One signature, four coins, one buyer

1. The launch

You sign one transaction on Robinhood Chain. Inside it the registry calls the pons v2 factory, so the PONS coin exists when the transaction lands, with a fresh vault as its creator-fee recipient and a 1% creator tax. Your image is stored on chain as contract code and served from there; no pinning service is involved.

The transaction escrows one ETH slice per remote venue. A relayer sees the launch, creates the identical coin on pump.fun, Flap and Clanker with addresses derived from your launch id (so a retry can never make a second coin) and writes each address back with attest(). That releases its slice. If it marks a venue fail()ed, or says nothing for two hours, you take that slice back with reclaim().

2. Where the fees go

• PONS: the 1% creator tax accrues on the curve. Anyone can call collect() on the vault to sweep it across; the keeper does when it is worth the gas.
• pump.fun: creator fees go to the keeper's Solana wallet.
• Flap: the 1% / 1% tax goes to the keeper's BNB wallet.
• Clanker: LP rewards go to the keeper's Base wallet.

The vault on Robinhood Chain holds the PONS fees. The other three streams sit in the keeper's wallets on their own chains and are its float for remote lifts. Those wallets are visible on each venue's own contract.

3. The lift

The vault has one way to spend: lift(). The keeper calls it with three numbers, the market caps of the pump.fun, Flap and Clanker markets in ETH terms. The vault does the rest:

• It computes the PONS cap itself, from the curve's reserves before graduation and from the Uniswap v4 pool's price after. The keeper cannot misstate it.
• It takes the share per lift of its balance (25% by default), capped by the absolute cap and refused under the floor, and only once per cooldown.
• It picks the lowest cap. A remote market only wins if it undercuts PONS by more than the remote band; inside the band the vault buys on PONS, the market it can verify.
• If PONS wins, the vault buys on the pons curve (or the v4 pool) in that same transaction, with the burn address as recipient. Nothing off chain touches that path.
• If a remote market wins, the slice is released to the keeper, which buys on that venue with its local float, burns what it bought, and posts the transaction back with settle().

Every lift is an event: which venue, how much, the four caps it saw, and what was burned.

4. What is and is not trustless

• Enforced on chain: the PONS leg of the launch; the vault as the only fee recipient; the PONS cap; the share, floor, cap, cooldown and band; that money can only leave in a lift; that a PONS lift is a buy sent to the burn address.
• Trusted to the keeper: the three remote caps it reports; the remote buy and burn; the three remote fee streams. A lying keeper can misroute at most one capped slice per cooldown, to itself, and the events show it did.
• Not Anypad's to promise: a pons community takeover can redirect a coin's creator fees after pons's public timelock. No fee-recipient contract can prevent that.

5. Why no maker

A market maker that sells the expensive venue and buys the cheap one holds inventory on every chain and sells it back into your coin every time a gap opens. That is supply coming home. Anypad keeps the buy and drops the sell: the four prices are pulled together from below, by the cheapest market rising, and every lift is supply gone for good.

Launch a coin