Everything that can go wrong.

A call pays only when its averaged settlement price finishes above its strike. Most options expire worthless. A correct forecast about the stock can still miss the strike or the expiry.

A quoted ask may disappear or have too little size. A bid may not exist when you want to sell your option before expiry; crossing a thin spread can cost much of the premium.

The v2 settlement oracle uses an averaged price around 16:00 New York time. Most markets in the approved 20-market launch use one source: the oracle records a candidate, waits one hour and lets the guardian hold it. Dual-source markets can finalise immediately only when both sources agree; their own configured delay applies when one is missing or they disagree.

An in-the-money call is owed Stock Tokens. Most markets in the approved launch have no qualified USDG conversion route, so they pay those Stock Tokens in kind. A routed market attempts bounded USDG conversion and falls back to Stock Tokens if the route fails or misses its limit. An issuer transfer freeze can leave an internal ledger balance until withdrawal works.

A filled call gives its buyer the gain above the strike. In the replacement design, the writer receives the sale premium less the 5% first-sale fee, but gives up that upside on the amount sold. Settlement returns the remaining Stock Tokens as a net-share amount; it is not simply all shares back or a full cash sale.

The replacement design takes 5% from the premium when a newly written option sells. A true resale of an existing long is 0%. The collateral-based rate for new series launches at 0 ppm.

Smart pricing is optional. When a writer enables it, the PRICER may replace a live ask, but AutoRoller rejects a price outside the writer's inclusive minimum and maximum ask band. A replacement keeps the remaining size, series and expiry unchanged. The role cannot move collateral, and an in-the-money ask is not repriced.

Snapshotting prices, finalizing settlement and redeeming holders require transactions. A cranker can automate them and advance auto-roll strategies, but no cranker has an exclusive settlement privilege: anyone may call the public functions, pay gas and submit the transactions.

The finalized price controls both long and short payouts. The replacement design separates fee, configuration, listing, treasury and guardian powers into scheduled role lanes; it is not active before broadcast. General fee and role changes wait 48 hours, while exercise and collateral-rate changes wait 72 hours. The guardian can pause new risk and veto a single-source result.

STONKHOUSE is deployed at 0xc252…D5C4 (opens in a new tab). Stonkhouse does not control the third-party token contract, launchpad or trading venue. Venue fees can change, and thin liquidity can increase price impact or leave no practical exit at the size you want.

No independent STONKHOUSE time-weighted average price has been identified. A quote or median from the same pool is not independent price evidence.

Premium is paid only if a buyer fills. Your listed lots sit on the app's book, and any Seaport 1.6 client can fill the same orders. If nobody buys before the book closes at Friday 4:00pm New York — or Thursday when NYSE is shut that Friday; the call's own exercise time is what counts — that week's premium is zero. Calls are written only when bought, so nothing was written.

This is the most likely outcome on a thin book, and the book for weekly calls on a tokenised stock is thin. The listing is not shown on any third-party venue: a buyer has to come to it.

Each account re-checks its premium floor and the lower bound of its strike band at the spot of every fill, not at the spot the week was priced on. If NVDA rises and the listed ask falls under the floor, the fill reverts. If NVDA rises until the strike is less than 3% above spot (the band's lower bound under the current policy), no new ask fixes that: nothing more can be sold from that listing.

On week 1 (strike 223 USDG, ask 1.000000 USDG), fills are refused at any price once spot passes about 216.50. At the current premium floor of 0.40% of spot, that listing's ask is not what binds first.

Anyone holding a call of your option type may exercise it inside the exercise window (Friday 4:00pm to Saturday 4:00pm New York), plus a few seconds of offset unique to your account. Valorem takes the collateral at the strike and leaves the strike proceeds in USDG in your account, with no protocol fee. Premium from those lots is already in your wallet. The keeper sets the strike about 5% above spot, and the factory refuses a list outside 3% to 12% above spot. It takes a move, but not an enormous one.

A buyer can exercise some of the lots they bought from you and let the rest expire. You can end the week with a mix: some NVDA back, some strike USDG, plus the premium already paid on every sold lot.

Depositing while a week is listed does not put the new NVDA up for sale. New tokens sit idle. What you already listed is pinned: strike, ask, exercise and your expiry cannot move if the keeper sets a later week. You cannot change how many lots you offered while listed.

Idle NVDA can leave at any time. Lots you listed are reserved until a fill takes them or until someone settles after your expiry. There is no share token and no redeem queue.

Plenty of products make an empty week look survivable by paying it in a protocol token. Stonkhouse has a token, but a legacy account week is not subsidised by it. You keep the ask less the protocol fee (5% today; the admin can set it anywhere up to 20%), and that is the entire return path.

Stock Tokens are debt securities issued by Robinhood Assets (Jersey) Limited. They are not shares: no vote, no claim on Nvidia, and issuer credit risk on that entity. The issuer can freeze or restrict transfers, blocklist your account, burn tokens from any holder including the account, and upgrade the token contract, each from a single key with no timelock. The token can also pause its own price oracle, and the issuer can end the series on 30 days' notice, after which the tokens can be redeemed only with identity checks an account cannot pass.

The events are different. A freeze stops anything that moves the token, including selling a call, a withdrawal and the NVDA leg of settle. An oracle pause stops new lists and fills, and nothing else: settlement never reads the oracle, so an open week can still settle. A burn takes NVDA out of the account outright.

Premium and strike proceeds are paid in USDG, a third-party stablecoin issued by Paxos, so you carry whatever risk USDG carries. One Paxos key, with no delay, can pause USDG, freeze any address, wipe the balance of a frozen address, and in two transactions burn USDG from any address that is not frozen. The same key proposes and executes upgrades to the token behind a 24-hour timelock that Stonkhouse does not control. It has frozen addresses on this chain and, so far, has never unfrozen one.

Settling a written week asks Valorem to hand back the account's claim: the unassigned NVDA and the strike USDG, in one call. Either token's issuer can make that call fail. When it fails, settle still clears the listing and leaves the claim in place. The claim is stranded.

Valorem Clear can charge 15 bps of written notional, paid in NVDA from the account's balance on top of the collateral each time a fill writes a lot. It is off today. Stonkhouse settles on its own instance of Valorem Clear, whose fee switch is held by a Safe with a single owner and a threshold of one, not by the factory admin; the factory refuses to list or fill through the fee until admin separately accepts it. On a weekly out-of-the-money call that is not small change: the premium floor is currently 0.40% of spot, so 15 bps of notional is a large fraction of a listing priced at the floor.

Robinhood Chain runs a single Robinhood sequencer and has no uptime feed for the factory to read. The sequencer also screens transactions, and one that touches a restricted address is dropped; if an account itself were restricted, nothing could reach it. Forcing a transaction in through Ethereum takes 4 days, and may not escape the screening either. The NVDA price feed updates through the week, overnight included, and stops from the Friday close to Sunday evening New York time and over US market holidays; a gap longer than the factory's price-age limit (4 days today; the admin can set it from 1 hour to 7 days) blocks listing and selling until the feed updates.

The keeper prices each factory week from spot. If the feed cannot be read when the week is due, the keeper sets no week rather than guess a price.

Live lots are shown on the app's book. If the app is down in the hours before the close, buyers have no page to fill from, though the orders still exist on Seaport.

The Stonkhouse contracts are live and have had no external audit. What stands behind them is a test suite and internal reviews by the team that built them. An internal audit on 2026-09-13 found that the earlier pooled vault wrote calls before selling them; the design was changed to write only inside a fill. Isolated accounts inherit that rule, plus a unique option type per account. Those reviews were of the vault, not a substitute for an audit of the live factory.

The factory clones a locked implementation. Valorem Clear is not source-verified on any explorer yet; its deployed bytecode is identical to Valorem's published code except for the metadata hash. Valorem Clear's code was audited by Zellic in 2022–2023 under its former name, OptionSettlementEngine; that audit covers Valorem, not this factory. Valorem's code has had no commit since 2023, so there is no patch path behind it. Seaport, USDG and the Stock Token are third-party code outside anyone's control here.

The keeper is one hot key. It can crash, run out of gas money, or be looking the wrong way when the week should be set or your lots listed.

Assume the keeper key is stolen outright. The attacker can set the week's strike and ask, and list lots you already requested. Every list still goes through the account, which checks the strike band, the premium floor, the lot size and the compiled window limits.

The factory admin sets policy inside compiled caps: the strike band, the premium floor, the utilisation ceiling, the protocol fee, the lot cap, the deposit cap, the price-age limit, the fee recipient, and whether to accept Valorem's engine fee (the switch that turns that fee on is held by the Clear's one-owner fee Safe, not by the admin). It can appoint the keeper and the Guardian. Today the admin is a single hot key, and the protocol fee is paid to that same address. There is no timelock and no delay. A handover of the admin role to a Safe is planned and has not happened.