How it works
The tape, the limit,
and what is proved
Plumb is a small idea with a lot of care underneath it: hold the pool's price against an outside reference, and let you trade against the reference rather than the pool.
What the tape is
Robinhood publishes Chainlink-style price feeds on Robinhood Chain for its own tokenized stocks. Each one is a contract with a description it gives of itself — Robinhood AAPL / USD, RHTSLA / USD — an aggregator underneath it, and a history of rounds you can walk backwards. They update while the American market is open, on a deviation threshold: a few minutes apart when a stock is moving, hours apart when it is not, and not at all when the market is shut.
Those feeds are not advertised in a registry, so Plumb finds them the only way this chain allows. Morpho Blue's CreateMarket events name every lending market; each market names an oracle; and the real oracles name the feed they read. Every step is then verified on chain at one pinned block.
What gets thrown away, and why
Roughly a fifth of the stock oracles on this chain do not read a feed at all — they read a Uniswap pool and present it as a price, describing themselves as Uniswap V3 Pool Price in USD. Those are useless here. Held up against the pool, such an "oracle" can only ever report that the pool is right, and the one thing a reference must be able to do is disagree. Plumb rejects them by name and counts them, so the discard is visible rather than silent. It also rejects a feed whose description does not name the stock it is supposed to price, a feed with no aggregator underneath, a redemption rate wearing a price's clothes, and any stock whose two feeds disagree by more than half a per cent.
The site reads the surviving feeds live in your browser, at the same instant it reads the pool it is comparing them with. The figures baked into the page are from the last scan and exist only so nothing is ever blank.
A limit priced against the tape
An ordinary swap protects you with slippage: a percentage below the quote you were just shown. It answers the question "did the price move while I was signing?" and no other question. If the quote itself was poor, a slippage guard will happily let it through.
A Plumb limit is an absolute price in dollars, taken from the tape. Choose a distance — say twenty-five basis points below the last print — and the site converts it into the minimum number of tokens the transaction must deliver. That minimum travels inside the transaction. Uniswap's Universal Router checks it, not this site: if the pool cannot meet it, the router reverts and you have spent gas and nothing else.
The distinction is easy to test and worth testing: the same limit at $1,000 and at $20,000 must imply the same price a share, which a percentage guard cannot do. The suite checks exactly that.
What it does not mean
A gap between the chain and the tape is not free money. When the American market is shut the feeds are frozen at Friday's last print while the pools keep trading, so a chain price above the tape may be the chain pricing the weekend's news correctly rather than pricing it wrongly. Plumb takes no view on that. It shows you both numbers, tells you how old the tape's number is, and enforces whatever price you decide you are willing to pay.
Two venues for the same share
Every stock here trades against USDG in both Uniswap v3 and Uniswap v4, in pools with different fee tiers and different depth. The two disagree constantly — by a few basis points usually, by the better part of one per cent sometimes — because the arbitrage that would close the gap has to pay this chain's fat fee tiers to do it.
Plumb quotes both, for your exact size, using Uniswap's own quoters, and sends the better one. The panel shows what the other venue would have paid, so the choice is visible rather than a claim. Pools with a hook are skipped: a hook can change what a swap does, and Plumb has not read every hook on this chain.
A switch is one transaction
Selling one stock and buying another as two transactions leaves you holding dollars in between and costs two signatures. Plumb builds both legs into a single call to the Universal Router: the shares are sold, the dollars are spent inside the same transaction, and each leg carries its own minimum. If the second leg cannot be filled at your price, the chain reverts the whole transaction and you still hold the shares you started with.
What is proved
Plumb deploys no contract, so the only thing it can get wrong is the transaction it asks your wallet to sign. That transaction is built by a single file, js/route.js, and the test suite loads that same file — so the calldata the suite proves is the calldata the page sends.
The suite is attacked on purpose
A green suite means nothing until it can be made red. Every run of the sabotage harness takes the builder, breaks it in a plausible way — the limit's sign flipped, a minimum dropped, a leg that pays the wrong party, a permit signed for everything the wallet holds — and demands that the suite fail. A break that the suite still passes is a hole, and is reported as one. A run that never finished is reported as inconclusive rather than counted as a catch, because a crash is not a catch.
What none of it covers
- The feeds are Robinhood's, not ours. They can be stale, and on a weekend they always are. They can also simply be wrong, and nothing here would know.
- A fork of a chain is not the chain. The suite proves the transaction against the real contracts and real liquidity at a recent block; it cannot prove what the pool will hold at the moment you sign.
- Tokenized stocks are not shares. What they entitle you to is a matter between you and their issuer.
- Plumb has never held a key, an allowance you did not sign, or a contract in the path of your money — and that is a statement about what the code does, not a guarantee about any chain it runs on.