GOLD RUSH

The onchain race between stocks and gold. Pick an asset. Win the Rush.

Every Rush starts with a price snapshot. Gold and the stocks are normalised to 0% and tracked on relative performance until the round closes. Same starting line, best return wins. Settled on Hyperliquid.

Gold is always in the race. The stocks change. The benchmark doesn't.

This is the working spec. It is written to be argued with before anything is deployed, and to be published as the app's documentation afterwards.

The short version

A Rush is a round with four lanes: gold, and three stocks. You back one lane with HYPE while the round is open. When it closes, the lane with the best return since the snapshot wins, and its backers split the pot. Nobody sells you anything, nobody takes the other side: the losers' HYPE is the winners' prize, minus a 5% rake.

The rake is the protocol. It buys real gold on chain and puts it in a vault that has no owner and no sweep. $RUSH can be burned at any time for a pro rata share of that vault. Every Rush adds gold and never removes it, so the floor under the token only goes up.

A game whose house always buys gold, and a token whose floor is the gold it bought.

What we measured before designing anything

Everything below was read on chain on 2026-08-28, and it is the reason the design looks the way it does rather than the way the pitch would like it to.

Two conclusions, and the whole protocol follows from them:

1. The race is settled on HyperCore spot, because that is the only equity price a contract can read at all. Since those books are thin, the settlement is built to survive a manipulated print rather than to pretend one cannot happen.
2. The treasury is XAUt0 on HyperEVM, because that is where gold is actually tradeable, and a vault you cannot redeem against is a promise, not a floor.

A Rush, end to end

The lanes

Four lanes: gold plus three stocks, drawn from an allowlist sealed at deploy. Gold is priced by GoldOracle on HyperEVM; the three stocks are priced by HyperCore's spot precompile. Same scale, same money, two different venues because the two assets are honestly liquid in two different places. The stocks rotate by round number, so the roster changes without anyone choosing it and no asset can ever be added later. Gold never rotates out. That is the brand and it is also the rule.

The allowlist as it stands, with what each one printed over the last seven days:

The snapshot, and why it is a median

A single reading of a thin book is worth nothing: one $500 trade sets it. So a Rush never reads a price once.

• Sampling is permissionless. Any address can call sample(), at most once every 20 minutes, and a sample records every lane at once. Nobody can choose which asset to snapshot.
• The start price of each lane is the median of the samples taken during the open phase.
• The end price is the median of the last six samples of the run.
• Return is end / start − 1, in basis points, and the best return wins.

To move a median, an attacker has to hold a false price across more than half of many samples. The counter is cheap and available to everyone who stands to lose: a few dollars of trade prints the true price back, and a single sample() call records it. The defence is not that manipulation is impossible, it is that defending costs about the same as attacking and the pot is capped.

Three rules that come straight from the measurements

• DNF. A lane whose sampled price never changes during the round did not race: it is excluded from the ranking. A dormant listing cannot win by standing still. Gold cannot be caught by this rule in practice, which is the other reason its price comes from a market that never stops.
• Ties go to gold. If two lanes finish level, or if every stock is DNF, the benchmark takes it.
• The pot is capped. A Rush accepts at most a fixed amount of HYPE, set at deploy. The cap exists so that the prize can never grow past what it costs to corrupt a thin book. It rises only by a governance-free rule: it cannot be changed after deploy.

Payout

Winners split the pot pro rata to their stake, minus a 5% rake. If nobody backed the winning lane, nothing is paid: the whole pot rolls into the next Rush. A Rush that nobody read right makes the next one worth more.

Where the rake goes

🔴 There is no arbitrary call anywhere. The vault's buy path is a pinned pool address and a pinned token, not a spender plus calldata. That distinction is the difference between a treasury and a back door, and it has already cost this shop one protocol.

🔴 There is no sweep. No owner can move gold out of the vault. The only way out is the one every holder has.

$RUSH, and the floor

• Fixed supply, minted once at deploy, no mint function, no owner, no tax. A plain ERC-20 that a scanner reads as clean, because that is what it is.
• Burn to redeem. Burning x $RUSH pays you x / totalSupply of the vault's XAUt0, in gold, in the same transaction. Redemption is the floor, not a promise about one.
• Every Rush adds gold and burns supply. Gold per token can only rise: the numerator grows with the rake, the denominator shrinks with every redemption and every buy and burn.

/// The floor, in gold, per token. It has no path down.
function floor() external view returns (uint256) {
    return goldVault.balanceOf() * 1e18 / rush.totalSupply();
}

⚠ Honest about what the floor is not: it is a claim on the gold the protocol has already bought, not on the gold it might buy. If nobody ever plays a Rush, the vault stays where it is and the floor stays where it is.

How the pieces are laid out

On HyperEVM (chain 999)

• RushBook — the rounds: backing, sampling, settlement, payout, and the roll.
• GoldOracle — dollars an ounce from two pinned pools, half hour TWAPs, no keeper and no setter.
• GoldVault — holds XAUt0, buys it through one pinned pool, pays redemptions. No owner, no sweep.
• RushToken — the ERC-20, fixed supply, burn to redeem.
• LpDesk — the deployer's launch position: single sided, and recoverable with one pull().

On HyperCore

• the eight spot markets the lanes read, through the price precompile. The protocol holds no account there and needs none: it reads, it never trades on Core.

Venue: Project X v3 (0xFf7B3e8C…), for the $RUSH pool and for the vault's gold buys. Proven on mainnet: canonical callback names, single sided add, and a pull() that fits a small block.

What the operator can and cannot do

Sampling, settling, redeeming and claiming are permissionless. If the operator disappears, Rushes still settle and holders still redeem; only the conversion of rake HYPE into gold would stop, and that HYPE stays in the vault's own balance until somebody calls it.

What it costs to run

Measured on a fork of the live chain with the real scripts, 23 tests green:

The risks, in plain words

• Thin books, on the stock side. The three stock lanes are priced by markets that trade a few hundred dollars a day. The median, the DNF rule and the pot cap bound the damage; they do not make the books deep.
• Last trade, not oracle. The precompile returns the last price traded on HyperCore, so a lane's price can be hours old. A stale price that never moves is DNF, which is the honest treatment.
• Parimutuel, not a market. You are not buying exposure to a stock. You are backing which lane moves best, against everyone else in the round.
• Gold is a token. XAUt0 is Tether Gold's HyperEVM representation. The floor is worth what that token is worth, and it carries that issuer's risk.
• This is a game. Backing a lane is not investing, the payout is not income, and $RUSH is not a share of anything.