Holding dHOOD without staking earns nothing. That is deliberate - the reward is for committing, not for holding.

Weight is fixed at stake time and sets your slice of every distribution. Two people staking the same amount for 30 and 180 days earn in a 1:2 ratio - the longer commitment is not paid more per day, it is simply counted twice as heavily.

The 2% trading tax splits 0.5% to the team and 1.5% to stakers. Routing passes through the vault, which charges its own entry fee like it would anyone, so about 1.485% of each trade reaches stakers on the first pass and the ~0.015% remainder rides along in the next batch.

Both streams are denominated in dHOOD, so there is one payout asset and two counters. pendingRewards() returns them separately and the interface never collapses them into a single opaque "rewards" figure.

forfeit = shares × 20% × (time remaining / term)

20% at the moment you commit, 10% halfway, zero once served. The percentage is identical across terms; only the duration differs - which is why the term you pick matters most in the middle of it. Thirty days in, a short position is already free while a long one still owes 16.7%.

Forfeited shares are redistributed to everyone still staked. totalWeight is decremented before the forfeit is distributed, so an exiting staker cannot collect a slice of their own forfeit.

If the last remaining staker closes early there is nobody to pay, so the forfeit goes to the treasury rather than being stranded or dividing by zero.

distribute:  acc += rewardShares × 1e18 / totalWeight
pending:     weight × acc / 1e18 − debt

acc is a running total of revenue-per-unit-weight since deployment. debt is a watermark - where that total stood the moment you joined. What you can claim is everything the total has risen since: your weight times the gap.

A new position's debt is initialised to the current accumulator rounded up, so it can never be credited revenue distributed before it existed. Rounding down leaks 1 wei per position - enough to break the final withdrawal. Not hypothetical; see assurance.

The reason is one line of integer arithmetic. Payout is floor(w·acc₁/1e18) − debt, while the honest entitlement is floor(w·(acc₁−acc₀)/1e18):

debt = floor(w·acc₀/1e18)   →   floor(a) − floor(b)   can exceed floor(a−b) by 1
debt =  ceil(w·acc₀/1e18)   →   floor(a) −  ceil(b)   never does

That surplus wei is the fractional remainder other stakers' floored accruals left in the pot. Taking it means paying out more than came in - and here the reward asset is the staked asset, so it comes out of principal.

route() deposits into the vault, and the vault charges its entry fee like it would to anyone. So ~1% of each routed batch bounces back to the router and rides along in the next batch.

Each pass moves 100/101 of whatever is left, so the remainder converges to zero and every routed wei eventually reaches stakers. Nothing is lost - only delayed.

The alternative was exempting the router from the fee, which would make previewDeposit caller-dependent and break ERC-4626 compliance for everyone. A self-recycling residual is the cheaper trade.

Deposits revert with FeeRouterNotSet until the router is wired, so there is no window where an unwired vault accepts money. Overridden from stock ERC-4626: previewDeposit, previewMint, _deposit, and _decimalsOffset (returns 6).

The owner cannot touch positions, move staked shares, change terms, change the penalty, or pause anything. MAX_PENALTY_BPS and the term table are fixed at deployment. treasury is immutable.

notifyTradeFeeReward is callable only by the FeeRouter and is pull-based - the contract transfers the shares in itself rather than trusting that a prior transfer landed.

Holds no privileges over anything. The entire surface is route(), pendingAssets(), lifetimeRouted() and three immutable address getters.

route() is permissionless - anyone can trigger it, nobody can misdirect it. It reverts when there is nothing to route, when no one is staked, or when the pending balance is too small to convert to a whole share. In every case the balance waits for the next call; revenue is never lost.

Any onward transfer of the team share to FeeRouter is a manual decision. There is no schedule, no vesting and no minimum - nothing on-chain requires it to happen at all.

The staker share needs no change to the four contracts above to arrive: route() already forwards whatever HOOD reaches the router, whatever put it there. A tax hook will bring privileged capabilities of its own, though - at minimum whatever decides which addresses are taxed. None appear in the tables on this page because none exist yet.

The suite runs with fail_on_revert = true, and the handler guards its own preconditions rather than reverting. This matters: with reverts tolerated, a handler that silently fails every call still passes every invariant, and the run proves nothing.

stake() initialised each position's reward debt with a floored division. Rounding debt down credits a new position up to 1 wei of revenue distributed before it existed - 1 wei per position, accumulating.

In most staking systems that is invisible dust. Here the reward asset is the staked asset, so the shortfall eventually reaches principal:

staking cannot cover what it owes: 9789102232319278373992587352 < ...353
ERC20InsufficientBalance(staking, 6220287, 6220288)

The last staker to unstake could not withdraw. Off by one wei, funds stuck.

Fixed by initialising debt with Math.ceilDiv and saturating the subtraction so the now-slightly-high debt cannot underflow. Payouts are provably bounded by contributions; residual dust stays in the contract instead of being over-distributed.

All 35 unit tests passed with that bug present, including one named test_lateStakerDoesNotEarnEarlierRevenue. Finding it needed an adversarial ordering of stakes, distributions and exits.

A green suite proves nothing until it has been seen to go red. Injecting the bug back in turns invariant_stakingIsSolvent red with the exact wei shortfall, and testFuzz_lateStakerEarnsNoPriorRevenue produces a concrete counterexample. Reverting the mutation returns all 61 to green.