Give someone
a share.
Seal a tokenized share behind a single-use key. That key lives inside a link. Whoever opens it takes delivery — no account, no email, nobody sitting on the shares along the way.
A standalone ERC-20 on Robinhood Chain — no owner, no mint, capped supply. The escrow never touches it, and owning one earns you nothing on the other. Explorer
“to start your first portfolio”
Steps to deliver
Seal, send, claim. One of those three never hits the network.
Contract tests
Among them the mempool attack this whole design is built to block.
Ways we can seize it
No owner, no pause, no upgrade path, no fee. None of it is in the bytecode.
Not a mockup.
A live app sits behind this, connected to the escrow on Robinhood Chain. Choose a share, set an amount, and it returns a URL — against the real contracts, signed by your own wallet.
- Escrow
- 0x17793d…6C6E60
- Chain
- 4663
A bearer bond belongs to whoever is holding the paper. That is a terrible property for paper and a natural one for a URL.
Lock01
The escrow takes the shares while your browser mints the key
You approve the escrow and it pulls the shares into the custody of code. At that same instant your browser creates a fresh key pair — the public half turns into the certificate’s serial number, the private half turns into the link.
Send02
The secret rides in the one part of a URL that never gets sent
Drop it into any messenger. The key sits after the “#”, which browsers never forward to a server. It is absent from our logs because it has to be — there is no server to log it, and nothing hits the chain while the link is in transit.
Claim03
The link signs the recipient’s address and the escrow lets go
Whoever holds the link opens it and supplies an address. The key signs that address, the escrow verifies the signature against the serial number and releases. The key is then destroyed for good — one link, one claim.
Five properties, and one of them is the entire point.
A copied link cannot be stolen in the mempool
The escrow never takes the secret — it takes a signature over the recipient’s address. Anyone who copies a pending claim and drops in their own address gets a rejected signature. Claim links built on a bare hash preimage break right here, and they break silently.
The recipient signs up for nothing
No email, no account, no session, no app to install. They open a URL and connect a wallet — that is only how they tell the escrow where to send the shares.
You can still back out
As long as nobody has claimed it, the issuing wallet can reclaim the shares in a single transaction.
It is not really about stocks
The escrow is token-agnostic: any ERC-20, any amount. It points at Robinhood’s tokenized equities only because those are the ones live on this chain — the contract itself has never heard of them.
Anyone can relay a claim
The signature alone decides where the shares land, so an outsider can cover the gas without being able to reroute delivery.
Every extra rides inside the link.
None of these reach the escrow. They sit in the slice of the URL that never gets to a server, which is why they are free and why the contract never had to change to permit them.
- Wrapped as a giftA sealed envelope they tear open
- The certificate turns up folded inside an envelope with a wax seal over it, and stays out of sight until the recipient cracks it open — the way a bearer instrument once changed hands. Add a name and the envelope shows who sent it. This is the style of delivery, not a lock: the shares are claimable the instant the link is held. The lock is the access code.
- An occasionBirthday, congratulations, thank you
- Sets what the claim page opens with, plus the line on the envelope if you send it as a gift. Cosmetic — the shares are identical either way.
- An access codeTwo channels, not one
- Your browser encrypts the key before it goes into the link, so the URL carries ciphertext and the recipient is prompted for a code. Until it unlocks, the page reveals nothing — not the amount, not the sender. Anyone with the link can still brute the code offline, so the idea is to send the link and the code by separate routes.
- How it opensRise, engrave, or stamp
- Pick what the recipient sees as the certificate appears. Engrave traces the guilloché line by line, the way a plate is cut. It rides in the link, so it is free and never touches a contract.
- A line on the certificatePrivate by construction
- A brief note printed on the instrument. It rides in the same fragment as the key, so it never reaches a server and never lands on chain — free to add, and as private as the link itself.
- A gas stipendSo delivery is not a bill
- Attach ETH that is released alongside the shares. It refunds the claim rather than prepaying it, because gas is billed before the transaction runs — a truly empty wallet still needs someone else to broadcast, which the claim page helps arrange.
- Your address, or notCosmetic, and we say so
- The certificate can omit the issuing address from its face. That changes the print and nothing more — the transaction that made the link is public regardless, and anyone can read the sender straight off the chain.
- A QR codeFor passing one over in person
- The exact URL, fragment included. That is the warning as much as the feature: a photo of it is the shares.
What this is not.
- Unaudited
- The contracts are deployed and unreviewed. 28 tests pass, covering the front-running attack and a fee-on-transfer token, but tests are not an audit.
- These are real tokens, and we are not Robinhood
- The shares in the picker are Robinhood’s tokenized equities on this chain, read from their own contracts. sendInvest has no affiliation with them and adds nothing to them — it escrows an ERC-20 and returns a URL. Demo tokens are provided for anyone holding none.
- Whoever holds the link holds the shares
- That is the design, and it works both ways. A link forwarded into the wrong group chat is claimable by everyone in it. Treat it like cash in an envelope.
- The claimer still needs gas
- The stipend is a refund, not a prepayment — it lands in the same transaction the recipient pays gas for, and gas comes first. A wallet with nothing in it needs someone else to broadcast the claim, which the claim page helps with.
- No relayer is running
- Anyone can submit a claim on someone else’s behalf; nobody runs it as a service.
Fair ones.
What stops you from taking the shares?+
The escrow has no owner, no pause, no upgrade path and no setter of any kind — not by pledge, but because none of those functions exist in the bytecode. Tokens leave in exactly two ways: a valid signature from the link’s key, or the original sender reclaiming them.
Where does the private key live?+
In the URL you copied, and nowhere else. Your browser generates it the moment you mint the link and it never crosses the network. That is also why we cannot recover it for you — if the link is lost before a claim, reclaim the shares and mint a new one.
Can two people race for the same link?+
They can try. The first valid claim mined wins and the key is burned; every later attempt reverts. There is no partial claim and no second draw.
Why does the claim sign my address?+
Because the alternative leaks. If the escrow just took the secret, it would show up in the pending transaction and any onlooker could front-run the claim with their own address. Tying the signature to the recipient makes an intercepted claim useless to whoever grabbed it.
What does the access code really guard against?+
Someone glancing at the link. Not someone who holds it and is set on breaking in. The key is encrypted under the code with 310,000 rounds of PBKDF2, so guessing is slow rather than impossible — a four-digit PIN is a speed bump, a passphrase is a lock. Done right it is a second channel: the link by one route, the code by another, neither enough on its own. Lose the code and the shares stay out of reach until the sender reclaims them.
Does the note go on chain?+
No. It is base64 in the same URL fragment as the key, so it is as private as the link itself and free to add.
Which shares are these, exactly?+
Robinhood’s tokenized equities on chain 4663 — NVDA, AAPL, TSLA, MSFT, GOOGL, AMZN, META, COIN, SPY and QQQ — read from their own contracts. Several look-alike contracts reuse those tickers, so every address here was matched against the one carrying the market price. Pick “Other” to send any ERC-20 instead; the escrow credits whatever actually lands, so a token that skims on transfer escrows the amount truly delivered.
Hand over one share.
One transaction, one URL. Whoever is on the other end needs nothing but a wallet.