Docs / The vault
Inside Ordeo
Shielded ORDEO earns because notes hold vault shares
ORDEO notes count shares of a vault, not tokens. Adding ORDEO to the vault without creating shares makes every share worth more, so every shielded note grows.
State
| Variable | Meaning |
|---|---|
backing | ORDEO standing behind all shares |
totalShares | Shares held in ORDEO notes |
pendingYield | Yield that arrived while no shares existed; it joins the backing with the next shield |
ethFees | ETH fees waiting to be swept to the splitter |
Conversions and the virtual offset
value of s shares = s × (backing + 1) / (totalShares + 1,000,000) rounded down shares for n tokens = n × (totalShares + 1,000,000) / (backing + 1) rounded down
The extra million shares and one token are virtual: they exist only in the formula. They stop the classic first-depositor trick, where someone shields a tiny amount, donates a large one to inflate the share price, and lets later shields round down to zero shares. With the offset that attack costs far more than it could take, and any shield that would round to zero shares reverts (ZeroShares).
Rounding always favours the vault: shares minted round down, share value rounds down, fees round up. The share price therefore never decreases; the test suite checks this as an invariant.
Entering
A ORDEO shield (directly or through the router’s buy) takes the shield fee, puts that fee into the vault as yield, and mints shares for the rest at the current price. Shares minted at today’s price do not share in yield that arrived before. If no shares exist yet, any waiting pendingYield joins the backing at this moment, so the first notes created receive it. ETH notes are plain wei and have no shares.
Exits
A spend that takes ORDEO out prices its exit before anything is burned: gross = valueOfShares(exitValue). The pool then removes exitValue + transferFee shares and gross tokens. The transfer fee shares are burned without taking tokens, so their value stays with every remaining share.
On an unshield, the flat ORDEO fee is added back to the vault as yield, the bundler’s fee is paid if there is one, and the rest goes to the recipient. On a private send, the exit (if any) pays only the bundler.
Fees
| Fee | On ORDEO notes | On ETH notes | Proposed value |
|---|---|---|---|
| Shield | Stays in the vault as yield | Accrues to ethFees, then the splitter | 0.10% |
| Private transfer (value sent to another key) | Shares burned: value stays in the vault | Accrues to ethFees | 0.10% |
| Flat unshield fee | Stays in the vault as yield | Accrues to ethFees | 10 ORDEO / 0.0001 ETH |
The proposed values are what the deploy configuration suggests; the owner confirms them before deploying, and after that they are fixed. The code refuses any rate above 5% (MAX_FEE_BPS = 500). Bundler fees are separate: they go to the bundler, which donates its ORDEO back to the vault by default. See Fees.
Donations
donate(amount) adds ORDEO to the backing without minting shares. Anyone may call it. The pool pulls the tokens with the same exact-amount check as a shield and emits Donated and YieldAdded. Tokens sent to the pool with a plain transfer are not counted as backing and cannot be recovered.
Sources of yield
The main source is the Pons creator fee. OrdeoYieldSplit is the token’s Pons creator fee recipient and the pool’s fee sink. Every ETH it receives is split 50% to the team and 50% to the holders’ address, the harvester’s wallet. The split is a constant (TEAM_BPS = 5000 of 10,000) and both addresses are fixed in the constructor.
The harvester spends its half on ORDEO through OrdeoTradeDesk.buyAndDonate, which donates every token it buys to the vault. Each buy has a minimum output set at the reference price less 1.5%, batches are at most 0.02 ETH, and a round is skipped when ORDEO is more than 3% dearer than the reference. Whoever holds the harvester key controls the holders’ half until it is spent; because fees arrive gradually, that balance stays small.