HarvestBot
For judges · 30 seconds, no setup · Robinhood Chain testnet 46630

Five clicks. No wallet. Every claim on a line you can check.

HarvestBot lets an autonomous agent harvest tax losses on Robinhood tokenized equities, bounded by an onchain mandate it physically cannot exceed, and gets it slashed when it lies.

Verify live in your browser Every address Reproduce By criterion
Reading chain 46630 from your browser… rpc.testnet.chain.robinhood.com · 1 batch · no wallet
Click these, in order · strike each line as you go

The 30-second path.

  1. The harvest happened.

    Agent-signed, router-gated, HIFO recomputed by the Stylus ledger, 9 lots, real AMZN → real NFLX.

    0x689c4d34…6123 on the explorer ↗

  2. The chain refused the rebuy.

    Status 0, WashSaleViolation. Same agent, same key, 40 seconds later.

    0xd486468e…cf10 on the explorer ↗

  3. The rogue trade got the agent slashed.

    Slashed(agent, mandate, 200000000, 20000000, 180000000, …), called by a third-party key. The same bond refuses stale proof: the expired beat-2 envelope reverts EnvelopeNotLive.

    0x6b896b6e…7dcb on the explorer ↗

  4. The Stylus ledger is real WASM on Robinhood Chain.

    ArbWasm.stylusVersion() = 3 on chain 46630; deployed and activated in one cargo stylus deploy tx, 0x5cc682a7…77ed ↗.

    0xEff7…5a21 on the explorer ↗

  5. The numbers.

    Stylus vs Solidity computeHarvest on the same chain, same inputs, identical outputs: 2.87× less L2 gas at 64 lots, 3.1× at 128, with the WASM program uncached (worst case).

    bench/RESULTS.md ↗
0 of 5 struckZero clicks into code: /verify reads these receipts from chain 46630 live, no wallet.
The one flow · every hash an explorer link · status read live where it is cheap

Harvest, refuse, slash.

Beat 1 · harvest

Nine lots banked.

Sell 0.638501 AMZN, HIFO lots 63 → 55, rotate into NFLX. The mandate recomputed the picks on the Stylus ledger and realized −$24.531251.

Beat 2 · blocked rebuy

The rebuy, refused.

NFLX → AMZN, 40 seconds later. Reverted WashSaleViolation(owner, AMZN, AMZN, 1792060681): walled until 15 Oct 2026.

Beat 3 · slashed

The rogue trade, slashed.

AMZN → PLTR was never a sanctioned substitute: reverted OffMapSubstitute. A third-party key, 0x0Fec…28e2, used the signed envelope as proof. Bond 1,000 → 800 mUSDC.

Tags: live read from the RPC in your browser just now · receipt from the committed receipts/46630.json. The decoded events (lot ids, slash split, live bond balance) are on /verify.

Deployed on chain 46630 · deployments/46630.json + deployments/46630-bench.json

Every address, in full, one click from the explorer.

Stylus Rust → WASM

TaxLotLedgerthe HIFO engine the mandate checks against · deploy + activation tx ↗
0xEff7B46049fC677F58264e0ebb19dF1a39195a21
Bench ledger · Stylusbenchmark twin, seeded 8 → 128 lots
0x1a337c6d48bc0d19f913d16074d362d065564f86

MOCK labeled in name and symbol

MockOraclethe mark: AMZN $412.30
0xBaDD49e6f6665Bdc90AE21EC2AAA22fD8cf52598
MockSwapfixed-rate venue at the oracle mark
0xFd7f7A2beE5F1DC47A59691bF023948567969E6a
MockUSDCthe bond's collateral
0x0E8A996DBD141352fA10940ae8045C323dC03f89

Solidity 0.8.28 · OpenZeppelin 5.4

HarvestMandateowner custody; re-validates every decision
0x15FDF1F8A537ea7e660C9867b3e5e66B0996a6E2
ExecutionRouter1 target · 1 selector · value 0
0x2a121714bEA2B69154521aEba9C5039C500c19aE
WashSaleGuardwalls the rebuy for 30 days
0x1A98594aA8dC627b34b586756833bbe508B0A29C
SubstituteMapowner-curated pairs
0x1e8Df64A7B17490dcDd4E03E695Cb1E766A37CfE
AgentBond · hardened V2redeployed 2026-09-27 · deploy tx ↗
0xBA9257cbE8Aff6c5FD091295a175DB904931e273
Bench ledger · Soliditythe control: same ABI, same integer semantics
0xa220D5B0b6E944266acd76288678e91a6BcfAAca

Real assets · keys faucet stock tokens

AMZN Stock Tokensold in beat 1
0x5884aD2f920c162CFBbACc88C9C51AA75eC09E02
NFLX Stock Tokenthe sanctioned substitute
0x3b8262A63d25f0477c4DDE23F83cfe22Cb768C93
PLTR Stock Tokenoff the map: beat 3
0x1FBE1a0e43594b3455993B5dE5Fd0A7A266298d0
Owner (Maya) · deployer
0x72cd3cB98A5d9B830b386EeBA7B2340132Ba557b
Agent session keycan call exactly one function through the router
0xF783e954a1827bD33d210Ed2d21120aC1511457E

Retired · AgentBond V1 pre-fix build · not read by any live surface

AgentBond V1retired 2026-09-27 — challenge() accepted executed/expired envelopes; agent could withdraw while active. Holds the historical beat-3 slash.
0x822fAC45a881801955b3130076A58790bBb40736

Copy puts the full checksummed address on your clipboard, exactly as committed in deployments/46630.json. The beat-3 challenger 0x0Feca08dECA807b8adF412b3DCA608eDEb4428e2 is recorded in receipts/46630.json.

Reproduce the judged path · real, no flags · DEMO.md → Reproduce

Three commands. Two need no network; one needs no wallet.

contracts/ · offline
$ cd contracts && forge test
Ran 8 test suites
81 tests passed, 0 failed, 0 skipped (81 total tests)
# incl. the -3,140.00 scenario and 3 fuzz properties
stylus/ledger/ · offline
$ cd stylus/ledger && cargo test
6 native tests on the WASM engine
# same pinned scenario: exactly −$3,140.000000
live · read-only · no wallet
$ cast call 0xEff7B46049fC677F58264e0ebb19dF1a39195a21 \
  'computeHarvest(address,address,uint256,uint256)(uint64[],int256)' \
  0x72cd3cB98A5d9B830b386EeBA7B2340132Ba557b 0x5884aD2f920c162CFBbACc88C9C51AA75eC09E02 638501157098660213 412300000 \
  --rpc-url https://rpc.testnet.chain.robinhood.com
[55, 54, 53, 52, 51, 50, 49, 48, 47]
-18321704 [-1.832e7]

The ledger answers with the next nine: beat 1 already sold lots 63–56 and part of 55. Beat 1's own picks and −24531251 are in its HarvestReport event.

Receipt block · JUDGE.md

The totals, carried down.

Tests81 + 6 — 81 Foundry (100 % line · 100 % function · 98.3 % statement · 89.2 % branch on src/, 3 fuzz properties) + 6 Stylus native
Static analysis0 · 0 — Slither: 0 high, 0 medium — docs/SLITHER.md triages all 10 remaining (Low / Info / Optimization)
Deployed6 system contracts (1 Stylus + 5 Solidity) + 3 labeled MOCKs + 2 bench ledgers on Robinhood Chain testnet — deployments/
Real-run costwhole demo incl. deploy < 0.002 ETH
Pinned scenario64 lots × 10 sh, $380→$455, mark $412.30 → exactly −$3,140.000000 on both engines
The four judging criteria · evidence, not adjectives

One page per line of the scoresheet.

ISmart contract quality

Best practices, efficient, minimal vulns.

  • 81 Foundry tests: 100 % line · 100 % function · 98.3 % statement · 89.2 % branch on src/; 3 fuzz properties; 6 Stylus native. contracts/test ↗
  • Slither 0 high · 0 medium; every remaining finding triaged. docs/SLITHER.md ↗
  • Least privilege: the agent key reaches one target, one selector, value 0, with an expiry and a daily rate limit. No path exists from the agent key to a withdrawal.
  • An audit hardened AgentBond (live-envelope-only challenges, no bond exit while the agent key is active; 8 regression tests), redeployed and proven on chain: two EnvelopeNotLive reverts. ARCHITECTURE.md ↗
IIProduct-Market Fit

A service people already pay for, missing on chain.

  • Maya is down $3,140 on paper and does nothing: banking it means picking which of 64 tax lots to sell, then policing a 30-day wash-sale calendar.
  • Wealthfront and Betterment sell exactly this service ("direct indexing") for 0.25 %/yr. On chain, none of the plumbing exists.
  • The assets are Robinhood's own testnet Stock Tokens — AMZN, NFLX, PLTR from the official faucet — on the chain that issues them. addresses ↓
IIIInnovation & Creativity

The agent's own signature is the evidence.

  • A tax-lot HIFO ledger in Rust on Arbitrum Stylus: 2.87× less L2 gas at 64 lots, 3.1× at 128, identical lotIds and realizedLoss at every size. bench/RESULTS.md ↗
  • Anyone holding an envelope the mandate must reject can slash it: 20 % of the bond, a tenth of that as bounty. Beat 3 was challenged by a key that is neither owner nor agent.
  • Arbitrum precompiles as a capability probe: ArbWasm.stylusVersion() = 3 answered "is WASM live on this Orbit chain?" in one RPC call. DX-REPORT.md ↗
IVReal Problem Solving

The rule is enforced by a revert, not a reminder.

  • The rebuy inside the window reverted on chain: WashSaleViolation(owner, AMZN, AMZN, 1792060681). beat 2 ↗
  • The mandate re-verifies signature, nonce, deadline, substitute map, wash-sale window, HIFO selection and realized loss at the oracle mark before anything moves.
  • Seven invariants (INV-1 custody … INV-7 determinism) each have a named test. ARCHITECTURE.md ↗
Honest limitations · verbatim from JUDGE.md

What it is not, before you ask.

  1. i
    Testnet only. Robinhood Chain mainnet exists; we did not deploy there (gas budget + unaudited code).
  2. ii
    The oracle mark, the swap venue and the bond's USDC are MOCK contracts, labeled in name and symbol. There is no AMM for Stock Tokens on the testnet. The assets themselves are real faucet tokens.
  3. iii
    The "substantially identical" map is owner-curated, not an oracle judgment — a wrong map is an owner risk. Map and oracle changes are not timelocked yet.
  4. iv
    Wash-sale scope: re-buys are walled for the 30 days after a harvest; the 30-day look-back before the sale is not enforced yet.
  5. v
    AgentBond was redeployed on 2026-09-27 with an audit hardening (live-envelope-only challenges, no bond exit while the agent key is active; 8 regression tests) and beat 3 was re-run against it. The pre-fix V1 (0x822f…0736) is retired and holds only the first run's slash — details and the rest of the known limits in docs/ARCHITECTURE.md.
  6. vi
    The agent is rule-v1 (deterministic HIFO + first allowed substitute). No LLM in the loop; the rationale hash commits to a plain-text rationale string. We say "agent", not "AI".
  7. vii
    The bench is worst-case for Stylus: Robinhood testnet has no ArbOS cache manager yet, so every call pays the WASM init floor. The spec had guessed ~8×; the chain says 2.9×–3.1× — we report the chain.