Everything, documented.

• Pause. Pausing the bot contracts stops the keeper's trading entries. Pausing the fee router goes further: it stops every swap through it, which includes the sell leg a bot needs to close a position into ETH.
• What pause never does is block a withdrawal. stop, cancel, withdraw, refundExpired, withdrawEth and Predict's claim carry no whenNotPaused — verified function by function against the deployed sources. With everything paused you can still take your position back in kind: the tokens and ETH as they stand, without selling.
• Call rescue(token, to) on the surplus only. It is arithmetically capped at balanceOf(this) − escrowed[token] — the amount above what users deposited. If that surplus is zero it reverts with NothingToRefund.
• Change the fee band for new bots, orders and market swaps. Read on-chain today: minFeeBps = 90 (0.9%) and maxFeeBps = 200 (2%). The owner can move both, but setMaxFeeBps carries require(b <= 300), so 3% is an absolute ceiling that cannot be raised without deploying a new router. The Desk itself charges 1% and the page refuses anything higher.
• Change the referrer share. It is 3000 (30%) today and the only guard is require(b <= 10_000) — so the owner can set it to 0% for future fees. Already-accrued referral balances stay claimable. Treat 30% as current policy, not as a guarantee.
• Redirect the treasury for future fee accrual. Fees already accrued to the old address stay claimable by that address.
• Transfer ownership, in two steps (transferOwnership → acceptOwnership, with a zero-address check).
• On Predict only: repoint the oracle. setOracle(address) changes the contract that decides which side of every future round wins. This is the strongest owner power anywhere in the ecosystem — an owner who points it at a contract they control decides who wins, and therefore where the pot goes. It does not reach a round that has already settled, and it cannot touch a stake in the ledger, but it is the one power for which "trust the operator" is the only protection. The current oracle is bounded by Chainlink; a replacement need not be.
• On Predict only: change the fee, within hard-coded constants (MAX_FEE_BPS = 500, MAX_REFERRAL_BPS = 5000) and only while the game is paused.
• On the OTC Desk only: set the fee for future fills up to a hard-coded ceiling of 1% (MAX_FEE_BPS = 100), allow or disallow a quote asset for new offers, name the address that may flush accrued USDG fees into the burner, pause new offers and fills, and rescue only what sits above escrow plus accrued fees. Cancel never pauses, the fee destination (the burner) is immutable, and there is no path from an owner function into an offer's escrow.

• Move your escrow. There is no code path from an owner function into user balances.
• Redirect a withdrawal. Payouts go to the maker address stored at creation. There is no setter for it.
• Upgrade the contracts. No proxy, no upgrade mechanism. What is deployed is what runs.
• Raise the fee on a running bot. The rate is written into the bot's record at creation; a later default change does not reach it. Limit orders carry their fee inside the signature.

The keeper is the off-chain process that executes bots. It runs on its own key (0x96D0B800…59246c) and owns nothing. Its entire power is "call the execute function on a record that already exists". Everything about what that execution may do is enforced by the contract:

• It cannot sell a grid level at a loss — the profitable spacing is checked on-chain per level.
• It cannot pick its own route on a limit order — the route is committed inside your signature as bytes32 routeHash, and execute() reverts with BadRouteHash otherwise.
• It cannot beat your minimum — output is measured as the balance delta of the destination and compared to minAmountOut, not taken from what the pool claims.
• It cannot route you through an arbitrary V4 hook — key.hooks must be address(0) or explicitly allowlisted.
• It cannot make the router free for itself — minFeeBps = 90, and it reverts FeeTooLow() below that.
• It cannot take custody. It never holds your funds at any point.

Its failure mode is inaction, not theft. If it goes down your bot freezes mid-strategy: no buys, no sells, no take-profit, no stop-loss. The money is safe; the stop you were relying on is not. What to do →

• Real Yield Staking v2: the owner is the NLYRA treasury. It can pause new activity for at most 30 days (the pause expires by itself, and claims and withdrawals keep working) and it can point the Pons fees back to the treasury. It cannot move staked funds, take rewards, change rates, tiers or cooldowns, or alter anyone's position — as the Coinsult audit confirms. The fee splitter and the position market have no owner.
• $NLYRA staking v1: confirmed against the deployed bytecode — it is the Uniswap fork of StakingRewards, and it has no owner, no pause and no recoverERC20. The 322M staked cannot be swept by an admin, and the reward pool is funded to the wei. The only role is rewardsDistribution, which funds reward cycles.
• The one caveat on staking, named: because the staking token and the reward token are the same, notifyRewardAmount counts the contract's whole balance as backing. So the rewardsDistribution address — a single wallet, 0xe30647…e04C, with no setter to rotate it — could mark user principal as payable rewards. That is not an atomic drain: it would play out slowly and entirely in public. It is still a trust assumption and you should know it exists.
• DEX (V2): the protocol fee switch — 0.05% of swap volume to the treasury, active from day one. Trading cannot be paused, tokens cannot be blocked, pool funds cannot be touched.
• DEX (V3): a share of pool fees to the protocol, and the owner can create new fee tiers. Positions and liquidity cannot be touched.
• Launchpad v4: exactly one power — adding (or closing to future launches) approved trading pairs. It has no code path to an existing pool, position or fee split.

Two of these are confirmed by on-chain reads: the staking contract's rewardsDistribution is 0xe30647…e04C, and the Holder-Rewards launch factory's keeper is the ops hot key.

Several contracts are redeployments of code that has years of production history elsewhere:

• The $NLYRA staking contract is Synthetix StakingRewards — the same design Uniswap used for UNI liquidity mining in 2020.
• The V2 DEX is Uniswap V2 (Factory + Router), with the one hash constant every V2 fork must recompute.
• The V3 side is Uniswap V3 deployed from the official npm artifacts (v3-core 1.0.1 + v3-periphery 1.4.4).
• The Shield circuits come from the 0xbow Privacy Pools project (Apache-2.0).

An audit of the upstream project is not an audit of our deployment. It says the design is well-studied; it says nothing about the deployment parameters, the wiring, or the code we wrote ourselves around it.

The 0xbow Privacy Pools circuits are genuinely audited — upstream, by their authors' auditors. Our PrivacyPoolComplex wrapper around them is not, and our Shield entrypoint is an upgradeable proxy. That distinction is the whole point.

• Smart-contract risk. Apart from Staking v2, unaudited code — and an audit lowers the risk, it does not remove it. Do not deposit what you cannot afford to lose.
• Keeper risk (bots only). If the keeper stops, your bot freezes: no take-profit and no stop-loss. Your money is safe; your risk management is not.
• Escrow risk (bots, ladder, martingale, Predict). Funds sit in a contract, not your wallet. A bug in that contract is a bug that reaches your balance.
• Market risk. Self-custody is a guarantee about access, not about price. A grid that bought all the way down hands you back exactly that: a losing position.
• Hostile-token risk. Transfer taxes, blacklists and mint switches live in the token contract, which we do not control. The SAFE verdict is a filter, not a promise.
• Escrow and hostile-token risk on OTC. An offer sits in the OTC contract until it fills, is cancelled or expires. The escrow says nothing about the token itself: a honeypot, a blacklist or a transfer tax lives in the token contract, and what reaches the buyer is what that token lets through. Read the verdict on the card before you fill.
• Impermanent loss. Providing liquidity to a volatile pair can underperform simply holding.
• Key risk, yours. The maker address is permanent. Lose the wallet, lose the bot — there is no recovery path and we cannot build one.
• Key risk, ours. Contract ownership sits on single hot keys. What those keys can do is capped by the contracts; there is still no multisig in front of them.
• Concentration risk on $NLYRA. The creator wallet holds about 4.7% of supply (roughly 47M NLYRA) and can sell it at any time. It is a public balance you can watch.
• Predict oracle risk. The owner can repoint Predict's oracle for future rounds. See §3 · Admin powers.
• Phishing. The only official site is nlyra.xyz. We will never DM you first, never ask for your seed phrase, and never ask you to "validate" your wallet. The app only proposes transactions — read what you sign.

• Check the approvals you are asked to sign. Every approval the site requests is for an exact amount to a pinned contract — there are no infinite approvals anywhere in the front end, and the page refuses any spender that is not the escrow it expects. Read the amount in your wallet dialog and confirm it matches what you typed.
• Open any address above → Blockscout → the Contract tab → read the verified source.
• On a bot contract, open Read Contract and check the maker address on your own bot id, then Write Contract and call the withdrawal function — that is the whole rescue path, no website involved.
• Paste any of our own contracts into the scanner. We are held to the same verdict machine as everyone else.

You are almost certainly in Safari or Chrome. A wallet app's keys are not reachable from the phone's normal browser, so there is nothing for the page to connect to.

Open nlyra.xyz inside your wallet app's own browser — every major wallet has one (MetaMask → Browser, Trust → DApps, Coinbase Wallet → the compass icon) — and connect from there.

The same applies to Blockscout's write forms if you ever use the self-withdrawal path: open that link inside the wallet app too.

The site uses injected wallets only — MetaMask, Rabby, or a wallet app's built-in browser. There is no WalletConnect and no e-mail login. Install one, or open the site inside your wallet app.

Usually a locked wallet or a site permission that was revoked. Unlock the wallet, then in the wallet's Connected sites list remove nlyra.xyz and connect again from scratch. In MetaMask a hard reset of the account's transaction cache (Settings → Advanced → Clear activity tab data) also clears a stuck nonce.

Your wallet is on another network. The site offers to switch, and to add the network if you do not have it. If your wallet refuses the automatic switch, add it by hand with the exact settings in §1 · Add the network — chain id 4663.

Every transaction re-checks the chain before it is built, so a wrong-network transaction cannot be signed by accident.

Your ETH is on a different chain. ETH on Ethereum, Arbitrum or Base is not ETH on Robinhood Chain — it has to be bridged onto this chain first. §1 · Get gas lists the three routes in.

This is the single most common thing that stops a new user. Check the network name in your wallet before assuming anything else is broken.

Try the chain's public RPC directly: https://rpc.mainnet.chain.robinhood.com. If your wallet has a custom or stale RPC saved for chain 4663, delete the network and re-add it with the official settings. If Blockscout also looks stale, the chain itself is having a moment — nothing you sign in that state will be lost, it just will not confirm.

No. A reverted transaction does nothing at all — it is as if it never happened, except that you paid the gas (about $0.007).

The usual cause is the price moving past your slippage between pressing the button and the block landing. Try again, or raise slippage a step. On a fast-moving token 3% is often not enough.

Blocks on this chain are about 100 ms, so a genuinely pending transaction is rare and usually means a nonce gap: an earlier transaction from the same wallet is stuck in front of it. Open your wallet's activity list, find the oldest pending item and either speed it up or cancel it — everything behind it is waiting on that one.

Paste the hash into Blockscout to see the truth. The explorer is the record; the site's UI is only a view of it.

A safety check caught a mismatch between the transaction the server built and what is on your screen, before your wallet was opened. Nothing was signed and nothing was spent.

It checks the destination contract, the chain, the tokens, the amounts, the minimum output, the fee and the referrer — against the raw calldata, not against the server's description of it. Re-quote and try again. If it persists, something is genuinely wrong and you should not push through it — report it instead.

The fresh quote differs from the one you were shown by more than 3%, so the trade was stopped before it reached your wallet and the panel repainted with the real number. You are never asked to sign a trade whose terms changed after you decided.

Three possible reasons, in order of likelihood: price impact (your own order moved the pool — the quote line shows it from 1% up), a hook pool (some V4 pools take an extra 1–2% on every swap; it is measured and already inside the quote), or a transfer tax in the token itself. Full breakdown →

Bots are executed by the Keeper, an off-chain process. When it is down the bots hub shows a keeper offline tag. In that state: no buys, no sells, no take-profit and no stop-loss.

Your money is safe and withdrawable regardless — withdrawing does not need the keeper, the server or the website. But the protection you were relying on is not there. If you were counting on a stop, withdraw and manage the position by hand.

Stop losses are executed by the keeper, not triggered by the contract on its own. If the keeper was down, nothing fired. This is the honest limitation of every automated exit on the platform.

The price has left the range you set. Above it, everything was sold and the bot is sitting in ETH. Below it, everything was bought and you are holding the token at a loss. Neither state loses your money by itself — you can stop the bot at any moment and take back either side. What you lost is the opportunity. Infinity Grid has no upper bound, which is why it is the better choice when you have no view on the top.

The configuration cannot make money. A grid pays the 1% fee on both legs plus the pool fee twice, so levels closer together than about 2.5% net are guaranteed to lose. The rejection names your exact number and the maximum grid count for your range. Widen the range, use fewer grids, or pick a cheaper pool. The contract enforces the same floor independently, so it is not a setting anyone can waive.

What is enforced is the minimum output you signed, not the price you typed. If liquidity thinned, the pool can print your price without being able to pay your minimum at your size. Other possibilities: the order expired, your balance or Permit2 approval changed after placing it, or the keeper was down. A FAILED row carries the reason.