# Tokenized-Equity Coinflip Desk (COINflip) > **Status: the desk is operating on mainnet.** COINflip opened on 10 August > 2026 and is served from the arcade at play.netnet.capital. Contract > addresses are published on [Official Channels](/official-channels) and > nowhere else. **Participation is restricted to persons 18 years of age or > older.** Dollar figures on this page are the deployed parameters, quoted at > the market price of COIN where so labeled, and never a promise. COINflip is a coin flip in which the coin is Coinbase stock. A player brings USDG or COIN, the tokenized Coinbase Global stock that trades on Robinhood Chain through Rialto, picks heads or tails on one to four coins, and a future round of a public randomness beacon decides the flip. A winner is paid the full fair multiplier for the mode, `2^N` times the stake, in COIN. The desk's entire edge is a flat **5% fee**, charged openly on top of every stake. The coins are fair, the fee is the whole edge, and anyone can verify the beacon. The game is the flagship of the fund's RW-PLAY thesis: tokenized real-world assets are natural play pieces for on-chain games. In COINflip a tokenized equity is the stake, the pot, and the prize, settled in seconds. Every USDG bet is a live Rialto fill into COIN at placement, and every sell-back after a win is another. The consumer application speaks plain English by design. Its HOUSE RULES panel carries the fee disclosure in full and links here. This page is the controlling description of the mechanics. ## The game * **Modes.** One, two, three, or four coins. The player picks one side, and every coin in the bet must land that side to win. The win probability is `2^-N` and the payout is **exactly `2^N` times the stake**, so the coins themselves carry no edge in either direction. The mode list can be extended by the Manager only within an immutable ceiling of six coins. * **The fee.** 5% of the stake, charged on top at placement, in the currency the bet was placed in. Because the payout table is exactly fair, every mode returns the same expectation: **95.2% of the all-in amount**. One line therefore covers the whole machine, and the application prints it: "The coins are fair. The 5% fee is the house's entire edge." * **Minimum bet.** The all-in amount, stake plus fee together, must be worth at least **$1** at the price feed's mark, rounded in the player's favour. A wallet holding exactly one dollar can play it. * **Maximum bet.** Set by the coverage cap described under the house fund below, and shown live in the application. * **Lifecycle.** Placing a bet locks the stake and fee, names the randomness round the flip will use, and **reserves the full `2^N` payout from the house fund**. A bet the fund could not pay is refused at placement rather than owed later. Once the round publishes, settlement verifies the beacon's signature on chain, derives one bit per coin, and pays a win or absorbs a loss. Bets are non-transferable, and there is no limit on open bets per address, because each bet's payout is reserved individually. ## Every leg is COIN The stake, the payout, the house's liability, and the house's bankroll are all denominated in COIN units. One COIN staked against two COIN owed is solvent at any price, so the game itself never depends on a price feed. The only legs that need a price are the two conversions, and those are exactly the legs gated on market hours: * **Bet in COIN.** No conversion and no price needed. COIN bets run around the clock, weekends included. The stake plus the 5% fee transfer in COIN. * **Bet in USDG.** The desk takes the fee from the USDG side, then converts the full stake to COIN through Rialto at placement, one live fill per bet, and the flip proceeds COIN-native from there. Off-hours a stale feed pauses that on-chain conversion, so the application buys the COIN in your own wallet at the live market price and bets that instead: a USDG bet is never blocked, though the off-hours fill pays a wider spread and is refused in the rare case that COIN has moved too far from the oracle. * **Win.** The payout arrives as COIN from the house fund, so a winner is holding Coinbase stock. A one-tap sell-back converts COIN to USDG through Rialto while the market is open; on a weekend the button queues the sale for the Sunday 8 PM ET reopen, and the queued sale executes at the reopen price, not the price at the time of the tap. * **Loss.** The staked COIN joins the house fund. Nothing converts. ## The fee, and where it goes The 5% fee splits in half, and both halves are immutable constants of the deployed contract: * **2.5% to the Manager.** The management company's revenue from the game, accrued in the currency each bet was placed in and swept to the team multisig. * **2.5% to the NetNet RWA Sleeve**, the disclosed portfolio of tokenized real-world assets the Manager holds for the protocol's benefit, described under [Real World Bonds](/rwa-desk). COIN-side fees sweep to the Sleeve directly; USDG-side fees convert to COIN at sweep time, while the market is open, and follow. The honest line is the one the HOUSE RULES panel prints: half the fee goes to the Manager, and half grows the NetNet RWA Sleeve. Two clarifications belong next to it. First, **nothing from this product reaches the Treasury**. Other fund products remit a fee to the reserve from their first sale; this one deliberately does not, and no page of this documentation extends that claim to COINflip. Second, the Sleeve is **not part of the fund's on-chain reserves (RFV) or backing**, and no NET is backed by Sleeve assets. Any future use of the Sleeve to support the fund is at the Manager's discretion, as disclosed on the [Real World Bonds](/rwa-desk) page. Fee sweeps are permissionless: `sweepFees()` is callable by anyone at any time, and the fund's keeper calls it on a thirty-minute cadence. Cumulative sweeps to the Manager and the Sleeve always equal cumulative fees charged; neither half can be redirected or zeroed at any bet size. On the fee's size, stated plainly: comparable on-chain coin flips run at edges between roughly 2% and 3.5%. **Five percent is above that market.** The desk charges it anyway and prints it on the machine, rather than burying it in the multiplier: payouts are always quoted at the fair `2^N`, and the cost is always shown as the all-in amount. ## The house is the Manager The bankroll behind the game is the Manager's own capital, and this is disclosed as the product's central operational fact rather than softened. * The Manager seeded the house fund with **$20,000**, converted to COIN at deployment through Rialto. Liabilities are COIN-denominated, so the fund's solvency does not depend on the COIN price; the price exposure on the bankroll is the Manager's alone. * Anyone may add to the house fund. Only the Manager may withdraw, and a withdrawal is **coverage-floored**: it reverts if it would leave the fund below the total payouts reserved on open bets. **A placed bet's payout can never be defunded.** * Above that floor the bankroll is operational, exactly like the Superstore's buffer. The Manager may withdraw down to the floor and refill at will, with no timelock, and the application's live coverage readout reflects whatever is actually there. * The house fund is **never protocol funds**. The Treasury, the fund's reserves (RFV), and protocol-owned liquidity are not a betting counterparty, and no code path lets them seed, top up, or backstop the bankroll. ### The coverage cap The maximum payout on any single bet is an immutable formula: **5% of the free bankroll**, where free means the house's COIN minus everything already reserved. The maximum stake per mode follows as the cap divided by `2^N`. At the launch seed that is a maximum payout of about **$1,000**, a maximum single-coin stake of about **$500**, and a maximum four-coin stake of about **$62.50**, all scaling with whatever the free bankroll is at bet time. Raising the limits means the Manager seeding more; a shrinking bankroll shrinks them automatically. The cap also binds **per round, in aggregate**: the total payouts reserved against any single beacon round can never exceed the same 5% of the free bankroll. A bet that would push its round over the cap is refused, and the application offers the next round, seconds away. This closes the obvious stacking play, in which many individually legal bets pile onto one beacon outcome. ## Market hours Robinhood's stock tokens trade 24/5, from Sunday 8 PM ET through Friday 8 PM ET, and are closed on weekends. The desk maps onto that calendar the only honest way: * **The flip itself never freezes.** COIN-in, COIN-out bets run through the weekend, because no leg of a COIN bet needs a price. * **Betting never waits; cashing out does.** The on-chain USDG conversion is gated on the market being open and the Chainlink COIN feed being fresh within a four-hour window, because converting at a frozen Friday price would hand a free option against the house. When that gate is closed, a USDG bet still goes through, since the application buys the COIN in your wallet at the live off-hours price and bets that; a sell-back from COIN to USDG is what waits for the reopen. A player who holds COIN over a weekend, whether by choice or because a queued sell-back is waiting for the reopen, carries the stock's weekend price risk. That is what holding a stock is. ## Randomness, and how to check it The outcome of every flip comes from [drand](https://drand.love), the public distributed randomness beacon, on its quicknet chain. The machinery is the same as the Superstore's, and it has no operator input anywhere in the outcome path. 1. The bet names its round **at placement**, by arithmetic anyone can repeat: the first quicknet round due at least **15 seconds** after the bet's timestamp. The delay exists so that the round **cannot exist yet** when the bet is placed. A threshold of independent drand nodes must jointly sign a round before it exists, so nobody, the fund included, can know the flip's outcome at bet time. The 15-second figure carries a roughly fifteen-fold margin over the chain's measured timestamp skew, and the contract fails closed on both ends: a bet that would name an already-published round reverts, and a settle whose round turns out to have been published before the bet reverts. 2. Once the round publishes, anyone may relay its signature. The contract verifies the BLS signature on chain against drand's group public key, using the chain's BLS12-381 precompiles, and rejects anything the drand network did not sign. The flip bits are the hash of the verified signature, one bit per coin. 3. Settlement is **permissionless and unpaid**. The fund's keeper settles every bet at its own expense the moment the round is public, and the point of the permission being open is that **a bettor can always settle their own bet** without anybody's cooperation. In practice the coin on screen spins for roughly 15 to 20 seconds end to end, with the drand round number visible under it the whole time. 4. **If the beacon fails.** If a bet's round is still unpublished two hours past its due time, the bettor, and only the bettor, may void the bet for a **full refund of stake and fee**, releasing the payout reservation. Because settlement is permissionless, any beacon that exists is settled long before that deadline; the void exists for a true drand outage, not as anyone's discretion over a live bet. The application's fairness page shows the round number, the signature, and the bit derivation for every historical flip. To audit one: fetch the round from any public drand node, verify the signature, hash it, and confirm the bits the contract recorded. ## Fairness, stated per actor * **The bettor, and any third party.** The outcome is a pure function of the bet's named round and the beacon's signature. Nothing a bettor signs, times, or resubmits changes a value locked at placement. * **The operator.** The operator cannot choose an outcome, cannot bias one, and cannot annul one. Settlement is permissionless, the void is bettor-exclusive, and the halt switch stops new bets only: no post-bet step, not settlement, not sell-back, not a coverage-floored withdrawal, can be halted by anyone. * **The sequencer.** Aiming a bet at a known round would require the chain operator to falsify timestamps beyond the measured-skew margin inside the 15-second delay, and the fail-closed checks turn a larger skew into reverted transactions rather than exploitable bets. This is disclosed as the design's residual trust assumption rather than argued away. ## The arcade at play.netnet.capital play.netnet.capital is the fund's arcade hub, presented as a desktop from another decade. COINflip runs there natively; **WinNET**, **CLIMB, INC.**, and **the Superstore** appear as icons that link out to their own venues at [win.netnet.capital](/winnet), [climb.netnet.capital](/climb), and [superstore.netnet.capital](/superstore). The About window carries the fund framing and the Manager's RW-PLAY letter, and each game's own long-form disclosure is the controlling document for that game. Network fees on Robinhood Chain are paid in ETH. An account created with an email address or a passkey never has to hold any: flips are gas-sponsored through the same infrastructure as WinNET's entries, subject to per-account rate limits. A player who connects an external wallet pays their own network fees in the ordinary way. One naming note, stated for clarity: the coin on screen carries the ticker COIN, which is how the tokenized stock identifies itself on chain. COINflip is not affiliated with, sponsored by, or endorsed by Coinbase Global, Inc., and the tokenized stock carries the issuer and redemption mechanics of its tokenization, which are not the fund's to control. ## What the desk can never do * **Touch the Treasury, protocol-owned liquidity, reserves, or emissions.** The desk holds no permission on any fund contract, is never exempt from the trading fee, and never touches the canonical NET pair. No leg of a bet involves NET at all. * **Pay out more than it holds.** Every bet reserves its full payout at placement; the contract's invariants require the desk's COIN balance to cover the house fund, every reserved payout, every unsettled stake, and accrued fees, at the end of every transaction. * **Defund a placed bet.** Reservations release only at settlement or a bettor-elected void, and owner withdrawals revert below the coverage floor. * **Change the odds or the fee.** The `2^N` payout rule, the 5% fee, its 50/50 split, the coverage-cap formula, and the refusal to price against a closed market are immutable. The Manager's settable surface is the mode list within the ceiling of six, the minimum bet, the halt on new bets, and sweep execution, every change event-logged. * **Keep a fee it did not disclose.** Cumulative sweeps equal cumulative fees charged, verifiable on chain. ## Program terms 1. **Operator.** NetNet Capital Management. The house bankroll is the Manager's own capital; participant stakes and reserved payouts are contract-escrowed, and the operator cannot settle, void, or redirect a bet's outcome. 2. **Eligibility.** Participants must be **18 years of age or older**. 3. **Costs.** The 5% fee, charged on top of the stake at placement, is the house's entire edge. USDG bets and sell-backs execute through Rialto at the quoted market price. No leg pays the fund's NET trading fee, because no leg touches NET. 4. **Randomness.** Every outcome is seeded by the public drand beacon and verified on chain. Settlement is permissionless; results are independently auditable. 5. **Amendments.** The payout rule, fee, fee split, coverage-cap formula, solvency invariants, and halt scope are fixed in the deployed contract. Changes require a successor deployment, not an in-place edit. ## Parameters | Parameter | Value | |---|---| | Modes at launch | 1 to 4 coins, settable within an immutable ceiling of 6 | | Payout | Exactly `2^N` × stake, immutable | | Fee | 5% of stake, on top, immutable; split 50/50 Manager and Sleeve, immutable | | Expected return, every mode | 95.2% of the all-in amount | | Minimum bet | $1 all-in at the feed mark, rounded in the player's favour | | Maximum payout | 5% of the free bankroll, per bet and per named round in aggregate, immutable formula | | House seed at launch | $20,000, converted to COIN at deployment | | Round naming delay | 15 seconds | | Void deadline | 2 hours past the named round's due time, bettor-exclusive, full refund | | USDG legs | On-chain conversion needs market open plus a 4-hour feed-freshness gate; off-hours a USDG bet still runs by buying COIN in the player's wallet first, while sell-back waits for the reopen. COIN legs run 24/7 | | Fee sweeps | Permissionless; keeper cadence 30 minutes | | Halt scope | New bets only; settlement, sell-back, and coverage-floored withdrawals can never be halted | | Owner functions on any fund contract | **None** | ## Risk factors * **Every bet is expected to lose.** The coins are fair and the payouts are fair, so the 5% fee is, precisely, the amount by which the average player loses. The expected return of every mode is 95.2% of the amount paid. Most bets also lose outright: a single coin loses half the time, and a four-coin bet loses fifteen times in sixteen. Playing COINflip is not a way to make money, and nothing in this documentation should be read as suggesting it is. * **Market risk on COIN.** Winnings arrive as tokenized Coinbase stock, and a USDG bet becomes COIN at placement. The stock's price moves, including while a sell-back waits for the market to reopen, and a queued weekend sale executes at the reopen price. * **Market hours.** Betting always works, but off-hours a USDG bet routes through an in-wallet COIN purchase that pays a wider spread, and cashing out from COIN to USDG is unavailable on weekends and whenever the price feed is stale. A player holding COIN through a weekend carries the gap risk of the stock. * **The bankroll is operational.** The house fund is Manager capital, withdrawable at will down to the coverage floor. Reserved payouts on placed bets are always protected, but maximum bet sizes rise and fall with the bankroll and are not a commitment. * **Liveness.** Settlement requires someone to relay the beacon and call settle. Both are permissionless and the bettor can do both personally; the two-hour bettor-exclusive void with a full refund is the backstop for a beacon outage. The operator cannot choose an outcome, but it can be slow. * **Sequencer trust.** The round-naming delay assumes the chain's sequencer reports honest timestamps within the measured skew margin, with fail-closed checks behind it. This is disclosed above rather than mitigated. * **Tokenization risk.** COIN is a tokenized stock and carries the issuer and redemption mechanics of its tokenization, which are not the fund's to control. * **Smart-contract risk.** The desk is a new contract, in addition to the Rialto, Chainlink, and drand infrastructure it composes with. Full fund mechanics are in [The Fund (Mechanism)](/mechanism); the Sleeve that receives half of every fee is described under [Real World Bonds](/rwa-desk); the complete risk section is [Risk Factors](/risks). Nothing here is investment advice.