Whitepaperv4 · ethereum mainnet

$THODL — Whitepaper

The first on-chain treasury for TDH. A solid, perpetual protocol that gives you fast, liquid exposure to the entire 6529 Memes ecosystem in a single token.


TL;DR

$THODL is the first on-chain treasury for TDH — an immutable ERC20 protocol on Ethereum mainnet that turns every DEX swap into a perpetual accumulation of 6529 Meme NFTs, ranked by their Price‑Per‑TDH (PPTDH) efficiency. 9% of every swap feeds the treasury, which always buys the most TDH-efficient card on the market. 1% goes to the developer wallet as the only source of dev income — there is no pre-minted developer allocation, no presale, no investor round.

The contract itself is the vault: purchased NFTs are held inside it and no function exists to withdraw them. The liquidity pool is atomically seeded at sale finalisation and its LP tokens are sent to 0x000…dEaD, making the liquidity permanently locked. A 2-of-3 Safe multisig is the only admin, and emergency powers self-destruct one-shot at launch via disableEmergency().

For a holder, owning $THODL is a single-token, liquid claim on a permanently-growing stack of high-conviction 6529 Memes — plus a proportional share of the governance weight (TDH) those NFTs generate inside the 6529 ecosystem. The more trades happen, the more NFTs the treasury absorbs; as supply of Memes is finite, every purchase permanently reduces the tradable float of the collection.

Activation milestone: when the treasury accumulates 100,000 TDH, the protocol will open shared TDH usage — $THODL holders will be able to direct and benefit from the vault's TDH in the 6529 ecosystem (governance, gated drops, community access). See §6.4.


1. Background — what is TDH?

TDH ("Total Days Held") is the 6529 community's on-chain reputation and governance primitive. For every 6529 Meme NFT a wallet holds, that wallet earns a daily TDH score, weighted by the card's edition size. A card with a small edition carries more TDH weight per copy than a card with a large edition:

Per-copy-per-day TDH rate = 3941 / edition_size      (unboosted, official 6529 formula)

where 3941 is the edition size of FirstGM, the 6529 reference card whose per-copy weight is 1. So holding one copy of a card with 300-edition accrues 3941/300 ≈ 13.14 TDH per day, while a 1000-edition card accrues 3.941 per day per copy.

TDH gates voting power on 6529.io governance, access to community features, and is commonly referenced in the 6529 ecosystem as a measure of "commitment to the memes". There is no way to buy TDH directly — you must hold the NFTs over time.

PPTDH = price / TDH, i.e. how much ETH you pay per unit of TDH yield generated. Lower PPTDH = better deal. The PPTDH ratio across the 6529 Memes collection is published at 6529nfts.io/memes/prices-and-valuations and is the central primitive optimised by this protocol.


2. Protocol mechanic — the full loop

           ┌─────────────────────────────────────────────────────────────┐
           │                     THE $THODL LOOP                         │
           └─────────────────────────────────────────────────────────────┘

   ┌──────────┐        10% fee         ┌────────────────┐
   │  Trader  │ ───── on every ─────▶  │  $THODL token  │
   └──────────┘       swap (UniV2)      └────────────────┘
         │                                      │
         │                             9% ─┐    │   ┌─ 1% dev wallet
         ▼                                  │    ▼
   user buys/sells $THODL                   ▼
                                      ┌───────────────────────┐
                                      │   BuyerContract       │
                                      │  (immutable treasury) │
                                      └───────────────────────┘
                                          │             │
                            convertFeesToETH         NFTs held forever
                            (own Uniswap sell,       (no withdraw function
                             fee-exempt path)         exists in the code)
                                          │
                                          ▼
                          ┌─────────────────────────────────┐
                          │  Off-chain oracle               │
                          │    - scans OpenSea listings     │
                          │    - computes PPTDH per card    │
                          │    - signs lowest-PPTDH with    │
                          │      EIP-712 BestListing        │
                          └─────────────────────────────────┘
                                          │
                                          ▼
                                    triggerBuy()
                                 (permissionless,
                                  15-block cooldown,
                                  gas refunded from treasury)
                                          │
                                          ▼
                            ┌───────────────────────────────┐
                            │ Seaport.fulfillAdvancedOrder  │
                            │ recipient = BuyerContract     │
                            └───────────────────────────────┘
                                          │
                                          ▼
                     NFT lives inside BuyerContract forever.
                     TDH accrues to the contract's address.
                     Via 6529 DelegationRegistry, it is
                     consolidated to a governance wallet
                     controlled by $THODL holders.

Step-by-step walkthrough

  1. Trader swaps $THODL on the Uniswap V2 ETH/$THODL pool. The token's _update function intercepts the transfer, takes 10% in $THODL, splits it 9%/1% to BuyerContract / dev wallet.
  2. BuyerContract accrues $THODL passively. An authorised keeper (typically the oracle signer EOA, registered by Safe via setKeeper) periodically calls convertFeesToETH(amountIn, minEthOut), which sells accumulated $THODL for ETH on the same Uniswap pool. Restricting the call to keepers + owner prevents permissionless callers from sandwiching the swap with minEthOut = 0. Because BuyerContract is fee-exempt on the token, its own sell pays no fee — there is no recursion.
  3. Oracle scans OpenSea listings of the 6529 Memes collection every 30 s. It computes PPTDH = price_wei / tdh_rate_1e9 for each active card (mint-window cards < 299 supply are excluded) and picks the lowest.
  4. Oracle signs an EIP-712 BestListing(tokenId, priceWei, validForBlocks, nonce, deadline) message off-chain.
  5. Anyone submits the signed payload to GaslessOracle.submitBestListing(...), which verifies the signature and forwards updateBestListing(tokenId, priceWei, validForBlocks) to BuyerContract. The submitter's gas is reimbursed from the treasury ETH balance (capped at 100 gwei effective, 0.01 ETH per call).
  6. After a 15-block cooldown (~3 min), anyone can call triggerBuy(tokenId, seaportOrderData). The contract validates:
    • tokenId matches the oracle's current best listing.
    • The Seaport order is for the 6529 Memes contract (0x33FD4269…).
    • All consideration items are NATIVE ETH (no Dutch orders, no ERC20 royalties).
    • The total ETH required ≤ maxNftPrice (safety cap, 5 ETH default).
    • On-chain IERC1155.totalSupply(tokenId) ≥ minCardSupply (299 default).
  7. Purchase executes atomically via ISeaport.fulfillAdvancedOrder, with recipient = address(this). The NFT lands directly inside BuyerContract. A balance-of check after the call guarantees the NFT was received.
  8. NFT lives forever inside the contract. There is no function in the code that moves it out. It can never be sold, transferred, or listed. Its TDH flows to the contract's address and is consolidated to the governance wallet via callDelegationRegistry() (owner-only).

3. Investor thesis

3.1 First on-chain treasury for TDH — perpetual, liquid 6529 exposure

$THODL is the first protocol that turns the 6529 ecosystem into a single liquid ERC20. Owning a well-rounded 6529 Memes position historically required buying dozens of individual cards over months or years, monitoring listings, managing gas, and navigating the PPTDH curve by hand. $THODL packages that entire activity into one token, perpetually:

  • Buy $THODL once — you own fractional exposure to every card the treasury acquires, priced by the market.
  • The protocol's oracle does the PPTDH math 24/7 — every cycle it ranks every active OpenSea listing across all 487 6529 Memes by PPTDH and signals the most TDH-efficient card on the market. The treasury buys it. Forever.
  • Exit anytime on Uniswap V2 (bearing the 10% FOT fee, which goes back into the protocol you just exited — fueling more buys).

Unlike a vault where NAV is recomputed by a curator, here the exposure is a running claim on a permanently-growing stack of high-conviction cards selected purely on a transparent, on-chain-verifiable metric (PPTDH with the 6529 formula). There is no manager, no rebalance committee, no discretion: the protocol's behaviour is fully encoded in immutable contracts.

3.2 Supply reduction — deflationary pressure on the Memes floor

The Memes collection has a finite maximum supply per card (mint ends after ~6 days and supply freezes). Every NFT the treasury purchases is permanently locked — there is no transfer-out function in the buyer contract. Over time, as trading volume on $THODL funds more buys:

  • Cards held by the protocol leave the float forever, never to sell back.
  • Effective circulating supply of the collection shrinks with every trigger.
  • At constant or growing demand, this creates monotonic upward pressure on floor prices and on the community's weighted PPTDH baseline.

This is structural, not promotional: it follows mechanically from the absence of a sell path in the smart contract code.

3.3 Governance weight — THODL holders vote on 6529 via the vault's TDH

As the treasury accumulates NFTs, it accumulates TDH. Through the 6529 Delegation Registry's consolidation mechanism, the contract's TDH is attributed to a designated consolidation wallet that participates in 6529 governance on behalf of the protocol. That wallet's voting stance — on 6529.io proposals, community direction, meme card curation, boycotts, ecosystem partnerships — is decided off-chain by $THODL holders via a snapshot-based vote (1 $THODL = 1 vote). The Safe multisig that controls the consolidation wallet executes the outcome.

Concretely:

  • Per-card TDH contribution grows as the protocol buys more cards and as time passes (each day = +1 × (3941/edition_size) per copy held).
  • Per-$THODL voting power grows monotonically alongside, minus any $THODL burned via buybackAndBurn.
  • The marginal $THODL holder inherits a fractional claim on a governance position inside 6529 that would be infeasible to assemble individually.

Over time, this turns $THODL into the most efficient per-dollar way to express conviction about 6529 community direction.

Activation milestone — 100,000 TDH. $THODL holders' direct use of the vault's TDH (governance routing, gated 6529 access, community features) activates as soon as the treasury reaches 100,000 accumulated TDH. Until then the consolidation wallet is registered and accruing in the background; from that threshold onward the protocol opens shared TDH usage (see §6.4).

3.4 Zero dev pre-allocation, yield stream from usage

The developer has no pre-mined token allocation. Developer income is exclusively the 1% of every trade fee, paid in $THODL. This aligns incentives: the dev earns only when the protocol is used, and only at the same rate per-trade as the treasury (the protocol earning 9× more than the dev on every swap).

The dev's ability to influence protocol parameters (through the Safe multisig) is bounded by the immutable logic: the dev cannot mint new tokens, cannot move NFTs out of the vault, cannot withdraw the LP, cannot override trade fees, cannot rewrite the oracle. The only live knobs are safety caps (maxNftPrice, minCardSupply, minEthForTrigger) and governance primitives (oracle authorisation, consolidation registration, buyback-and-burn discretion).


4. Safety — why funds, LP, and NFTs are provably safe

The trust model of $THODL rests on what the smart contract code cannot do, by construction. Every class of risk that investors typically worry about in DeFi is eliminated at the code level rather than by policy.

4.1 NFTs cannot leave the treasury

BuyerContract inherits OpenZeppelin's ERC1155Holder and accepts ERC1155 transfers (needed to receive Seaport purchases). It has zero functions that transfer NFTs out:

  • There is no sendNFT, withdrawNFT, listOnSeaport, transferToSafe, or any equivalent.
  • The only place the contract calls Seaport is triggerBuy, which is fulfillAdvancedOrder (a buy).
  • emergencyWithdrawToken explicitly operates on IERC20 only, not IERC1155. It cannot move NFTs.
  • The callDelegationRegistry function calls into the 6529 registry contract only, on a hardcoded address, to register consolidations/delegations — not to transfer ownership of anything.

Even the Safe multisig owner, with full admin rights, cannot sell or transfer a single NFT out of the treasury. It is a one-way sink.

4.2 Liquidity pool is permanently locked

At GenesisSale.finalize(), the 5% LP reserve (3.47M $THODL) is paired with 8.1 ETH from sale proceeds and deposited into a fresh Uniswap V2 pool. The LP tokens returned by addLiquidityETH are sent directly to 0x000000000000000000000000000000000000dEaD — the canonical burn address. Nobody, including the deployer, holds the keys to that address.

Consequences:

  • The liquidity can never be withdrawn.
  • No rug-pull is possible: the remove_liquidity call would fail for anyone who attempted it.
  • The 5% $THODL + 8.1 ETH sit permanently in the pool as floor-defending liquidity.
  • The only way the pool's reserves change is through ordinary swaps.

4.2a LP scaling roadmap

The seed LP (~$48k at launch, assuming ETH=$3k) is intentionally kept small to make the deployment self-funding (no out-of-pocket from the dev). As trading volume scales and the token's market cap grows, depth must scale with it to avoid extreme slippage on large trades. The protocol has a layered, progressively-enabled approach:

  1. Tier 1 — BuyerContract.buybackAndBurn(ethAmount, minThodlOut) (live from day 1). The Safe can use treasury ETH to buy THODL from the LP and burn it. Net effect: pool's ETH side grows, THODL side shrinks → spot price rises and float reduces. Does NOT increase absolute depth, but improves price stability under selling pressure.

  2. Tier 2 — Owner-led LP injection (always available; trust-mid). The Safe can THODL.setFeeExempt(self, true) and then call UniswapV2Router.addLiquidityETH with treasury THODL + ETH it has accumulated. New LP tokens go to the Safe (NOT burned). This injection directly increases pool depth at the cost of the Safe holding LP tokens (theoretically removable). Suitable for periodic, announced top-ups.

  3. Tier 3 — LpHelper permissionless contract (deployable as addon, see contracts/src/LpHelper.sol). An immutable, fee-exempt helper that lets ANY user deposit THODL + ETH and receive LP tokens directly to their wallet. The Safe makes a single THODL.setFeeExempt(LpHelper, true) call to enable; from that moment on, any community member can become an LP-provider without losing 10% to FOT fees. LP tokens stay with the depositor, who can remove them later (collecting Uniswap V2 0.3% trading fees in the meantime). Optional, deployed only if community-LP demand emerges.

The recommended sequence:

  • Launch with Tier 1 only.
  • If treasury accumulates surplus and community asks for more depth, Safe enables Tier 2 with a discretionary injection.
  • If a steady community-LP-provider demand emerges, deploy LpHelper and announce Tier 3.

Each tier is opt-in by Safe and cumulative — none requires a contract redeploy of the core protocol.

4.2b Why not just open LP to anyone from day 1?

Because of the FOT fee mechanism, a normal user calling Router.addLiquidityETH directly would lose 10% of their THODL contribution to fees (the router's transferFrom(user, pair) triggers the FOT path). This is hostile UX. Without the Tier 3 helper, only fee-exempt addresses can add LP cleanly — which by design is restricted to the Safe and the LpHelper (when deployed). This protects the protocol's "all fees go to treasury" narrative against accidental leakage.

4.3 Sale proceeds flow is deterministic

During the GenesisSale.buy() phase, buyer ETH is simply stored in the sale contract. At finalize():

  • Unsold $THODL above the LP reserve → burn() via ERC20Burnable. Permanently reduces supply.
  • 8.1 ETH from proceeds → addLiquidityETH as described above.
  • All remaining ETH → proceedsRecipient (set at deploy as BuyerContract).

There is no code path that allows sale ETH to reach the deployer, the dev wallet, a multisig, or any third party. The 9/1 fee split applies only to ongoing swaps post-launch, not to the primary sale.

4.4 Emergency powers are one-shot self-destructing

During the brief pre-launch window, emergencyWithdrawETH and emergencyWithdrawToken are available to the owner so that mistakes in setup (wrong env var, misrouted tokens) can be recovered. At launch, the Safe multisig calls disableEmergency() exactly once:

function disableEmergency() external onlyOwner {
    if (!emergencyEnabled) revert EmergencyAlreadyDisabled();
    emergencyEnabled = false;
    emit EmergencyDisabled();
}

After this, both emergency functions revert with EmergencyDisabledError. The flag is non-reversible — there is no enableEmergency(). From that moment on, even the owner cannot extract ETH or ERC20 from the treasury by any means. (Again, NFTs were never extractable even during the emergency window.)

4.5 Ownership can be renounced

THODL, BuyerContract, GenesisSale, MerkleAirdrop, and GaslessOracle all inherit OpenZeppelin's Ownable2Step. At the community's discretion, the Safe can call renounceOwnership() on any or all of them, setting the owner to address(0) and eliminating even the last privileged operations. Candidate post-launch renouncements:

  • THODL — after LP is seeded and launched = true, the remaining owner powers (setAmmPair, setFeeExempt) are low-risk; renouncement makes the token fully immutable.
  • MerkleAirdrop — once the root is lockRoot()'d, ownership becomes ceremonial; can be renounced.
  • GenesisSale — after finalize(), the contract has no further operations; can be renounced or left dormant.

BuyerContract and GaslessOracle ownership is more tactical: oracle signers may need to be rotated if a key is compromised, TDH filters may need occasional tuning. Community governance decides whether to keep the Safe or renounce.

4.6 Fair launch, no hidden allocation

  • No dev pre-mint. 100% of the 69.42M supply is distributed via (a) merkle airdrop to TDHODL Meme card minters (post-Submission), (b) public Genesis Sale at a fixed FCFS rate, (c) LP seed. The developer's token balance comes from minting the TDHODL Meme card on the same Submission Window, on the same terms as every other minter (~20 cards minted = 2.24M $THODL = 3.23% of supply).
  • No presale / private round / VC allocation. Every external buyer enters on the same FCFS curve, capped at 0.26116 ETH per wallet (= 1 card-equivalent), at a 4× markup over the minter's effective per-ETH share. Minters have a structural economic advantage by design; every public buyer sees identical terms.
  • Fully on-chain verifiable. The token, sale, airdrop, buyer, and oracle contracts are all verified on Etherscan at deploy time.

5. Tokenomics

5.1 Total supply

69,420,000 $THODL, 18 decimals. The number encodes the memetic constant 69420. The supply is minted in full at deploy time and delivered to the distribution contracts (airdrop + sale) — no further minting is possible (no mint() function is exposed). Supply can only ever decrease through burns, never increase.

5.2 Distribution

Allocation%AmountMechanism
TDHODL Meme card airdrop50%34,710,000MerkleAirdrop.claim(); airdrop snapshot taken after the TDHODL Meme card mint window closes (Submission Window flow). Per-mint share = 34,710,000 / total mints. Reference: at the typical ~310 mints of a 6529 Meme card, share ≈ 111,968 $THODL per card minted.
Public FCFS Genesis Sale45%31,239,000GenesisSale.buy(), fixed rate, per-wallet cap
Initial LP reserve5%3,471,000Auto-deposited by GenesisSale.finalize() into Uniswap V2, LP tokens burned to 0x000…dEaD

The TDHODL Meme card is being submitted to the 6529 Memes collection via the official Submission Window. Wallets that mint the TDHODL Meme card during that window receive the airdrop; one mint = one allocation, mint N times = N allocations (the airdrop scales linearly with cards held at snapshot).

Developer's personal allocation: 2.24M $THODL (3.23% of supply, calculated against an assumed 20 minted cards at the snapshot), claimed via the same merkle airdrop on the same FCFS terms as everyone else. There is no separate dev mint, no founder vesting, no advisor pool.

5.3 Sale parameters

ParameterValue
Rate428,700 $THODL per 1 ETH
Per-wallet cap0.26116 ETH (= 1 minter-card-equivalent of tokens, at 4× the minter price)
Minimum raise for launch8.1 ETH (= ~31 wallets at cap)
Maximum raise if fully sold~72.87 ETH
Duration14 days from sale.start()
Unsold at deadlineBurned via token.burn() inside finalize()
Overflow handlingExcess ETH beyond per-wallet cap is refunded in the same tx

5.4 Fee mechanic (post-launch, perpetual)

Every transfer where either from or to is a registered AMM pair triggers the fee:

DestinationBasis points% of swap
BuyerContract (treasury)9009%
Dev wallet1001%
Fee exempt0%

P2P transfers between EOAs — wallet-to-wallet — pay no fee. Adding/removing liquidity by whitelisted addresses (the deployer during setup) pays no fee. The token is self-describing about this via isFeeExempt and isAmmPair public mappings.


6. Governance — $THODL as a lever on 6529

6.1 The consolidation mechanism

Every 6529 Meme NFT held by any wallet accrues TDH to that wallet. Normally, if you own NFTs across multiple wallets, each wallet has its own TDH score. The 6529 NFTDelegation contract (0x2202CB9c00487e7e8EF21e6d8E914B32e709f43d) introduces a registerDelegationAddress function with a "consolidation" use case: wallet A consolidates to wallet B, and B inherits A's TDH for governance purposes. (Note: 0x00000000000076A84feF008CDAbe6409d2FE638B is the standard delegate.cash registry, NOT the 6529-specific consolidation contract; v3 of this protocol uses the latter.)

For $THODL:

  • Wallet A = BuyerContract (holds the growing NFT collection).
  • Wallet B = the consolidation target — a Safe multisig controlled by the protocol, whose signers execute $THODL holders' governance decisions.
  • Every meme-card purchase by BuyerContract mechanically increases B's voting weight on 6529.io.

The callDelegationRegistry(bytes) function on BuyerContract (v4) lets the Safe owner register / revoke consolidations via calldata, restricted in two layers: (a) the registry address is immutable (set in constructor, no setter exists), and (b) the function only accepts the 6 hardcoded 4-byte selectors of known 6529 NFTDelegation methods (register/revoke/update/batch + sub-delegation variants). This prevents any future code path that could be weaponised to drain assets.

6.2 How $THODL holders direct the vote

Off-chain governance (Snapshot.org-style) where 1 $THODL = 1 vote:

  1. A proposal is opened in the $THODL snapshot space (e.g., "How should we vote on 6529 Proposal #N?").
  2. $THODL holders vote with their balances at the snapshot block.
  3. The outcome is published.
  4. The Safe signers execute the decision by casting the corresponding vote from the consolidation wallet on 6529.io or the relevant 6529 governance endpoint.

Over time, the Safe can be replaced by an on-chain voting module that automates step 4, removing the last trust assumption. The contract architecture already accommodates this: callDelegationRegistry accepts arbitrary calldata, and there is no requirement that the owner be a human-controlled multisig.

6.3 Why this matters

For a 6529 community member who wants voice without spending hundreds of ETH on individual cards, $THODL is the most capital-efficient path to leverage. Buying $THODL:

  • Immediately gives a proportional claim on whatever TDH the contract holds today.
  • Gives a proportional claim on all future TDH accrual as the treasury buys more cards.
  • Scales with the entire community's trading activity, not just the holder's own.
  • Requires no operational overhead (no card selection, no listing management, no consolidation calls).

6.4 Shared TDH usage — activation at 100,000 TDH

The treasury accrues TDH from the moment its first NFT is purchased and registers consolidation. To avoid premature, low-signal governance participation while the vault is still small, the protocol gates shared TDH usage behind a measurable on-chain milestone.

Trigger: when the BuyerContract treasury reaches 100,000 accumulated TDH (verifiable from the 6529 NFTDelegation registry + BuyerContract NFT inventory at any moment), the protocol activates the shared-TDH layer.

What "shared TDH usage" means:

  • $THODL holders can collectively direct the consolidation wallet's TDH on 6529 governance votes (via Snapshot-style off-chain process, 1 $THODL = 1 vote, executed by the Safe).
  • TDH-gated 6529 ecosystem features (community access, drops, boycotts, partnerships) become available pro-rata to $THODL balance.
  • The protocol publishes a public TDH dashboard reflecting (a) total vault TDH, (b) per-$THODL TDH share, (c) live governance action queue.

Why 100,000 TDH: this is the threshold below which the vault's vote is too small to be meaningful in 6529 governance and above which the per-$THODL share becomes practically usable. At 100k TDH and a fully diluted 69.42M $THODL, the per-token entitlement is 100,000 / 69,420,000 ≈ 0.00144 TDH/token. A holder of 1M $THODL controls ~1,440 TDH worth of governance weight, which is meaningful in mid-sized 6529 votes.

Pre-100k state: the consolidation wallet is registered, the TDH is accruing, and it is passively visible on 6529.io. The Safe does not direct it, $THODL holders do not vote on it; it simply earns reputation in the background. This avoids governance theatre while the protocol is still warming up.

Post-100k state: the protocol publishes the activation transaction and from that block onward the shared-TDH governance pipeline is open. The threshold is one-shot — once crossed, shared usage stays on permanently.


6.5 Long-term vision — on-chain oracle migration & TDH activation

The current architecture is deliberately conservative: it ships what is provably safe today on Ethereum L1, while leaving room to upgrade the trust assumptions as the surrounding ecosystem matures. Two specific future milestones are committed to as part of the protocol's direction.

1. On-chain oracle migration when the 6529 chain launches.

The price oracle that selects the next 6529 Meme to buy is currently an off-chain service (see §2 step 4 and §4 of this whitepaper). It signs BestListing(tokenId, priceWei, validForBlocks, nonce, deadline) messages off-chain and the on-chain BuyerContract enforces freshness, signer authorization and price bounds before honoring the trigger. This is the right design today because there is no general-purpose, low-cost on-chain way to read live OpenSea listings from an Ethereum L1 contract.

When the 6529 chain launches, an on-chain oracle becomes architecturally feasible: native access to the 6529 NFT layer, lower per-call cost, and a settlement environment where listing data and trigger logic can co-exist without introducing trust shortcuts. The protocol commits to migrating the price-discovery path on-chain as soon as that infrastructure is live and audited:

  • The off-chain signer becomes redundant — the BuyerContract (or its 6529-chain twin) reads listings directly from the chain and computes the best-PPTDH candidate in a view function.
  • The GaslessOracle relay degenerates to a thin adapter or is retired entirely. Authorized-signer state and the setOracleHub knob are no longer load-bearing.
  • The trigger becomes fully trustless: no key, no off-chain process, no signer to compromise. The same on-chain logic that any user can verify also fires the buy.
  • The setSeaport / setOracleHub adjustability described in §7 collapses into a one-shot migration, after which both knobs can be permanently locked.

This is a meaningful reduction in the residual trust surface of the protocol, and it is the single largest decentralization upgrade still pending. Until 6529 chain is live, the off-chain oracle remains the operationally correct choice — but it is explicitly an interim design.

2. Shared TDH activation at 100,000 TDH.

When the BuyerContract treasury accumulates 100,000 TDH (verifiable from the 6529 NFTDelegation registry + the contract's NFT inventory at any moment), the shared-TDH layer described in §6.4 turns on. From that block onward $THODL holders can collectively direct the consolidation wallet's TDH on 6529 governance votes, TDH-gated 6529 ecosystem features become available pro-rata to $THODL balance, and the public TDH dashboard goes live. The 100k threshold is one-shot — once crossed, shared usage stays on permanently. Until then the consolidation wallet still accrues TDH passively in the background, but $THODL holders do not vote on it. See §6.4 for the full mechanics and the rationale for this specific number.

Why both of these matter for the long-term thesis.

The two milestones together convert $THODL from "a token with a credible mechanic on day 1" into "a token whose remaining trust assumptions are scheduled to shrink toward zero". The on-chain oracle migration removes the only off-chain operational dependency in the buy loop; the 100k TDH activation removes the only governance gate that was set as a sanity bound at deploy. Neither is conditional on team discretion — both fire automatically (or as a one-time, publicly announced migration) when the on-chain conditions are met.


7. Protocol parameters and adjustability

Most values are set at deploy and cannot change. The small set that can change is controlled by the Safe multisig and publicly observable on Etherscan.

ParameterContractValue at deployAdjustable?By whom
Total supplyTHODL69,420,000 × 1e18No (only burn can reduce)
Fee BPSTHODL900 / 100 (9%/1%)No — hardcoded constant
Fee recipientsTHODLBuyerContract, dev walletNo — set-once immutables
AMM pair registryTHODL{ univ2_weth_pair: true } after launchYes (add future pools)Owner
Fee exemption listTHODLdev, launcher, owner, buyerYesOwner
Seaport addressBuyerContract0x000…068F… (Seaport 1.6)Yes (setSeaport) — adapts to future Seaport upgradesOwner
6529 NFTDelegation addressBuyerContract0x2202CB9c…No — immutable (v4 lock)
Allowed delegation selectorsBuyerContract6 hardcoded 6529 functionsNo — set in constructor
Memes contractBuyerContract0x33FD42…AaD17aF1No — constant
Purchase intervalBuyerContract15 blocks (~3 min)No — constant
Gas refund capsBuyerContract100 gwei / 0.01 ETHNo — constants
Min ETH for triggerBuyerContract0.1 ETH (deploy)YesOwner
Max NFT priceBuyerContract5 ETH (deploy)YesOwner
Min card supplyBuyerContract299 (deploy)YesOwner
Oracle hub addressBuyerContractGaslessOracleSet-onceOwner
Authorized oracle signersGaslessOracleempty at deployYes (add/revoke)Owner
Sale rateGenesisSale428,700 THODL/ETHNo — immutable
Per-wallet capGenesisSale0.26116 ETHNo — immutable
Sale deadlineGenesisSaledeploy + 14 daysNo — immutable
Merkle rootMerkleAirdrop0x00 at deploySet-once, then lockRoot()Owner
Emergency enabledBuyerContracttrue at deployOne-shot OFF via disableEmergency()Owner

The pattern is "conservative defaults, minimal adjustability, maximum immutability". The Safe can tune a few operational knobs (gas cost caps, oracle authorisation, consolidation target) but cannot change the core economic rules.


8. Deployed addresses (mainnet)

Deployed and Etherscan-verified on Ethereum mainnet, 2026-04-27 (v4 — closes the callDelegationRegistry/setDelegationRegistry drain vector found in the second /ultrareview pass: delegationRegistry is now immutable and callDelegationRegistry enforces a hardcoded selector allowlist of the 6 known 6529 NFTDelegation methods. Versions v1/v2/v3 are abandoned).

Contract / WalletAddressEtherscan
THODL (ERC20 token)0x610539129D0E646580520dA6A37405f675a2979eview
BuyerContract (treasury + NFT vault)0x1D1946e1Cc50545C2A10ca7A668444bEeC83e5c3view
GaslessOracle (EIP-712 relay)0x4830696eA721808C1EB066107b2bBb26997E9686view
GenesisSale0x709598cf21b7140AbD420D701709fffBd62F5a25view
MerkleAirdrop0xE26030c0895FfeF07B5dcC767D86b763Dd2391E2view
Uniswap V2 pair (WETH/THODL)(created at finalize)
Safe owner (multisig 2-of-3)0x5DDBC7F93a683d596E0D1f3a93907319ae5C7a47view
Dev wallet (1% fee recipient)0x00830AF6B0dD2fd8466d69aAa6481Ff3944F9daFview
Authorized oracle signer0x6d9191a12fd6f1aa247db30cb14072c6cba1a6d9view
TDH consolidation target0x1293d6D1CC65Dcad008CdccfD9feB4f90F94923aview
Seaport 1.6 (NFT marketplace)0x0000000000000068F116a894984e2DB1123eB395view
6529 NFTDelegation (consolidation registry)0x2202CB9c00487e7e8EF21e6d8E914B32e709f43dview

9. External dependencies

DependencyUsed forAddress
Uniswap V2 RouterLP seed, fee conversion, buyback0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D
Seaport 1.6NFT purchase0x0000000000000068F116a894984e2DB1123eB395
6529 Memes (ERC1155)Target collection0x33FD426905F149f8376e227d0C9D3340AaD17aF1
6529 NFTDelegationTDH consolidation registration0x2202CB9c00487e7e8EF21e6d8E914B32e709f43d
OpenZeppelin ContractsERC20, ERC1155Holder, Ownable2Step, MerkleProof, EIP-712, ReentrancyGuardv5.0.2

All four external protocols are blue-chip, widely audited, and have been in production on mainnet for years with billions of dollars in cumulative throughput.


10. Links


11. Glossary

  • TDH — Total Days Held. 6529's on-chain holder reputation score. Per-copy-per-day rate = 3941 / edition_size.
  • PPTDH — Price Per TDH. price_wei / tdh_rate. Lower is better.
  • FOT — Fee-on-Transfer. An ERC20 that takes a fee on certain transfers (here: AMM-pair transfers only).
  • Consolidation — 6529's mechanism to combine the TDH of multiple wallets under one primary wallet for governance purposes.
  • LP — Liquidity Provider / Liquidity Pool. In this context, the Uniswap V2 WETH/THODL pool.
  • Seaport — OpenSea's open-source NFT exchange protocol. Used here for on-chain NFT fulfilment.
  • EIP-712 — Ethereum standard for typed structured data signing. Used by the oracle to sign BestListing payloads without spending gas.
  • Safe (Gnosis Safe) — Smart-contract multisig wallet. Here, the owner of all $THODL contracts.
  • Dead address0x000000000000000000000000000000000000dEaD. A canonical address with no known private key; sending tokens to it effectively burns them.

This document describes the protocol as implemented in the open-source code at github.com/6529STR/tdhodl. Where this document and the code disagree, the code is authoritative.