Robinhood Chain: who orders transactions?

Who controls it

Transaction ordering

A single sequencer operated by Offchain Labs on Robinhood's behalf orders the normal transaction path; fraud-proof validation is limited to two permissioned validators.

Escape hatch

The canonical Arbitrum bridge offers a seven-day withdrawal path to Ethereum, but a transaction-filtering precompile can block even L1 force-included transactions.

Upgrade authority

Routine Security Council actions require 6 of 8 signatures and a seven-day timelock; 7 of 8 can execute emergency action immediately, and contract discovery retains a direct EOA-admin risk.

Halts and outages

Ethereum settlement and the Arbitrum challenge period constrain ordinary invalid state, but only permissioned validators may challenge. The documented filter can also block a transaction submitted through L1. So the bridge does not guarantee a self-service withdrawal under the old rules when the operator or the privileged controls cause the failure.

Ketju assessment

Ketju does not approve Robinhood Chain: an emergency council can act without delay, and a transaction filter can block even force-included withdrawals. Ketju verified these control facts independently. Robinhood publishes clear governance: an eight-seat council, two permissioned validators, a routine timelock and an emergency threshold. The routine delay helps, but emergency action bypasses it. L2BEAT discovery also reports a direct externally owned account in the upgrade path. A seven-day canonical withdrawal does not protect a holder if privileged actors can change or filter it before the holder completes it.

Review triggers

• Fraud-proof validation becomes permissionless and remains so for 90 consecutive days
• The transaction filter is removed or can no longer block an L1 force-included transaction
• Every direct EOA upgrade permission is removed and emergency upgrades receive an enforceable delay before they take effect
• Any sequencer, validator, bridge, or transaction-filter interruption prevents finality or withdrawals for more than 6 hours

Each trigger names a fact anyone can observe. If one occurs, Ketju will review the assessment again. None is a forecast.

Questions before use

1. Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
2. Can the client withdraw without help from the party that normally orders transactions?
3. Who can upgrade bridges or contracts, and what delay applies?
4. Does the asset introduce an issuer weaker than the chain grade?
5. What evidence will show a halt, censorship event, or governance change?