# Randomized-Payout Pack Desk (Superstore)

> **Status: the desk is not yet operating.** This section describes a
> forthcoming product whose specification is complete but whose contracts are
> not deployed. No boxes have been sold, no prize has been paid, and no
> address for this desk is published yet. Every dollar figure on this page is
> a design parameter from the product specification, quoted at the market
> price of NET at current prices, and not a reading from a live shelf.
> Nothing here is live until the fund announces otherwise.

The Randomized-Payout Pack Desk, consumer brand **the Superstore**, to be
served at superstore.netnet.capital, sells boxed software the way a computer
store did in 1996. Each box is an **Edition** of a named tokenized equity, for
example AAPL '95 Home Edition, at a **fixed price in USDG**. Inside every box
is a **random quantity of NET**, drawn against a ladder of odds published on
chain and printed on the back of the box. Every box pays at least its stated
floor. When the box opens, the buyer has **60 seconds** to elect between
keeping the NET and uninstalling for a discounted share of the win in the
box's equity.

The desk is the retail sibling of [Real World Bonds](/rwa-desk) and it runs on
the same machinery. Prizes come from the Manager's own pre-exercised pTEAM
inventory, distributed exclusively through the desk and never sold on the
market. Each payment pays a backing-neutrality fee to the Treasury and buys
the equity named on the box through Rialto. The desk adds nothing to the
fund's deployed contracts, holds no permission on any of them, and has no
role on the emissions path, in the Treasury, or in protocol-owned liquidity.

The consumer application speaks plain English by design. Its store policy is
published at [Superstore Store Policy](/superstore-store-policy), and the
application links out to it. This page is the controlling description of the
mechanics.

## A standing note on the dollar figures

Ladder rungs are **multiples of the box price in dollars**. At purchase each
rung converts once, into a fixed quantity of NET, and from that moment the
prize is a NET quantity and nothing else. Every dollar figure in the store and
on this page is therefore the **market price of that NET at current prices**.
It is an estimate that moves with the market, never a promise, and no page of
this documentation quotes a rate of return of any kind.

## The shelf at launch

Four Editions at four fixed prices. Figures are the market price of the prize
at current prices.

| Edition | Signature box | Price | Headline prize | Floor |
|---|---|---|---|---|
| Trial | MSFT '95 | $10 | **$1,000** at 1 in 2,000 | $5 |
| Home | AAPL '95 | $100 | **$2,500** at 1 in 1,000 | $60 |
| Professional | NVDA '95 | $500 | **$5,000** at 1 in 250 | $350 |
| Enterprise | GOOGL '95 | $1,000 | **$5,000** at 1 in 200 | $800 |

The launch equity menu is **MSFT, AAPL, NVDA, and GOOGL**, four mega-cap names
with deep books, each with a live Rialto market and a Chainlink price feed on
Robinhood Chain. The signature pairing above is the shelf's own styling; the
**shopper picks the equity**, and the pick is validated on chain against the
active menu. No headline prize may exceed the shelf's prize ceiling, which is
**$5,000 at launch** and can be raised only through a timelocked transaction.

New equities enter the menu only through a **timelocked** `addAsset`
transaction whose token and price feed must match an entry the fund has
verified in its published address registry, and the queue is alarmed while it
waits. The launch menu is frozen from that registry at deployment. Removing a
name stops future purchases of it and never sells anything already held; menus
are forward-only.

## The odds ladders

Every rung, as printed on the back of the box.

| Edition | Ladder (multiple of price at probability) |
|---|---|
| Trial, $10 | 0.5× at 74.9%, 1× at 16.05%, 2× at 7%, 5× at 1.5%, 20× at 0.5%, 100× at 0.05% |
| Home, $100 | 0.6× at 75%, 1× at 14%, 1.5× at 7%, 3× at 3%, 10× at 0.9%, 25× at 0.1% |
| Professional, $500 | 0.7× at 76.2%, 0.9× at 12.4%, 1.25× at 6%, 2× at 3%, 4× at 2%, 10× at 0.4% |
| Enterprise, $1,000 | 0.8× at 72.5%, 0.9× at 15%, 1.2× at 10%, 2× at 2%, 5× at 0.5% |

Every table above is exactly **0.9000× the price** at the conversion mark.
The shelf was re-marked from parity to 90% on 29 July 2026. Every **floor
multiple** and every **headline prize, in both value and odds**, is unchanged
by that re-mark: the ten percent came out of the mid rungs, and the
probability mass it freed went to the floor rung. Floors did not get smaller,
they got **more likely**.

Ladders live on chain, and the desk's own immutable checks refuse any table
that does not satisfy all of the following:

* probabilities sum to exactly 100%;
* the sum of probability times multiple equals the desk's published expected
  value target within one basis point, **tested in both directions**, so a
  published table must pay exactly what it advertises and cannot pay less
  than the target it prints;
* the ladder is sorted, the floor is above zero, and the top rung is inside
  the shelf prize ceiling;
* the top rung is coverable out of the desk's own inventory at the
  conservative mark, so a box is never sold against a prize the desk cannot
  pay.

There is **no contract-level minimum on the expected value target itself**,
in either direction. The 90% mark is a launch setting the Manager can retune,
not a floor the desk enforces, and this documentation does not present it as
one. What the desk does enforce is that a published table is honest about
what it pays, and that a change cannot land on a buyer mid-purchase.

A purchased box keeps the **exact table it was sold under**. Ladder changes
are forward-only and can never reach a box already bought. A buy transaction
carries the **ladder version the buyer's odds were read from**, and the desk
rejects it if the tier has been re-marked since, so a shopper who is looking
at one table can never be sold another. Every ladder change emits an event
carrying the full new table, which the keeper alarms on.

## How a purchase works

1. **Buy.** The shopper picks an Edition and an equity from the active menu
   and pays the fixed price in USDG. Everything about the box locks in that
   transaction: the ladder, the conversion of every rung into NET, the fee
   basis, the reclaim discount schedule, the equity binding, and the
   randomness round the box will use.
2. **The named round, and why there is a wait.** The box is bound to a
   **drand** round computed as the first round the beacon publishes after the
   purchase timestamp plus a fixed delay (**120 seconds** as the design value,
   re-measured by the contracts lane before deployment). The delay exists for
   one reason: the round the box will use **must not exist yet** at the moment
   of purchase. A threshold of independent drand nodes has to sign it jointly
   before it exists, so nobody, the fund included, can know the box's outcome
   when the box is sold. The install wizard's pacing absorbs the wait.
3. **Reveal.** Once the round is published, **anyone** may reveal the box. In
   practice the keeper reveals every box as a standing duty and the buyer's own
   application triggers the reveal while they watch the wizard, and the point
   of the permission being open is that **the buyer can always open their own
   box** without anybody's cooperation. The caller receives a bounty of **20
   basis points of the box price**, floored so that it clears layer-two gas,
   carved from the payment. That bounty is **gas reimbursement for whoever
   sends the transaction, not a bribe to attract strangers**; the desk does not
   depend on a market of third-party revealers existing. The seed is the hash
   of the round's signature together with the box id and the buyer's address,
   so it is unique to the box, and the payout is that seed looked up against
   the locked ladder.
4. **The election.** A **60-second** countdown starts at reveal. The buyer
   elects keep or uninstall. If the timer lapses with no action, the box
   **auto-keeps** and the NET is the buyer's.
5. **Settlement.** The equity leg executes through Rialto under a Chainlink
   price gate, and the elected outcome is delivered. The election never waits
   on Rialto, and the equity leg may land before or after it.

Network fees on Robinhood Chain are paid in ETH. An account created with an
email address or a passkey never has to hold any: the store sponsors those
fees, subject to per-account rate limits. A shopper who connects an external
wallet pays their own network fees in the ordinary way.

## The conversion to NET, priced against the buyer

At purchase, each rung converts at

```
conversionMark = max(pair TWAP, pair spot)
payout in NET   = multiple × price / conversionMark
```

The mark is deliberately the **buyer-adverse** one, the same
`max(oracle, live)` shape the fund's mechanism uses elsewhere. It removes the
arbitrage that a backwardated TWAP would otherwise hand a buyer. When the
market runs the other way the spot mark does not bind, the NET leg is worth
more than the mark, and that outcome favours the buyer.

## Expected value, stated the only honest way

At launch the ladders are set so that the **average** contents of a box, taken
across the whole odds table, are **90% of the box price at the market mark, at
the moment of purchase, before exit costs**. That qualification is the whole
claim and it is never dropped. Anyone can verify the figure from the ladder on
chain, and the desk's own two-sided check refuses a table that does not hit
the target it publishes.

Ninety percent is a **competitive** number rather than a generous one, and it
is offered as the former. Comparable mystery-box products return roughly 80%
to 95% of the purchase price, so this shelf sits at the better end of a range
that is, in every case including this one, **below the price paid**. Buying
boxes is not a way to make money, and nothing in this documentation should be
read as suggesting it is.

The consequence of it being an average is the part that matters to a buyer, so
it is stated alongside rather than left implied. An average across a ladder is
**not a property of any single box**. On every Edition the single most likely
result, at a probability of **72.5% or more**, is the **floor rung**, which
pays less than the price; the average is carried by rungs that almost never
come up. A buyer who buys one box should expect the floor, and the 90%
arithmetic is a statement about the shelf, not a forecast of their own
outcome. The re-mark to 90% made the floor rung **more likely on every
Edition**, not smaller, because that is where the freed probability mass went.

The realizable figure is quoted beside it, never instead of it. Keeping a win
and selling it today costs the vest, the fund's **5% trading fee**, and pool
impact, which lands the realizable value at roughly **88%** of the headline at
current prices. Uninstalling instead realizes the published discount schedule
below. The store shows the after-exit-costs figure next to every headline
prize and again on the reveal screen.

### Why 90% and not parity

The shelf launched its design phase at parity and was re-marked before any box
was sold. At parity the fee-debt ledger described in the fee section had **no
repayment source under rational play**. Keeping the install dominates
uninstalling at every rung, so the uninstall slices that retire the ledger
never fire, and the accrual of roughly 1.5% of gross sales became a standing
Manager obligation that stops sales outright once it reaches its cap.

At 90% the packs **self-fund that obligation**: the desk retains ten percent
of sales against an accrual of about one and a half. That relationship holds
**at any NET price**, which is the point. The fee is a fixed fraction of
backing, so it scales inversely with the market mark, and the same win costs
7.8% of its value at a NET price of $64.73, 12.7% at $40, and 20.4% at $24.80.
Tuning a dollar-denominated shelf to a token price that can move forty percent
in an afternoon is the failure mode the re-mark removes.

The Manager's pTEAM allocation still funds the shelf, so the desk is
distributing an allocation rather than running a house bankroll. The ten
percent is what keeps the product's own liabilities paid, not a profit target.
Because the ladder check is two-sided and the box back reads the desk's live
target off the chain, any future re-mark in either direction surfaces on the
box before a shopper can buy it.

## The election: keep or uninstall

One tap, inside a **60-second window** that is an immutable constant. The
election is final the moment it is recorded or the timer lapses; everything
after it is mechanical delivery.

**Expiry auto-keeps.** An unattended winner ends the night holding NET at 100%
of the win rather than a discounted settlement, which is the outcome that
protects them. A 60-second window is also too short to carry any meaningful
option value, so the choice is a genuine choice rather than a free look at the
market.

### Keep

The NET is the buyer's, on the vest schedule below. The held fee goes to the
Treasury and the equity the box bought sweeps to the NetNet RWA Sleeve.

### Uninstall

The buyer takes a discounted share of the win **in the box's equity** instead.
One formula, locked at purchase:

```
win in dollars     = multiple × price                      (locked at buy)
reclaim in dollars = discount(multiple) × win in dollars    (locked at buy)
from escrow        = the box's own equity units, up to that amount
shortfall          = the reclaim amount the escrow cannot cover
from buffer        = an oracle-gated Rialto buy of the shortfall,
                     up to the buffer soft-reserved to this box
delivered          = escrow units + buffer units of the box's equity
```

The discount schedule, immutable and locked into the box at purchase:

| Win size | Reclaim share |
|---|---|
| At or below 1× the box price | **85%** |
| Above 1× and up to 2× | **80%** |
| Above 2× | **70%** |

**Escrow first, buffer second, and the difference matters.** The printed
guarantee is the box's **own equity escrow**, the stock its own payment
bought. Beyond that, the desk extends delivery from a **USDG buffer the
Manager funds**, which buys the shortfall live on Rialto under the same
Chainlink minimum-out gate as every other desk swap. Coverage from that buffer
is **soft-reserved at reveal**, first come first served, and the store's
coverage indicator is labelled **not a guarantee** and is computed net of
those reservations. The Manager may add to the buffer at any time, and anyone
may add to it; the Manager may withdraw from it at will, except that a
withdrawal reverts if it would dip below the slice soft-reserved to a revealed
box that has not yet settled. A revealed win can never be defunded.

On the largest jackpot rungs the backing-neutrality fee consumes the entire
box price, so those boxes buy no equity at all and hold no escrow. An
uninstall on those rungs is **buffer-only**, and the box back and the choice
dialog say so before anything is committed.

Residual escrow above the reclaim amount sweeps to the Sleeve, the payout NET
returns to desk inventory, and the held fee slice pays down the fee ledger and
then refills the buffer.

### Selling reclaimed stock back to USDG

Delivered stock is the buyer's own asset, held in the buyer's own wallet. A
one-tap follow-on sells it back to USDG as the buyer's own Rialto swap, with a
Chainlink-gated minimum USDG out on the other side. The reclaim and sell-back
loop is not a trade through the fund's canonical pair, so it generates no
trading fee. That is stated rather than hidden, and no desk address is ever
exempted from the fee mapping.

## The vest schedule

Kept wins vest by **prize size**, measured on the win locked at purchase. The
two thresholds are immutable constants.

| Win locked at purchase | Delivery |
|---|---|
| Under $100 | **Paid immediately**, direct to the wallet, no vest |
| $100 up to under $1,000 | Vests over **1 day** |
| $1,000 and above | Vests over **2 days** |

Vesting wins use the same note plumbing as Real World Bonds: an amount owed,
per-address caps, and a paginated redeem. The finished portion of a vest is
claimable at any time, and unclaimed vested NET does not expire.

## Where the money goes

Each box payment splits three ways in the transactions that make up the box's
lifecycle. Figures are at the marks in the design record, 22 to 23 July 2026.

| Leg | Where it goes | At those marks |
|---|---|---|
| **Reveal bounty** | Whoever sends the transaction that opens the box, as gas reimbursement | 20 basis points of the price, floored to clear gas |
| **Backing-neutrality fee** | The Treasury | About **6%** of the price on an ordinary box, and the whole price on the largest jackpot rungs |
| **Equity purchase** | Rialto, into the box's own escrow, then to the Sleeve or to the buyer | The remainder |

### The backing-neutrality fee

Every NET the desk pays out is matched by a payment to the Treasury sized so
that backing per token is not reduced by the issuance. The Manager's strike
delivers 1 USDG per NET at exercise; the fee delivers the rest:

```
fee owed = payout in NET × (high-water backing per token − 1 USDG)
```

The high-water mark is monotone, and the fee is charged against the **higher**
of the mark at purchase and the mark at settlement, so a backing ratchet
mid-lifecycle can only raise the fee and never lower it. The fee is carved at
the equity buy, capped at the box price, and booked at settlement: on a kept
box the held fee goes to the Treasury and any excess accrues to a published
**fee ledger**; on an uninstalled box the payout never circulates, and the
held slice pays the ledger first.

Because the fee can exceed the box price on a jackpot rung, the honest claim
about backing is a **bounded** one, not an unqualified one. Backing per token
can be reduced by this product only by the fee ledger outstanding plus the
transient described under inventory below, and both are published on chain.
The ledger has an **immutable cap of $8,250** at the launch prize ceiling,
derived so that three worst-case jackpot debts fit inside it, and anyone may
call `repayFeeDebt` to pay it down. Above the cap, new purchases halt for any
Edition whose maximum fee could extend the debt further. Cumulative Treasury
remittances are always at least the cumulative fee owed on kept boxes less the
ledger outstanding.

### The equity leg and the NetNet RWA Sleeve

The remainder of each payment buys the equity named on the box through Rialto,
into that box's own escrow, under a Chainlink-gated minimum out. Equity from
kept boxes, residuals from uninstalled boxes, and residuals from any
USDG-settled box are held in the **NetNet RWA Sleeve**, a strategic
real-world-asset reserve held by the Manager for the protocol's benefit.

Stated plainly, so there is no confusion:

* The Sleeve is **team-custodied**, a dedicated Safe, and its holdings and
  address are published on chain for anyone to audit.
* The Sleeve is **not part of the fund's on-chain reserves (RFV) or backing
  today.** A team key holds it; it is not in the trustless Treasury. **No NET
  is backed by these assets today**, and the backing-neutrality arithmetic
  above does not depend on them in any way.
* The Sleeve is **earmarked to further NetNet.** In adverse conditions the
  Manager **may**, at its discretion, deploy the Sleeve to support backing or
  the Buyback Program (inverse bonds). That is a commitment to a possible
  future use. It is discretionary and social, not automatic and not
  contract-enforced.

The distinction is the honest one: a commitment plus a conditional future use
is fine to state, and a present-tense backing claim is not, because it is
checkable on chain and it would be false.

## Randomness, and how to check it

The seed for every box comes from [drand](https://drand.love), the public
distributed randomness beacon, on its quicknet chain. The fund does not
produce it and cannot forge it.

1. The box's round is **named at purchase**, by arithmetic anyone can repeat,
   and does not exist yet when the box is sold.
2. After the round publishes, anyone may relay its signature to a small
   permissionless registry contract, which **verifies the BLS signature on
   chain** against drand's group public key using the chain's BLS12-381
   precompiles and rejects anything the drand network did not sign. The
   precompiles were probed on Robinhood Chain mainnet on 28 July 2026 and are
   live, so **on-chain verification is the only mode**: there is no keeper
   commit-reveal fallback and no fallback seed anywhere in the design.
3. The box's seed is the hash of that signature together with the box id and
   the buyer's address, and the payout is a lookup of that seed against the
   ladder locked at purchase.

To audit any box: fetch its round from any public drand node, hash the
signature with the box id and buyer, and confirm the payout the contract
recorded is the rung that seed selects in the ladder the box was sold under.

## Fairness, stated per actor

The desk does not make a blanket claim to be provably fair. The accurate claim
is per actor, and it differs by actor.

* **The buyer, and any third party.** The payout is a pure function of the
  box's own snapshot, the drand round, the box id, and the buyer's address.
  Nothing a buyer signs, times, or resubmits changes any value locked at
  purchase.
* **The operator.** The operator cannot choose a payout, cannot bias one, and
  cannot annul one. Reveal is permissionless, so a buyer who is kept waiting
  can always open their own box. A void reverts outright while the round's
  signature sits on chain, so a reveal always beats an annulment. And a void is
  **permanently buyer-exclusive**, so there is nothing for the operator to
  annul in the first place. Withholding a reveal therefore gains the operator
  nothing at all: the box simply waits for its buyer, who reveals it or refunds
  it whenever they choose.
* **The sequencer.** Aiming a box's round would require the chain operator to
  falsify `block.timestamp` beyond the measured-skew margin built into the
  reveal delay. That is a chain-operator attack, it is publicly detectable
  after the fact, and it is disclosed here as the design's one residual trust
  assumption rather than argued away.

There are also no seeded early wins. A new customer's first box obeys the same
printed odds as every other box. The only free ritual in the store is a
clearly labelled **demonstration disc**: zero stakes, no prize, and no payout
path of any kind.

## What the desk can never do

* **Touch the Treasury, protocol-owned liquidity, reserves, or emissions.** It
  holds no permission on any fund contract and there are no owner functions on
  the fund's side for it to call.
* **Be swept of user funds.** Every transaction ends against two invariants:
  the desk's equity balance equals the sum of its per-box escrows, and its
  USDG balance covers pending refunds plus held fees plus the buffer. Sweeps
  subtract every liability bucket first.
* **Reduce backing outside the published bound.** The reduction is limited to
  the fee ledger, which is immutably capped and permissionlessly repayable,
  plus the unsold-inventory transient below.
* **Sell into the canonical pair.** Desk NET leaves only as a vesting note, an
  immediate payout under the instant-vest threshold, a reclaim return to
  inventory, or a USDG refund.
* **Bypass the trading fee.** No desk address is ever pair-mapped and none is
  ever exempted from the fee.
* **Nerf odds retroactively.** Snapshots are per box, settable parameters are
  forward-only, the menu and the prize ceiling are timelocked, and the halt
  switch cannot reach a box already sold.
* **Defund a revealed winner.** Buffer soft-reservations and the coverage
  floor on withdrawals both bind, and the escrow guarantee is immutable.

## Inventory, the floor guard, and limits

Inventory is deposited **one way** from the team Safe and there is **no
withdrawal function**; reclaim returns count back against the caps. The
settable inventory maximum is **1,000 NET**, under an immutable hard cap of
**2,000 NET**. Inventory allocation between this desk and Real World Bonds
stays operational: the Manager deposits to each desk batch by batch, and the
two desks are accounted jointly against the fund's disclosed
unsold-inventory bound.

The consequence is disclosed rather than hidden. At the marks in the design
record, a full **1,000 NET drawn and unsold** is a transient reduction of
about **3.0%** of backing per token, about **5.7%** at the hard cap, and about
**3.3%** as a worst case across both desks together. It is restored as boxes
sell, and the risk of a stranded clip is the Manager's alone, which is why
clips are kept small and fills follow vest accrual.

Guards on new purchases:

* **The floor guard.** The desk will not distribute the allocation cheaply. If
  the mark would put the desk inside a fixed **1.20×** premium to high-water
  backing, `buy()` halts.
* **The halt switch stops `buy()` only.** No post-purchase step in a box's
  lifecycle can ever be halted, by anyone, for any reason.
* **Reservations.** A purchase reserves the Edition's maximum payout until
  reveal, and the realized payout until settlement. Both windows are minutes
  long by construction.
* **Per-account limits.** At most **8 open boxes** per account, plus
  per-account sponsorship rate limits. Boxes are non-transferable.

## When something goes wrong

* **The round is never revealed.** The buyer may void the box for a **full USDG
  refund** of the price, from the reveal deadline two hours after purchase
  onward. The void is **permanently buyer-exclusive**: there is no third-party
  or permissionless void path at any delay. An earlier revision of the design
  had one, as a liveness backstop, and it was removed on audit. Because the
  beacon is public, a stranger holding a void power could have read a jackpot
  off chain and cancelled the box risk-free, so the only refund ever at stake
  is the buyer's own. A void also reverts while the round's signature sits in
  the registry, in which case the box must be revealed instead: a win anyone
  can see is a win that gets paid.
* **The equity purchase cannot execute.** After a 24-hour deadline the buyer
  may elect to settle in USDG instead. That conversion is **buyer-elected and
  never automatic**, precisely so that no operator can strip a winner's stock
  upside by starving quotes. A verified win is never annulled: on a keep the
  held USDG splits fee to the Treasury and remainder to the Sleeve; on an
  uninstall the reclaim settles in USDG up to the held amount plus the buffer
  reserved to that box.
* **Delivery degrades.** If the buffer cannot cover a shortfall, the buyer saw
  the coverage indicator before purchasing and again at the choice dialog. The
  printed guarantee was always the escrow leg.

## Parameters

Design values from the product specification. Values marked with a dagger are
confirmed by the contracts lane at deployment from on-chain measurement.

| Parameter | Value |
|---|---|
| Choice window | **60 seconds**, immutable, expiry auto-keeps |
| Reveal delay | 120 seconds † |
| Reveal deadline | 2 hours |
| Equity execution deadline | 24 hours |
| Void of an unrevealed box | **Buyer-exclusive, permanently.** No third-party path at any delay |
| Timelock on menu additions and the prize ceiling | 24 hours |
| Reveal bounty | 20 basis points of the box price, floored to clear gas † |
| Reclaim discounts | 85% / 80% / 70% by multiple, immutable |
| Vest thresholds | $100 and $1,000 on the locked win, immutable |
| Shelf prize ceiling | $5,000 at launch, raised only through a timelock |
| Fee ledger cap | $8,250 at the launch ceiling, immutable |
| Inventory | 1,000 NET settable, under an immutable 2,000 NET hard cap |
| Open boxes per account | 8 |
| Expected value target at launch | 0.9000× the price at the mark, before exit costs. A launch setting, not a floor: the desk enforces no minimum |
| Owner functions on any fund contract | **None** |

## Eligibility

Shoppers must be **18 years of age or older**. The attestation is carried in
the store's footer terms and on this page.

## Contract addresses

**Nothing is deployed.** The product introduces exactly two new contracts, the
pack desk itself and the small drand signature registry, and it reuses the
existing Rialto router registry, the Sleeve, and the per-equity token and price
feed pairs already recorded in the fund's address registry. Both new addresses
are **pending deployment**, and neither appears anywhere in this
documentation yet.

When they deploy, they will be published on
[Official Channels](/official-channels) and nowhere else, alongside every other
contract the fund operates. Until then, any address presented as belonging to
this desk is not ours. Never send funds to one.

## Risk factors

* **Randomized outcome.** Most boxes pay less than their price. The floor is
  the only guarantee, and on every Edition the floor is **below** the price and
  is also the single most likely result, at a probability of 72.5% or more.
  The 90% figure is an average across the whole ladder at the market mark, not
  a property of any one box.
* **The expected value target can be changed.** 90% is a launch setting. The
  desk enforces no minimum on the target in either direction, so the Manager
  can re-mark the shelf. A re-mark cannot reach a box already bought, and it
  cannot reach a purchase already in flight, but it can change what the next
  box on the shelf pays.
* **Market risk on the prize.** A prize is a fixed quantity of NET; its dollar
  value rises and falls with the market price of NET, including during a vest.
* **Exit costs.** Selling a kept win pays the fund's 5% trading fee plus pool
  impact, which is why the after-exit-costs figure is displayed beside every
  headline. Uninstalling realizes the published discount instead.
* **Market risk on reclaimed stock.** Tokenized equities rise and fall in
  value, and a buyer who uninstalls holds an equity position from that moment.
* **The buffer is not a guarantee.** Only the box's own escrow is guaranteed.
  Buffer coverage is finite, soft-reserved first come first served at reveal,
  and can be fully committed. On the largest jackpot rungs there is no escrow
  at all and an uninstall is buffer-only.
* **Bounded backing effect.** This product can reduce backing per token by the
  fee ledger outstanding plus the unsold-inventory transient. Both are
  published, both are bounded, and the ledger is repayable by anyone, but the
  effect is real while it exists.
* **Discretionary reserve.** Any future use of the Sleeve to support backing or
  the Buyback Program is at the Manager's discretion and is not guaranteed.
  Sleeve assets do not back NET.
* **Execution and feed risk.** Settlement depends on Rialto execution and live
  Chainlink feeds. The desk halts new purchases rather than fill on a stale
  feed or an execution outage, and an unfillable equity leg settles in USDG at
  the buyer's election.
* **Liveness.** A box needs someone to relay its round and someone to execute
  its swap. The mitigation is that both are permissionless and the buyer can
  perform them personally; the refund and the buyer-elected USDG settlement are
  the backstops. The operator cannot choose an outcome, and cannot cancel one,
  but it can be slow.
* **Sequencer trust.** The reveal delay assumes the chain's sequencer reports
  honest timestamps within the measured skew margin. This is disclosed above
  rather than mitigated.
* **Smart-contract risk.** The pack desk and the signature registry are new
  contracts, in addition to the fund contracts and the Rialto and Chainlink
  infrastructure they compose with.

Full fund mechanics are in [The Fund (Mechanism)](/mechanism); the fee schedule
is in [Trading Fee Schedule](/FEES.HTM); reserve and NAV accounting is in
[Treasury & NAV](/treasury); the sibling equity desk is
[Real World Bonds](/rwa-desk); the complete risk section is
[Risk Factors](/risks). Nothing here is investment advice, and nothing here is
live.