One Broker, end to end

The lifecycle below is the whole protocol. Every step is a call anyone can make from the terminal or directly against the contracts.

1. Mint

Brokers are minted from a capped supply of 5,000, up to ten per transaction, at a fixed price paid straight to the treasury. A freshly minted Broker starts unlicensed at weight 1 and starts earning distributions from that block.

2. Open the account

Every Broker already has an account address before anyone spends gas on it. The registry derives it from the implementation, the salt, the chain id, the Broker contract and the token id, so the address can be displayed and funded ahead of deployment. Calling createAccount deploys it, and calling it twice is a no-op that returns the same address.

account = registry.account(impl, salt, 4663, broker, tokenId)   // known in advance
registry.createAccount(impl, salt, 4663, broker, tokenId)      // idempotent

3. Build the portfolio

The account is a smart account whose only authority rule is the Broker's current owner. The owner drives it with execute, which means the account itself buys the hStock and the position lands inside the Broker rather than in the wallet standing next to it.

account.execute(stockDesk, 4 ether, abi.encodeCall(StockDesk.buy, (hHOOD)), 0)

Only operation 0 (a plain call) is allowed. Delegatecall is refused, so nothing can rewrite the account's own storage or its binding to the Broker.

4. License

A license raises the Broker's distribution weight from 1x to 3x, 8x or 20x. Upgrades cost the difference against the tier already held, never expire and never step down. The tier is stored against the token id, so a licensed Broker keeps its weight for whoever owns it next.

Weight applies from the moment it is bought. Revenue that arrived before an upgrade stays split at the old weights, so nobody can buy a license to backdate a claim on money that is already in the contract.

5. Distributions

Market fees, desk fees and the protocol's share of credit interest all flow into a single distributor. It holds one accumulator instead of epochs, and each Broker pulls what its weight has earned since it was last touched. Claiming is permissionless because the destination is always the Broker's current owner, never the caller.

Unclaimed distributions stay with the token id rather than the wallet. A Broker sold with distributions pending carries them to the buyer, which is deliberate: the Broker is the asset, so everything attached to it should price into one sale.

6. Credit

Lenders deposit ETH into a shared pool and receive shares. A Broker owner escrows the Broker and draws up to the credit limit published for its license tier, on a 30 day term at 12% simple interest. Because the Broker controls the account, the positions inside are pledged along with it. Nothing is sold and nothing is re-registered.

There is no price oracle. What a Broker can borrow is a fixed number per tier, so there is no mark to push around. A pledged Broker keeps earning, and claimFor routes its distributions to the borrower while the token sits in escrow.

Past due, liquidation is permissionless and unglamorous: anyone pays what is owed and takes the Broker, its account and the portfolio inside. Interest splits 80% to lenders and 20% to the Distributor, which puts it back in front of Broker holders.

7. Sale

Listing moves the Broker into escrow at a fixed price. On a fill the buyer receives the Broker, the seller receives 97.5% and the 2.5% fee becomes distribution income. In the same transaction the buyer becomes the controller of the account: the positions never moved, the old owner simply stops being able to call execute.

A Broker sitting in market or credit escrow is owned by that contract on paper, so both contracts expose claimFor and refuse bare ETH transfers. Distributions cannot be swept into a lending pool or stranded in an escrow by accident.