The law of the hall.

1The entry

The first time an address buys $USHER through the house router, the router passes two things to the hook: the buyer, read from msg.sender, and the usher the buyer named. The hook writes usherOf[buyer] = usher if, and only if, three things are true at once: the field is empty, the usher is not the buyer, and the usher is not the zero address.

Once written, the field is sealed. There is no function to change it, no function to clear it, and no owner who could add one. Your usher is the person who brought you, forever, whatever either of you does next.

A first buy with nobody named writes the field empty, and an empty field is never filled later. That is the one thing to know before your first buy, and it is repeated in section 9.

2The toll

Every swap in the pool pays a toll: a fixed share of the trade, taken in the quote asset by the hook after the swap. The toll is the same for everyone, at every moment, whether the address has an usher or not, whether it is buying or selling.

The toll is split in two, and the split is a constant of the deployment:

• The usher share. One part of the toll, called u on this page, that goes where section 3 says.
• The rest. Everything that is not the usher share burns. Nothing is kept by a team, and there is no switch to change that later.

Both numbers are set at deploy and published in section 10. Until then they have no value, and no figure you read elsewhere is ours.

3The payout

After each swap the hook reads one field, usherOf[trader]. If it holds an address, the usher share is credited to that address, in full. If it is empty, the usher share burns, in full. There is no third case and nothing is held back in either.

What is credited is claimable in pull: an usher calls claim and receives everything the rule has credited to it so far. Nothing is ever pushed from inside a swap, so no recipient can make a swap fail by refusing what it is owed.

Buys and sells alike. An address that sells everything it holds still pays the toll on that sale, and its usher still receives the cut.

4One level

The contract holds one field per address and reads one field per swap. It never reads usherOf[usherOf[trader]]. There is no function that walks up a chain, because there is no chain: an usher earns on the addresses it brought, and on nothing those addresses bring in turn.

This is not a setting. It is the shape of the storage. A programme with tiers needs somewhere to keep the tiers, and this contract has nowhere to keep them.

The hall on the home page shows it: bring an address, then watch that address bring another. The second one pays the first, not you.

5Nothing to hold

Being an usher requires no balance of $USHER. The cut depends on one thing only: the swaps of the addresses you brought. You can hold nothing and be paid on a thousand trades; you can hold a great deal and be paid on none, if you brought nobody.

That is deliberate. The token pays the people who bring, not the people who keep. What it costs is written in section 9: the burn is the only pressure on the supply.

6Nothing hidden

usherOf for every address, the amount credited to every usher, the number of addresses each usher brought: all of it is readable in the contract, by anyone, at any block. The site adds nothing to it. It sorts.

The ushers' board on the home page is that sort, and nothing else. It cannot show you a number the contract does not hold.

7The router

In a Uniswap v4 hook, the sender of a swap is the router that made it, not the person behind it. An usher is attached to a person's address, so the hook needs the real one. The house router provides it: it reads msg.sender itself and passes it to the hook in hookData, together with the usher named. The buyer is never a parameter anyone can set.

The hook accepts hookData only when the sender is the house router. A swap that comes by any other path still pays the toll, still burns what it burns, and writes nothing: no usher is recorded, and the usher share of that swap burns. Without the router, everybody is without an usher.

The router is also where the programme would be attacked. If anyone could pass an arbitrary hookData, they could write any usher onto any address. Two checks close that door: the hook checks that the sender is the router, and the router never lets the buyer field come from anywhere but msg.sender. Both are the subject of the audit that has to pass before anything opens.

8What the contracts enforce

9What can go wrong

Tiers, through the back door. An usher could promise, off chain, a slice of its cut to the people it brings, and rebuild a ladder that way. The contract cannot see that and cannot stop it. What it holds to is narrower and exact: the contract itself pays one level, and no more.

A first buy without an usher. An address whose first buy went around the router has no usher and can only get one at its first buy through the router. An address whose first buy went through the router with nobody named will never have one: the field is written empty, once. Read that twice before your first buy.

Bringing yourself. An address cannot be its own usher, and a second address bringing the first is a round trip that loses: it pays the whole toll to get back the usher share, and the rest burns. There is nothing to gain and it is left open on purpose.

The recruiter who holds nothing. Somebody can bring a thousand addresses and never hold a token. That is the design. The price of it is that the burn is the only thing pulling on the supply; nobody is paid to keep.

The cut nobody claims. An usher that never calls claim leaves its cut in the contract. It is not lost and it is not burned. Whether it should burn after a long enough silence is an open question, and the FAQ says so.

The share itself. Too small a share and nobody bothers to bring anyone; too large and the burn stops mattering, and the token lives on recruiting alone. The share is the one number this whole design turns on, and it is set only after it has been run against real traces of the chain.

The law is a page. The site can be wrong, or out of date. The contracts are the law, the explorer is the witness, and everything here is written to be checked against them.

10Parameters

Constants are fixed at deployment and published here. Until then, none of them has a value, and no number you may read elsewhere is ours.

11Chain and venue

Usher runs on Robinhood Chain, chain 4663, and trades on Uniswap v4 through the PoolManager at 0x8366a39CC670B4001A1121B8F6A443A643e40951. The pool is ours and the hook is ours; the protocol liquidity position is locked in a locker with no withdrawal function.

Gas is paid in ETH, at a gas price around 0.02 gwei on this chain. That matters here: writing an usher is one storage write per address, and paying one is one addition per swap. On a chain this cheap, the programme runs on every swap, however small, without the gas making it absurd.

Explorer: robinhoodchain.blockscout.com. Contract addresses are published on this page and on X at launch, and nowhere else. Anything else is somebody else's.