Four parts. One direction of travel.
ARCH is not a treasury with a policy. It is a set of Robinhood Chain programs whose only legal moves are the ones described here. This page is the mechanism; the Archpaper is the argument.
Burned by the Buttress and by claims. Supply only goes down.
Leaves in exactly one way: a holder burns ARCH for their share. No admin key.
Buys ARCH during 30%+ crashes, burns 100% of it. Cannot be withdrawn.
Splits all incoming revenue 50 / 40 / 10. Anyone can trigger distribution.
The allocation engine
Revenue arrives from creator fees on the ARCH venue, or from anyone topping the machine up with ETH directly. The Keystone does not decide anything — it applies a fixed ratio and nothing else.
- 50%Vaultclaimable ETH backing
- 40%Buttressbuy-and-burn ammunition
- 5%Communitygrowth and incentives
- 5%Operationsdevelopment and infra
Permissionless distribution. Once revenue accumulates, any wallet can call the distribute instruction and the split executes. The team cannot sit on undistributed funds, because sitting on them is not a privilege the program grants anyone.
Backing with exactly one exit
The Vault holds the ETH that backs every circulating ARCH. It has a single outbound path, and that path belongs to holders.
| Exit path | Burn ARCH → receive V × B / S, minus a fixed 1% that stays inside. |
| Admin key | None. There is no owner instruction that can move Vault ETH. |
| Pause | None. Claiming cannot be halted, throttled, or queued. |
| Borrowing | The Buttress has no instruction that reads or debits the Vault. |
| Ratio direction | Revenue in, supply down, fees retained — one direction only. |
An emergency switch must never become a way to freeze or seize holder backing, so there is not one. The trade-off is deliberate: the Vault gives up the ability to be rescued in exchange for the guarantee that it cannot be captured.
Ammunition that cannot be farmed
A bid that is permanently parked is a target. The Buttress is awake continuously but commits only on real damage — measured against a slow-moving, time-averaged reference that a single trade cannot move.
Velocity can scale a shot up to 2× on top of this curve, but never past the 2.50% per-shot cap and never below the gate. Under guarded launch the whole curve is halved.
Untrusted automation
Off-chain automation may propose a shot. The program re-derives the drawdown, the velocity multiplier, the cooldown and every cap on-chain before spending a wei. A lying proposer gets a failed transaction.
Impact-capped execution
A shot is additionally bounded by roughly 4% of pool liquidity, so the Buttress can never move price against itself or hand a sandwich to whoever is watching the mempool.
Everything is burned
There is no Buttress instruction that transfers ARCH anywhere except the burn. The tokens it buys stop existing in the same transaction that buys them.
What a timelock cannot reach
Adjustable parameters — shot sizes, cooldowns, caps — are owned by a 24-hour timelock, so every change is public a full day before it can execute. These four are not parameters.
- 01Vault ETH can never fund the Buttress.
- 02Buttress ETH can never reach the team.
- 03Everything the Buttress buys must be burned.
- 04The claim formula is fixed forever.