invite only.
← the book
the goat pick

$CHIT

holdingrobinhood chain

a private funding layer for trading fleets on robinhood chain. private, not anonymous.

chit.tools ↗the burn ↗the bot ↗
positiontop holders
since2026-09
audit6 holds · 3 open
01thesis

a trader who runs many wallets has to fund them. do it from one main wallet and the whole fleet is public. chit puts itself in the middle: the trader holds a balance with chit, chit funds the fleet and pays its gas, and no transaction joins the main wallet to a fleet account.

the claim is bounded on purpose and we like it that way. the main wallet never funds the fleet. the chain shows a deposit into chit and fleets funded by chit, with no transaction linking them. the operator can link them. chit is private, not anonymous, and never says otherwise.

why we hold: it is the first product on the chain that a degen actually needs, it ships in stages instead of promises, and the buyback is live on mainnet with no owner and no withdraw. algocats. is advisor and top holder, working for his own bag.

stage 1 (private gas) is live on testnet at chit.tools, the first sponsored buy landed on 6 september 2026. stage 2 (the shared funding pool) is deployed and ran a full loop on chain. next is a capped, holders only beta on mainnet, labelled beta and not audited by a firm yet. the firm audit is scoped for before full mainnet.

the bot is where the chain will actually use chit. mainnet mode runs on session keys: you link a wallet you own, the bot gets a key with caps and an expiry, and you pause or revoke it whenever. buy, sell, limit orders, dca, follow a wallet, whale alerts, all from telegram, nothing custodial. sells are written by the account itself, so a leaked bot key cannot drain anyone. it is built, reviewed and on the dev’s main; it turns on after the pool beta soaks, with its own review. we built a good part of it and we say so.

02the facts
chainrobinhood chain · 4663 mainnet, 46630 testnet
stagestage 1 live on testnet · stage 2 pool deployed · mainnet beta next, capped
buybacklive on mainnet at 0xe5a7…8b64 · 1% of balance per hour, burns in the same tx, no owner, no withdraw
the rule10% of fleet fees daily, +1 point per 100k mcap. the team’s promise, not a contract reading
bott.me/usechit_bot · orus and hey lines on every token card · mainnet mode on session keys built, off until the audit
session account8 invariants at 256 runs, 22 threat-model tests, 108 solidity tests green · one stated limit, below
usalgocats. advises the dev (bambam) and mods the chat. not part of the team
03audit

our pre-audits: contracts, service, telegram bot, session account

three passes done by us, line by line, one test per finding in the repo (a fix flips the test). this is not a firm audit and we never call it one; the firm audit is scoped for before full mainnet. open items are disclosed here because a pool that can be emptied by its operator is custody, and custody gets said out loud. 2026-09-14 to 2026-09-21.

  1. holds
    checks-effects-interactions everywhere eth leaves

    exit deletes before sending, fund and fundPrincipal update the draw before the loop, claimOperator increments before sending.

  2. holds
    deposit sizes, depositor cap, pool cap, draw cap enforced

    held under 256 random sequences of calls, plus fuzzing on the published sizes.

  3. holds
    operator can claim only the gas it fronted

    never principal, never headroom. invariant, not a single test.

  4. holds
    exit works while paused and without the operator

    the self-serve exit needs nothing from chit. spend posted during the exit wait still counts, so exiting is not a way out of a bill.

  5. holds
    accounting identity holds

    balance equals deposits minus outflow minus exits minus claims, always.

  6. fixed
    deposit after an exit request was lost

    one-line check in deposit(); the app greys out deposit while an exit is pending.

  7. open
    operator can empty the pool

    the design, disclosed as custody. guardian pause and the operator key split are on a branch; multisig and an hourly outflow limit are the ask before mainnet.

  8. open
    a failed buy is rolled back at the operator’s expense

    fund and execute are two transactions today; the fix is one atomic fund-and-execute. until then the service bounds failed buys per campaign.

  9. watching
    service side: ten findings handed to the dev

    concurrency on withdrawals, charge amounts that can be matched on chain, sweep cadence. reproductions live as tests; fixes in progress on the audit branch.

  10. fixed
    bot: webhook failed open without its secret

    the runtime refuses to build without a 16+ character secret; constant-time compare, 403 otherwise.

  11. fixed
    bot: stale whole-row upserts erased fleets

    no put anymore. create is insert-if-absent, patch touches one column.

  12. fixed
    bot: confirm trades and sell protection bypassed by old cards

    buttons carry the plain verb; the handler alone decides whether to ask.

  13. fixed
    bot: sealed keys were not bound to their row

    scrypt-derived key, associated data per user and purpose, blob names its sealing key.

  14. fixed
    bot: no update dedupe, money guarded per instance only

    telegram redelivery and double instances no longer re-execute buys, sells, withdrawals.

  15. fixed
    bot: a leaked bot key could drain tokens through a permit2 approval

    the first sell design left an unlimited permit2 approval and a free execute to the router. redesigned: the account writes the sell calldata itself, approvals are per sale and cleared in the same transaction. proven on the solidity suite and a testnet fork.

  16. fixed
    bot: the pool a mirror buys through was discovered, not recorded

    the deepest hookless pool won, and anyone can open one with a little liquidity. now the token’s pool is on record, and a recorded token never trades through a discovered pool.

  17. fixed
    bot: a dca slot bought twice by two overlapping runs

    caught in the dev’s review before it shipped. the order claim names the slot, so a second run working from a stale read sends nothing.

  18. holds
    session account: no approval left after a sale, eth lands only in the account, caps and expiry hold, a dead key moves nothing

    eight invariants at 256 runs each and twenty two threat-model tests, in the audit pack we wrote for the firm.

  19. open
    session account: with the sell flag on, the key names the pool and the floor

    the contract bounds amounts, not price: a leaked key could sell the position into a thin pool of its own. the bot sells only through the recorded pool at the quote with a 3% floor, and the flag is off by default. the honest limit of the design, first on the auditor’s list.

  20. watching
    session account: not audited by a firm, mainnet mode off

    the dev holds one unaudited contract with real money at a time, the pool beta first; the bot follows with its own review and its own announcement. we agree, and we say it here rather than in a footnote.

04timeline

what happened,
and when.

  1. first sponsored buy lands on testnet. stage 1 is live at chit.tools.

  2. stage 2, the shared funding pool, deployed on testnet.

  3. full pool loop runs on chain: deposit, fleet, draw, sponsored buys.

  4. our contract and service pre-audits handed to the dev, one test per finding.

  5. buyback live on mainnet, no owner, no withdraw. bot audited before deploy.

  6. orus scan line on every token card.

  7. hey research line on every token card.

  8. firm-audit scope written. capped holders-only mainnet beta is next.

  9. mainnet mode for the bot built on session keys: link your own wallet with one signature, the bot gets a key with caps and an expiry, pause or revoke it any time. the token card as a picture with the orus and hey marks, a public token api, the chrome extension stage 1.

  10. sell, limit orders, dca, follow a wallet, whale alerts and leaders from their own wallet built and reviewed. a session account audit pack with eight invariants handed to the dev. mainnet mode stays off until the session account is audited. we agree.