Brim

Brim is a protocol on Robinhood Chain that turns a basket of tokenized stocks and stable assets into a yield-bearing token, BRIM. Stocks are the reserve; yield is the product. The reserve fills to a line the protocol calls the brim: book value per token. Whatever arrives above that line is surplus, and the Waterfall divides it among stronger backing, operations, and overflow for stakers. Stakers watch their balance grow in the token itself. That growth comes from protocol revenue (offering premiums, trading tolls, the profits the desk sweeps back), and the revenue has to physically arrive before it can be minted as rewards. While the Well lasts, a finite pool of genesis tokens tops rewards up as well (§ 7). Underneath the yield sits a hard property: every BRIM in existence was paid for. After genesis, BRIM is only ever minted against value already banked in reserve, and the contracts check this arithmetic on every mint. There are no VCs, no insiders, and no pre-sale. The launch is open to anyone who wants to play. Top Juicers will be first in line. The floor is not a promise. It is a redemption function anyone can call while the Tap is open.

Two numbers

The protocol is organized around two quantities anyone can compute from chain state:

Book value, which this paper also calls the brim, is what one token's slice of the reserve is worth at oracle prices. The floor is what the Tap will actually pay, in reserve assets, to anyone who redeems while the Tap is open: permissionlessly, in kind, and 2% under the brim. The fee is what the holders who stay keep.

The central guarantee, stated precisely:

At accepted prices, no protocol action can lower the brim. After genesis, every mint is checked against this inequality in the transaction that performs it.

Note what this does and does not claim. Reserves are tokenized equities; their market prices move, and book value in dollar terms moves with them. What cannot happen is dilution. No issuance, no reward, no fee, and no configuration can mint a token that wasn't fully paid for. Markets may lower book value; protocol actions, at accepted prices, never will.

Six words. The paper uses six economic terms that are easy to run together:

How Brim moves value

The protocol is a set of small, single-purpose contracts. Each has one job, and they read best in the order value moves through them:

Two outlets, and only two: backing leaves the Reservoir only through the Tap, and overflow authorizes staker rewards only through the Spillway. Every path that moves reserves or stake shares one settlement lock, so no two can observe each other mid-motion. And every inflow that authorizes a mint settles on receipts: balances measured before and after, never amounts promised.

Issuance: selling above the brim

New BRIM is sold to buyers through offerings, which are deliberate events that governance starts and the Pour runs. Each offering is a Dutch auction on the premium over book value: the price opens at 5.00× and descends to a 1.10× floor, the contract's own hard minimum. No sale below it is possible. Every allocation vests through the Decanter, so freshly minted tokens are never liquid in the block they are born. Vesting runs 5 to 30 days at the buyer’s choice, and longer vesting earns a bonus of up to 25% more tokens.

Because the buyer pays a premium over the brim but receives tokens backed only at the brim, every sale generates a surplus: real money above what backs the tokens actually minted, bonus included. The surplus runs the same Waterfall as every other revenue: under the launch configuration (§ 11) 90% becomes overflow for stakers, 5% capitalizes the operating desk, and 5% stays in the Reservoir, permanently lifting the brim. Offerings are bounded by demand, by the 1.10× floor, and by a budget the Policy Board sets per series. They are never bounded by the reward budget that meters the Spillway (§ 5).

At a 5× fill, 75–80% of the payment is surplus, depending on the vesting bonus. That is why the offering is the yield engine at launch, before external revenue scales. The offering exists for size and the bonus: the pool quotes the market price; the Pour quotes depth the pool cannot.

Redemption: the floor

Any holder can hand BRIM to the Tap and receive their pro-rata slice of the entire reserve basket, in kind, minus a fee (2% at launch) that stays in the Reservoir for everyone who remains. The tokens are burned before assets move. There is no queue and no counterparty: the floor is a function, not a market maker. The Tap pays 0.98× the brim, never the brim itself; the difference is what the holders who stay keep.

This is the trust layer the rest of the design leans on, and by design it is the least clever function in the protocol. It needs no oracle and no liquidity, so a crashing market changes what the basket is worth, never whether the function pays it out. The redemption fee is also one of the two numbers behind the reward system's security bound (§ 5). The bound is the lesser of the pool cap and this fee, and at launch the pool cap is the tighter.

Staking and overflow

Stakers deposit BRIM into the Basin and hold shares of a growing pool. Rewards arrive as tokens added to the pool, so the balance a staker can claim grows. Three exits, priced by urgency:

Rewards are released by the Spillway on a permissionless tick (roughly hourly, metered in blocks, and cranked by anyone) from overflow: revenue delivered by listed sources, split at the door by the Waterfall, and tracked unit by unit while it waits in the Spillway's own vault. Donations and stray transfers can never authorize a mint: supported, tracked assets are swept into the Reservoir as pure accretion, and anything unsupported or unpriceable stays outside reward accounting altogether. Each tick's total inflow to the pool is bounded:

That bound is a theorem, not a tuning choice: it makes deposit-before-the-tick sniping strictly unprofitable through the instant exit, because the capture can never exceed the exit fee. At launch the pool cap, 1% of stake per tick, is the tighter of the two. The two legs inside the bound are different machines. Minted rewards are struck against overflow that the tick moves into the Reservoir in the same transaction, under the same backing inequality as § 3, checked again at distribution. They are further metered by a yearly budget, a share of supply per era (§ 11), that offerings and the Well never touch. The Well draw mints nothing: it is a transfer of genesis-era supply (§ 7), already counted in the brim, moving from the Well into the pool.

Where yield comes from

Yield arrives in two ledgers. Either your balance grows, because tokens flow into the staked pool and every share is worth more, or every token's backing grows, because value is banked or supply is burned and the brim rises for holders and stakers alike. Every source in the protocol lands in one of the two columns:

All overflow passes through the same accounting, the same tick, and the same inflow bound (§ 5). All burn-and-bank flows compound silently into the brim.

The system is reflexive by design. Activity is the yield, whether it is an offering, a trade, or an exit, and the protocol converts every kind of it into one of the two ledgers.

The Well

A reservoir needs a well for dry spells. At genesis, a fixed allocation of BRIM is placed in the Well. It is pre-minted, inside total supply from block one, and therefore already accounted for in the brim. Drawing on it later moves neither supply nor reserves: the brim is unchanged, to the wei, by every draw. Only the Spillway can draw from it, and no protocol path can mint it a refill; anyone may pay existing tokens in, and such a top-up is a gift to stakers.

Governance sets one target, an annual rate on the staked pool applied per tick. Each hourly tick:

Organic minting applies first; the Well fills only the gap it leaves. The glide is what keeps it honest over time: a tick may draw at most the Well's balance divided by the ticks in a runway floor (30 days at launch, with a timelocked lengthening to 90 days planned for the third week), so the Well can never be emptied faster than its floor, and as it runs shallow its draws taper geometrically instead of stopping at a cliff. A growing pool raises the target and the inflow bound; it never raises the drain. Hot weeks draw little or nothing. Quiet weeks draw the target while the Well is deep, and less as it shallows. Governance sets the target and the runway parameters; the counter-cyclicality is arithmetic.

The target governs only the Well's contribution, and it is a ceiling the Well aims at, not a coupon. Organic rewards apply first and may carry a tick above the target on their own; the Well fills a remaining shortfall, subject to its glide cap and to the pool-inflow capacity the organic mint left unused, and what it can add depends on how much is staked. The rate is quoted as an annual rate per tick; because ticks compound, the realized yield on a fully paid year is higher. Security signers can lower the target instantly and only the timelock can raise it, so a queued raise can never undo a brake. The Well reports its own bounds onchain: balance, target per tick, and the most a dry tick can draw. The chart to watch is organic overflow against Well draws. The day organic overflow carries the target on its own, the Well has done its job.

The Ripe connection

Brim is an independent protocol, but it launches with one deliberate ally: Ripe Protocol, an onchain credit system where users pledge collateral, borrow the GREEN stablecoin, and earn points, the juice score, for staking RIPE and RIPE LP. The two protocols share no balance sheet: Ripe never touches the Reservoir, no BRIM is pledged as collateral anywhere, and the floor does not depend on Ripe in any state of the world. The relationship runs through two doors.

The first is the operating desk. The Mill manages a separately capitalized, non-backing sleeve of protocol-owned assets, never the Reservoir, and its flagship strategy is a credit line on Ripe: the desk pledges operating assets, borrows GREEN against them, and deploys the proceeds where it seeks a positive spread over the borrowing rate. Policy treats borrowed principal as a liability, never revenue, and permits only realized net profit to be swept, meaning value remaining after principal repayment, accrued interest, execution costs, and realized losses. The contracts do not compute that profit; a timelocked governance action names the amount. Losses stay on the desk, and the reserve backing the floor never carries debt. Ripe gains a protocol-scale borrower; Brim gains a yield engine on assets that would otherwise sit idle.

The second is genesis. The Ripe juice score, onchain points earned by staking RIPE and RIPE LP, plays an important part in the launch event: the deepest hands in Ripe stand first in line for Brim, and the two communities are aligned from block one. Genesis itself is § 10; full details follow in a later note. Ripe grows it. Brim overflows.

Prior art, and the trade-offs combined

Brim sits at the intersection of several earlier monetary designs. Each solved a different problem (treasury accumulation, endogenous stabilization, elastic supply, basket redemption, reserve-capped emissions), and each gave something up to do it. Brim combines selected parts of those designs under one constraint: new issuance must preserve current book value at the prices the protocol accepts.

The synthesis is the design: take Olympus's premium-issuance flywheel but mint new rewards only against banked revenue (the finite Well supports rewards while it lasts with pre-minted, already-backed supply, and prints nothing); take Reserve's honest redemption but remove the NAV pin so the token lives above its floor, not at it. There is no price target to defend and no open-ended emission schedule to sustain. Against every predecessor's floor, the wedge is the same: the exit is a pro-rata take of the Reservoir itself, priced mechanically rather than negotiated. When demand is strong the premium funds the yield; when demand is gone the Tap pays the floor. Both states are solvent by the same arithmetic.

Genesis

The launch event ends in one state: a reserve in the Reservoir backing the entire initial supply, the Well's allocation included, inside supply and inside the brim from block one, and protocol-owned liquidity in the token's own market. That liquidity stays protocol-owned: the pool's hook admits liquidity from the protocol's own desk and no one else, so a toll cannot be sidestepped by posting a position instead of a trade. No VCs, no insiders, no pre-sale. Genesis is for anyone who wants to play. After it, the only way a new token ever comes into existence is fully paid for, at or above the brim. Genesis is the one moment that must establish the backing every later mint is checked against. How the event itself runs is left unspecified here on purpose. The Ripe juice score (§ 8) plays an important part, and full details come in a later note.

Honest limits

• Market risk is real. The reserve is tokenized equities; its dollar value moves with markets. The guarantee is that protocol actions never dilute, not that the number never falls.
• The floor has switches. The Tap can be paused defensively and its fee tuned (never above 10%) under the launch trust model, where governance also retains registry, pause, and mint-authorization powers behind timelocks. The brim law binds what protocol actions may do. It is not a claim that any single function is unstoppable.
• The Well targets, it does not guarantee. Subsidized yield is bridge capital with a visible runway, not perpetual emissions. A shallow Well glides below its target rather than stopping; the residual stays in the Well; draws are labeled separately from organic yield everywhere they appear. The target governs only the Well's contribution; it is set at launch and can be lowered instantly.
• The desk can lose. The Mill can lose operating capital on its own sleeve; it can never encumber the Reservoir, and what it sweeps back is named by governance, not computed by the contracts.
• Oracles are load-bearing. Issuance and rewards price everything strictly and fail closed: if a feed dies, minting stops rather than guessing. Redemption, by design, does not depend on prices at all.
• Patience is priced, not enforced. Capital that arrives just before rewards and leaves through the slow exit earns its share like anyone else; the bounds only make instant extraction unprofitable. We consider mercenary liquidity a customer, not an attacker.

Launch configuration. The mechanisms above are fixed; these dials are not. They are governed through the Policy Board and the Market Board within the ceilings shown: raises and value-moving actions wait behind timelocks, defensive reductions act immediately. This table is dated September 2026.