fat0 is operated by a single solidity contract on robinhood chain and by nothing else. solidity compiles to evm bytecode and the contract enforces validation at the boundary: every instruction declares exactly which accounts it may touch and the runtime rejects everything else. the program was deployed once, its upgrade authority was destroyed in the same breath, and the bytecode that exists now is the bytecode that will exist in ten years.

robinhood chain has bonding curve tokens. robinhood chain has time locked emissions. it has never had an asset whose issuance is metered by verifiable time and deposited capital simultaneously, where the binding constraint is recomputed on chain at every mint. fat0 is the first. the time gate reads the block clock, a clock the whole network agrees on, so the schedule cannot be argued with. the capital gate reads the vault, so the schedule cannot be bought past. no token on this chain has shipped both gates in one immutable program before.

mint            erc20 mint, mint authority = curve contract, freeze authority = none
curve state     contract: genesis block, cumulative wei in, fees folded, bump
vault           contract system account, holds the eth reserve
block guard     contract per wallet: last mint block, closeable for rent back

four accounts, one of them per user and refundable. the curve state is the entire memory of the machine. there is no admin account because there is no admin instruction for one to sign.

mint: the caller sends eth, the program checks the single transaction cap, the per block capacity, and both gates, computes tokens owed along the capital curve in exact u128 integer math, takes twenty five basis points into the vault, mints to the caller through the contract, and stamps the caller's block guard. burn: the caller returns tokens, the program checks the block guard to forbid burning in the mint block, computes the eth owed along the inverse curve, takes the fee into the vault, burns the tokens, and pays the caller from the vault. close guard: destroys the caller's block guard account and refunds its rent. that is the complete instruction set. there is no fourth door.

supply cannot be minted by any key, because the mint authority is a contract only the program can sign for. accounts cannot be frozen, because the freeze authority is null. the rules cannot be changed, because the upgrade authority is null. the vault cannot be drained, because the immutable bytecode contains no instruction that moves eth out except burn. the metadata cannot be edited, because its update authority is null. each claim is a field anyone can read on chain.