the cohort must clear.
  • No ex-post challenge backstop while filings are paused. A bad execution that cleared review can only be answered by the vault owner’s whitelist and veto, which is one reason both launch flags are on (Launch posture).
  • Resolve is permissionless but gas-heavy. If no keeper resolves a blocked review, the next state read forces resolution and that caller pays.