Shadow Protocol Whitepaper

Shadow Protocol is the first synthetic asset protocol dedicated to Chinese A-share equities. Users mint synthetic tokens representing price exposure to any Shanghai (SSE) or Shenzhen (SZSE) listed stock by over-collateralizing USDG. A multi-source oracle keeps synthetic prices in lockstep with the real market. A native launchpad allows any new token to be paired with a synthetic A-share as its base pool. The protocol runs on Robinhood Chain (Arbitrum-stack L2), is fully permissionless, and is available to non-US and non-PRC-resident users worldwide.

China's A-share market — approximately $10 trillion in capitalization across 5,000+ listed companies — is the world's second-largest equity market. It is also, structurally, unreachable by every existing tokenized-stock protocol.

Four walls make this impossible for the standard fully-backed model:

• Capital controls. The renminbi is not freely convertible. No offshore custodian can wire USD to buy A-share stocks through normal channels.
• CSRC prohibition. China's securities regulator has explicitly banned offshore tokenization of A-shares. Real custody offshore is illegal.
• No global custody. Only QFII institutions with Stock Connect quotas can legally hold A-shares. These channels do not permit tokenized re-issuance.
• Trading hours. A-shares trade only 4 hours per weekday. A fully-backed wrapper inherits those windows.

As a result: no version of Robinhood Stock Tokens, Backed bTokens, xStocks, or Ondo Stocks includes a single A-share. They cannot, structurally.

Shadow takes the only viable path: synthetic exposure via over-collateralized CDP (Collateralized Debt Position) — proven at scale by MakerDAO (DAI) and Synthetix (sUSD, sETH).

The design is composed of three modules:

• Multi-source zkTLS oracle. Prices are drawn from three independent Chinese finance sources (Sina Finance, EastMoney, Xueqiu). Each source posts a cryptographic proof (Reclaim Protocol / TLSNotary) that a specific URL returned a specific price. On-chain contract takes the median. If sources disagree by more than 3%, the update is rejected. No single point of failure.
• CDP Vault. Users deposit USDG at ≥ 350% collateral ratio to mint syn-tokens. Liquidations at 130% pay a 10% bonus to keepers. Standard MakerDAO pattern, hardened for thin secondary liquidity.
• Peg maintenance via mint/redeem arbitrage. Any imbalance between secondary market and oracle price is closed by arbitrageurs who can always mint or redeem at oracle price. Secondary market price stays within a ±0.5% band determined by protocol fees.

Shadow ships five on-chain contracts:

• PermissionedOracle — v1 price relayer, migrating to MultiSourceOracle in v2
• SyntheticAsset (ERC-20) — one deployment per listed ticker; ownership held by Vault
• Vault — CDP mint/burn/liquidate engine
• MarketFactory — permissionless market creation; anyone stakes SHADOW to open a new stock
• LaunchpadRouter — one-click token launch with syn A-share as base pool

Off-chain, a Cloudflare Worker fetches prices from Chinese finance sources every 30 seconds, produces signed price updates, and either pushes them on-chain (v1) or publishes to a public feed consumed by user transactions (v2 Pull Oracle model).

• v0 (Live) — Sep 2026. 5 A-shares deployed on Robinhood Chain mainnet. Permissioned oracle. CDP mint/burn. 150+ tickers browsable with real-time K-lines.
• v1 — Oct 2026. SwapVault contract (direct 1:1 swap UX for retail). LaunchpadRouter deployed. Top 500 A-shares onboarded. Uniswap secondary markets seeded.
• v2 — Q4 2026. Migration to Pull Oracle model. zkTLS multi-source oracle. EIP-1167 clone factory for cheap ticker deployment. Full 5,000+ A-share coverage.
• v3 — Q1 2027. Automated dividend and corporate-action synthesis via SSE announcement zkTLS. Continuous proof-of-solvency. Tranched insurance fund.
• v4 — Q2 2027. Extension to global equities inaccessible elsewhere: Vietnam HOSE, Saudi Tadawul, Chinese pre-IPO (SpaceX / ByteDance / SHEIN). Full Shadow-branded ecosystem.

• Oracle risk. A single manipulated data source can push a bad price. Multi-source consensus + circuit breaker (reject if any source deviates >3% from median, or if new price deviates >20% from previous) reduces but does not eliminate.
• Smart contract risk. v0/v1 contracts are unaudited. Beta caps ($500/user, $10k/pool) limit exposure. Audit planned pre-v2.
• Regulatory risk. Although designed for non-US and non-PRC users, any global jurisdiction may take action. Legal opinion from BVI/Cayman counsel to be published pre-v1.
• Liquidity risk. Without deep secondary pools, users may face wide spreads. v1 addresses this with SwapVault + Uniswap seed pools.