Robinhood Chain: who orders transactions?

Control profile

Transaction ordering

A single sequencer operated by Offchain Labs on Robinhood's behalf orders the normal transaction path; fraud-proof validation is limited to two permissioned validators.

Escape hatch

The canonical Arbitrum bridge exposes a seven-day Ethereum withdrawal path, but a transaction-filtering precompile can reject even L1 force-included transactions.

Upgrade authority

Routine Security Council actions require 6 of 8 signatures and a seven-day timelock; 7 of 8 can execute emergency action immediately, and contract discovery retains a direct EOA-admin risk.

Liveness record

Ethereum settlement and the Arbitrum challenge period constrain ordinary invalid state, but only permissioned validators may challenge and the documented filter can block a transaction submitted through L1. The bridge path therefore does not provide an unconditional self-service exit under the old rules when the operator or privileged control plane is the source of failure.

Ketju assessment

REJECTED on independently verified control facts. Robinhood publishes unusually clear governance: an eight-seat council, two permissioned validators, a routine timelock and an emergency threshold. The regular delay is useful, but it is not the whole system. Emergency action bypasses it, transaction filtering can reach force-included messages, and L2BEAT discovery reports a direct externally owned account in the upgrade path. A seven-day canonical withdrawal is not an enforceable escape window if privileged actors can change or filter that path before the holder completes it.

Observable review triggers

• Fraud-proof validation becomes permissionless and remains so for 90 consecutive days
• The transaction filter is removed or can no longer reject an L1 force-included transaction
• Every direct EOA upgrade permission is removed and emergency upgrades receive an enforceable exit delay
• Any sequencer, validator, bridge, or transaction-filter interruption prevents finality or exit for more than 6 hours

These triggers make the judgment monitorable. They are not predictions; each identifies a fact that would revoke or force review of the current assessment.

Advisor implementation questions

1. Does the client’s thesis require censorship resistance, or primarily low-cost settlement?
2. Can the client exit without cooperation from the normal transaction-ordering party?
3. Who can upgrade bridges or contracts, and what delay applies?
4. Does the asset introduce an issuer weaker than the chain grade?
5. What evidence will show a halt, censorship event, or governance change?