Robinhood Chain Mainnet

Fund ETH and prepare keys

Use a fresh deployer key that holds only gas funds, never a testnet key. The owner funds the deployer with enough ETH on chain 4663 for about 10 contract deployments and about 40 role and configuration transactions. Create a contract multisig on chain 4663 (threshold at least 2-of-3, separate hardware wallets) and send one test transaction through it. The script rejects an address without code and the deployer's own address as admin. The deployer key belongs only in a git-ignored .env used by Hardhat.

Real USDG from the official source

Take the canonical USDG address for Robinhood Chain from the issuer's or chain's official documentation, cross-check it on the explorer (symbol() is USDG, decimals() is 6, verified source) and set it as MAINNET_USDG. This documentation lists no address. The script re-checks code, decimals and symbol before sending anything.

Oracle contracts: Functions router, config, source, price sources, secrets

EmissionVerifier, RegistrySync and CarbonPriceOracle are Chainlink Functions consumers. First confirm in Chainlink's documentation that Functions is available on chain 4663 and take the router address and DON id for that chain from there. If it is not available, do not deploy against a stand-in; CarbonPriceOracle still works through the manual reporter fallback, while the other two cannot run.

1. Deploy with the real router (FUNCTIONS_ROUTER); constructors revert on a zero router.
2. Create and fund a Functions subscription (ideally owned by the multisig) and add the three contracts as consumers. Until then requests revert at the router.
3. setFunctionsConfig(donId, subscriptionId, gasLimit) on each contract (callback gas 200,000 to 1,000,000).
4. setSource(...) with the reference source for each contract (scripts/functions/sources.js), and compare sourceHash() with the expected hash.
5. CarbonPriceOracle.setPriceSources([...]) with 1 to 5 operator-chosen HTTPS endpoints. Until set, price requests revert with No price sources.
6. If a data provider needs an API key, upload the secrets to the DON and attach them with setDONHostedSecrets(slotId, version); always set allowedUrlPrefix to the host that deserves the key. The reference sources need no secrets.
7. Optional manual fallback: the admin grants ORACLE_REPORTER_ROLE to the reporting multisig (it is never granted by a constructor). Then the app labels the price card Manual report when lastPriceManual is true.

Full details: contracts/scripts/functions/README.md and audit/abi-changes-oracle.md. The mainnet script does not give EmissionVerifier the issuer role unless ENABLE_ORACLE_ISSUANCE=yes; leave issuance through the oracle path off until the sources, secrets and data semantics are finished, audited and tested.

Registry endpoints

RegistrySync creates its three default registries (VERRA, GOLD_STANDARD, ICM) inactive and without an endpoint. For each registry you use, call setRegistryEndpoint(name, url) (an https:// URL template containing {serial}) and then setRegistryStatus(name, true). CarbonRegistry is a separate contract (company and trader profiles) deployed with the multisig as admin.

Dry run, broadcast and core handover

Run npm run deploy:mainnet without confirmation, read the printed summary line by line (chain id, USDG, router, DON, subscription, multisig, issuers, fee, minimum price, KYC gate), then run CONFIRM_MAINNET=yes npm run deploy:mainnet. The script is resumable, grants every role to the multisig, has the deployer renounce every role, and throws on the first mismatch. Mainnet launch limits (defaults: 25 bps fee, KYC gate on) and the full gate list are in the runbook.

CARB token stack (optional, only when CARB is launched)

CARB is not launched yet and this step stays out of a first deployment unless the owner decides otherwise and legal advice and permits are in place. Order from section 7 of contracts/contracts/docs/TOKEN.md:

1. CarbToken(recipient = treasury multisig)
2. CarbStaking(carb, admin = multisig, warmup, cooldown, thresholds, discounts)
3. IssuerBond(carb, admin = multisig, minBond, unbondDelay, disputeWindow, bondRequired, slashTreasury). It is collateral/slashing only and never receives any NFT role or mint authority.
4. marketplace.setFeeDiscountProvider(staking) (admin)
5. Governance, only at stage 1: deployGovernance, applyGovernanceSetup, assertGovernanceBoundaries from scripts/lib/governance-setup.js

Publish the real parameter table at launch. The defaults in the helper are suggestions that the owner may change.

Issuance-role handover

The multisig must hold the NFT admin role and the deployer must hold no role. NATIVE_ISSUER_ROLE is for native/oracle issuance; EXTERNAL_ISSUER_ROLE is separate and only for fresh RegistrySync-attested external credits. IssuerBond is never an issuer. Governance never receives issuance power.

Governance stages 0, 1, 2

Stage 0: the multisig holds every role. Stage 1: the timelock additionally receives PARAMETER_ROLE and SLASHER_ROLE once voting, delegation and turnout have been observed. Stage 2: only after a trial period without incident and with a distributed, delegated supply, the multisig renounces those two roles and keeps admin, pause, KYC, fee withdrawal and all issuance control. Planned and not committed; see Governance.

Verify on Blockscout

npm run verify:mainnet, then check "Contract: verified" for each address on https://robinhoodchain.blockscout.com. On the Read contract tabs: the deployer has no DEFAULT_ADMIN_ROLE, the multisig has it, paymentToken() is the real USDG, paymentDecimals() is 6, nothing is paused. Run a smoke test with tiny amounts, and set up monitoring before opening the app.

Environment variables for Vercel

node scripts/update-carb-env.js --network robinhoodMainnet writes the contract addresses into the app's .env.local; copy the same values into Vercel (they are inlined at build time) and redeploy. See below.