A prop desk exam, paid in Bitcoin

StonkProp is a prop-trading challenge on Robinhood Chain. You buy one of 777 challenge account NFTs, in ETH, trade a virtual $5,000 account against Chainlink stock feeds under rules calibrated to kill roughly nine accounts in ten, and if you clear both phases the account becomes funded. Funded is not the finish line, it is the product: the account keeps trading, it never expires, and once $STONKPROP is trading, every week it takes a share of a cbBTC pool funded entirely by the coin's trading fees. Ticket money never funds payouts; the pool contract cannot pay out more than it holds and has no owner withdrawal for its Bitcoin.

The coin carries its own claim on that fee stream. Once the coin is live, a wallet that has held 1.5% of $STONKPROP supply for 24 hours qualifies for a cbBTC payout every 25 hours, whether or not it ever places an order, and 30% of every weekly payout goes to buying the coin back and burning it. Until the coin trades there are no fees, so nothing accrues: this is the mechanism, not a running yield.

A challenge account is an ERC-721 ticket, one of a fixed 777. All 777 were unlocked at launch and sold to the treasury; there is no open mint, and the supply can never grow, because the cap is a constant on the contract rather than a setting. Accounts change hands on the secondary market, where a 5% royalty declared through ERC-2981 returns to the treasury on every sale. The 777 are counted on their own tally rather than on token ids, because merging advances ids and must never quietly consume a ticket. Every token starts Fresh at tier 1: a virtual $5,000 account tracked in USD fixed point (1e8) by the rule engine. The money is not real. The cbBTC a funded account claims is.

Locking 2 to 5 Fresh tier-1 tokens burns them and mints one merged token of tier N, an N x $5,000 account. Only never-traded tokens can merge, and the hard cap is tier 5: a $25,000 account. The cap is arithmetic, not policy. Each account's weekly claim is capped at 10% of the epoch pool, so the expected value of size beyond tier 5 is exactly zero.

The lifecycle runs Fresh to Active at the first accepted order, then Active to exactly one of Funded, Dead (the app stamps it Blown) or Expired. Dead and Expired are terminal. Funded is not: a funded account can still be killed by a rule break, and that is the only thing that ends it. The referee is the only address that can write these transitions on-chain.

Passing phase 2 does not close the account, it opens it. On becoming funded, balance, equity, phase base and high-water mark all reset to the account's base size and the daily lock clears. The evaluation profit is not paid out; it was the exam. From there the account trades the same trailing drawdown and the same daily loss lock against its funded base, with no 30-day clock over it. A funded account does not expire.

The constants were not designed on a whiteboard. They were calibrated by Monte Carlo on real 5-minute NVDA, TSLA and SPY bars: 4,000 simulated accounts across five trader archetypes, per candidate rule set, until roughly one account in ten survived. Then the constants were locked. We own that number instead of hiding it.

The fee is the quiet killer. At 100x, a round trip costs 5 bps of $500,000 notional: $250, five percent of the whole account. That is deliberate. Nothing rewards churn here, and reckless churn feeds the floor.

Two streams of money exist and they never touch.

Stream one: tickets. The 777 primary sales, and the 5% royalty on every resale after them, go to the treasury. They fund operations. They never enter the prize pool, and no code path exists that could move them there.

Stream two: fees. $STONKPROP trades on its own pool, and the coin's creator fees accrue in ETH at the Pons fee escrow. The splitter claims them on a cooldown and cuts the flow three ways:

• 35% is swapped to cbBTC and transferred to the PrizePool. That is the traders' money.
• 15% is swapped to cbBTC and transferred to the HolderPool. That is the coin holders' money.
• 50% is forwarded to the treasury as plain ETH. That is operations.

All three destinations are immutable constructor parameters. The two giveaway legs are bounded so they can only ever grow: the pool share can never be set below 35%, the holder share never below 15%, and the two together never above 80%. The operator can pull the trigger; nobody can redirect the barrel. The splitter itself burns nothing; the burn happens at settlement, out of the traders' own pool.

The consequence is the sentence we repeat everywhere: payouts come only from the fee pools, tickets never fund payouts, and a pool can never owe more than it holds. There is no yield promise, no PnL owed, no bank run to have.

Time is cut into weekly epochs. At the close, the epoch total is the PrizePool's free balance, and it is cut in two:

• 30% of the epoch total is allocated to the BurnerVault as an ordinary leaf in the same tree. The vault claims its cbBTC exactly like any other claimant, swaps it to $STONKPROP and sends the result to the dead address. That is the buyback and burn, and it is paid out of the traders' pool, not out of fees.
• 70% of the epoch total goes to the funded accounts that made a profit that epoch, pro-rata by that profit. An account's profit above its funded base is its claim basis; the biggest basis takes the largest share, in proportion, down the list. Afterwards every funded balance resets to base, which is how a prop desk pays out.
• No single account may take more than 10% of the epoch total. The cap is not decoration: pure pro-rata by profit is hedgeable, and two funded accounts, one long and one short, would otherwise manufacture unbounded profit on whichever side won and drain the pool. Cap overflow and rounding dust roll into the next epoch.

Read the arithmetic carefully, because it is the whole difference between a prop desk and a promise nobody can keep. Nobody is ever owed their PnL. Your claim is a share of the week's pool, proportional to what you made, and the pool only ever pays what it holds. The sum of every leaf, the burner leaf included, can never exceed the epoch total.

The result is encoded as an OpenZeppelin standard merkle tree over (epochId, claimant, amount) and the root is posted on-chain with the epoch total, which must fit inside the pool's free balance. One root per epoch, immutable once posted. Winners claim directly from the contract with their proof, once per epoch per address. The per-epoch trade log that produced the result is published alongside the claim file, so anyone can recompute the tree from the raw fills.

The 15% holder leg is the second reason to own the coin, and it does not require you to trade at all. It accrues as cbBTC in the HolderPool and pays on its own clock.

Eligibility is deliberately unfriendly to renters. At the snapshot a wallet must hold at least 1.5% of total supply and must have held that much continuously for 24 hours. Supply is forced to one billion tokens by the Pons launch config, so the threshold is 15,000,000 $STONKPROP. Any dip below the line resets the clock to zero, so a balance flashed in for the block of the snapshot earns nothing.

Holder epochs close every 25 hours, not every 24. The extra hour walks the snapshot around the clock instead of parking it at the same minute every day, so no timezone gets to camp the moment. Eligible wallets split that epoch pro-rata by balance, posted as a merkle root on the HolderPool and claimed with a proof, once per epoch per address. The HolderPool is the PrizePool's twin: no owner withdrawal of cbBTC, rescue refuses the asset, and each epoch is bounded by the free balance.

So the coin has two claims on the same fee stream. The direct one is cbBTC every 25 hours. The indirect one is the burn: 30% of every weekly trader payout comes back to buy $STONKPROP and destroy it.

One server process is the sole writer of account state. Inside it, the roles are strict:

Orders are signed messages, not transactions: no gas, but the server verifies the signature recovers the NFT owner. Every order fills at the next oracle tick after placement, never the tick you can see. Front-running the feed therefore earns nothing: by the time you observe a price, the earliest fill you can get is the one after it, and the oracle gate rejects orders whenever the feed is stale or the market is closed.

The engine is centralized. So is every prop firm that has ever existed. The difference here is verifiability: the trade log is published per epoch, the claim tree can be recomputed from it, and the claims themselves are trustless against an immutable root. You still trust the engine to run the rules honestly between settlements.

The pool breathes with the coin. The pot accrues from $STONKPROP trading fees and is held in cbBTC. Thin volume means a thin pool; a falling Bitcoin price shrinks the dollar value of winnings. Nothing is owed, so nothing can default, but nothing is guaranteed either.

Oracles freeze. Chainlink feeds go stale outside market hours and can hiccup inside them. The engine fails closed: stale feed, no fills. During the evaluation your 30-day clock keeps running through weekends and freezes alike. That is a real cost and it is priced into the calibration. A funded account has no clock to lose.

Funded is not tenure. The funded stage removes the expiry, not the risk. The trailing drawdown and the daily loss lock apply exactly as they did in the exam, measured against the funded base, and touching the floor kills the account for good. Weeks with no profit simply pay nothing; there is no salary and no drawdown against the house.

Everything below is on Robinhood Chain, chainId 4663. This paper describes the rules as they are coded and the contracts as they are deployed. The six project addresses are read live from the API, so an address appears here the moment its contract is live and carries the stamp until then.