Kiln ($CLAY) Documentation

Overview

Clay StonKz (CLAYZ) is an existing 6,969-supply ERC-721 collection on Robinhood Chain. Kiln ($CLAY) is a new token built to give that collection an on-chain revenue engine: every taxed trade of $CLAY feeds a Treasury that buys CLAYZ NFTs off the floor, holds them, generates yield on its idle stablecoin, and permanently burns a slice of supply — all without any wallet ever being able to sweep the money out.

The system is three contracts deep, each with a narrow job:

KilnToken   — fixed-supply ERC-20, fee-on-transfer, no owner, ever
KilnLauncher — one-shot: seeds the Uniswap V2 pool, flips trading on
KilnTreasury — receives the fee, splits it 60/30/10, holds NFTs, runs redemption

Everything that can move funds is either fully permissionless (anyone can trigger the accounting) or gated behind a 48-hour Timelock controlled by a Gnosis Safe — never behind a single key that can act instantly.

Tokenomics

Fixed supply of 1,000,000,000 $CLAY, minted once, forever. There is no mint() function anywhere in the contract — supply can only ever go down, via the Treasury's burn leg.

Trading fee

The fee applies only to trades against a registered AMM pair — never to a plain wallet-to-wallet transfer, staking, or moving tokens into the Treasury itself.

Where the sell-side fee goes, by market-cap tier

The team's share (TEAM_WALLET, immutable) shrinks as the project succeeds — the freed-up share always flows straight to the holder pool. Tiers are reversible in both directions, driven by a rolling 30-day average market cap (not spot price) with a 30-day minimum dwell per tier, so a short spike or dip can't flip the tier back and forth.

Below $200k, every basis point of the sell-side rebate goes straight to holders — the team takes nothing until the project is genuinely established. LP always keeps 0.6% (buy) / 1.0% (sell), unaffected by tier.

KilnToken also has a second, immutable wallet slot (BRRRBON_WALLET) in its constructor, permanently unset (address(0)) — Solidity immutables can never be changed after deployment, so it stays unset forever. Its tier percentage is already folded into the holder-pool numbers above.

Anti-snipe protections

• Atomic launch — the pool is seeded and trading enabled in a single transaction; there is no window between "pool exists" and "trading is on."
• 48-hour anti-snipe window — wallet caps apply relative to the pool's own reserve at launch (5% max wallet, 5.5% max buy), not the total supply.
• 30-block buy → sell cooldown — blocks same-block or near-instant flip-and-dump bot patterns.
• Add-only pair registry — if a rival pool for CLAY/USDG ever appears to route around the fee, the Timelock can add it to the taxed-pair set. It can never remove or repoint an existing pair, only add new ones.

Launch mechanism

$CLAY trades on a Uniswap V2 pool (CLAY/USDG) — deliberately not V3. $CLAY is a fee-on-transfer token: V3's strict post-swap balance check would revert every sell routed through a standard router (MetaMask, 1inch, Dexscreener), since the pool always receives less than it expects once the fee is taken. V2 computes the output from the actual balance delta after transfer, which is exactly the pattern fee-on-transfer tokens need — and the same pattern NET (the other FOT token on this chain) already uses in production.

A V4 hook-based fee (as PRINTER and INDEX use on this chain) was considered and rejected: the fee would live on one specific pool, and a rival pool without the same hook would bypass it entirely. A token-level fee plus an add-only pair registry closes that gap regardless of which pool a trade routes through.

KilnLauncher.execute() is a one-shot, atomic operation, callable only by the fixed deployer address:

1. Creates the CLAY/USDG Uniswap V2 pair.
2. Sends the launch liquidity (both CLAY and USDG) directly to the pair, then calls mint() — the standard V2 sequence, no positions or NFTs involved.
3. Calls KilnToken.launch(), which flips tradingEnabled permanently and snapshots the anti-snipe caps and tier oracle in the same transaction.
4. Routes every CLAY token and USDG unit that didn't go into the pool — the non-pooled launch endowment — to the Treasury.

Treasury

Every taxed trade sends its fee share to KilnTreasury as plain $CLAY. Anyone can call sync() to recognize a new balance delta and split it:

The one-time launch endowment (the non-pooled majority of supply, sent to the Treasury at launch) is explicitly excluded from this split via a one-shot setEndowmentBaseline() call — it's capital, not revenue, and never gets counted, burned, or swapped as if it were trading fees.

Yield leg — swap safety

processYieldLeg is permissionless, so a caller-supplied minimum-output alone isn't real slippage protection (the same actor could manipulate the pool, then call with a minimum of zero). Instead, the Treasury keeps its own TWAP checkpoint (TreasurySwapOracle, refreshed via permissionless pokeSwapOracle(), valid only once at least 1 hour old) and requires the current spot price to sit within ±3% of it before any swap — checked against the pre-trade spot price, not the trade's own output, so a large honest swap's own price impact never triggers a false reject.

The resulting USDG deposits into the Steakhouse USDG vault on Morpho — the same vault behind Robinhood Earn itself. Reported backing applies a flat 2% haircut to the Morpho-reported value only, never to the real, redeemable balance.

NFT custody & the module registry ("Kanal 2")

NFTs the Treasury acquires sit in a FIFO maturity queue for 45 days before becoming eligible for redemption or module sale. A separate KilnModuleRegistry is the only path for a future resale mechanism (e.g. a Seaport-based buyback executor) to pull NFTs out — add-only, Timelock-gated, and every module starts with a sale quota of zero until governance explicitly raises it, capped at 20% of the current eligible pool per 7-day window.

Vault migration — the one designed escape hatch

If the Morpho vault is ever deprecated or a better one appears, migrateMorphoVault(newVault) — timelock-only, 48h delay — redeems the full position and redeposits it into a new vault. It's checked to share the same USDG asset, but funds can only ever move between two ERC-4626 vaults, never to an arbitrary address. The 48-hour public window before execution is the real safeguard: the destination is visible on-chain long before anything happens.

Redemption

Holders can claim USDG dividends and, separately, redeem a random NFT from the Treasury's eligible pool — both gated by the same per-epoch Merkle root, so neither channel can double-spend against the other.

Epoch roots — proposal, then disclosure, then activation

1. Governance proposes a new root via the Timelock (48h delay) — the snapshot data is public the entire time.
2. Once executed, a further 24-hour on-chain disclosure window must pass.
3. Anyone can then call the permissionless activateRoot() — enforcing "data published, then root live," independent of how governance times its own announcements.

Unclaimed balances never expire — there is no forfeiture rule, ever.

NFT redemption — a deliberate two-step commit/settle

A single-transaction "simulate, only send if favorable" design would let a holder cherry-pick which NFT they get. Instead:

1. Request: verify the Merkle proof, deduct the redemption price immediately (7-day rolling price anchor, −5%) — backing out costs the holder something, discouraging trial-and-error.
2. Settle: callable by anyone, one block later — pulls a pseudo-random index (future blockhash + prevrandao) over the mature pool, swap-and-pop, transfers the NFT.

Accepted, documented limitation: block-based pseudo-randomness is marginally influenceable by whoever proposes that block. For a low-value, largely fungible pick over a shared pool, this is treated as sufficient — a full VRF integration wasn't judged worth the added complexity.

Governance & security

KilnToken (ERC-20, never has an owner)
  │ reads pair-tax status from ─▶ KilnPairRegistry (add-only)
  │ reads price from ─▶ Uniswap V2 pair (CLAY/USDG, oracle only)
  └ fee shares routed to: LP / Team / Brrrbon / Treasury (all immutable)

KilnPairRegistry, KilnModuleRegistry, KilnTreasury
  │  owner =
  ▼
TimelockController (48h delay)
  │  controlled by
  ▼
Gnosis Safe (external, multisig)

What governance can and can't touch

Guardian — fast to freeze, never to move

A separate, fast-acting Guardian address can pause the Treasury unilaterally. Only the Timelock can unpause. A compromised Guardian key can, at most, freeze the system temporarily — never redirect funds, never touch an NFT.

Independent verification

179 tests (unit + invariant fuzzing, 256 runs × 100 depth per invariant). Reviewed with two independent static analyzers (Slither, Aderyn) — no reentrancy with fund loss, no arbitrary-address fund path, no missing access control found. One genuinely dead error declaration removed as a result.

Risk disclosures

Written plainly, not buried — these are accepted, documented trade-offs, not hidden gaps.

Roadmap

Network

Contracts

Live as of this writing — trading opens once KilnLauncher.execute() runs (see Launch mechanism above).

Reading on-chain state

Key view functions for building a dashboard or bot against Kiln:

// KilnToken
tradingEnabled() external view returns (bool)
launchPair() external view returns (address)
feeBreakdown(bool isBuy) external view returns (...)   // current tier-adjusted split
antiSnipeActive() external view returns (bool)

// KilnTreasury
backingValueUsdg() external view returns (uint256)     // haircut-adjusted USDG backing
pendingYieldClay() external view returns (uint256)
purchasePriceAnchor() external view returns (uint256)  // 7-day rolling NFT price anchor
eligiblePoolLength() external view returns (uint256)
paused() external view returns (bool)

// KilnModuleRegistry
isActiveModule(address module) external view returns (bool)

Events

Terms & attribution

Kiln is independent, unaffiliated software built for the Clay StonKz community. Nothing here is financial advice. Contract addresses and parameters on this page reflect the deployed state as of the date this page was last published — always verify against the explorer before relying on any address.

Built with Foundry, OpenZeppelin, and a Uniswap V2-pattern pool on Robinhood Chain.