docs

Tokenized equities have arrived onchain. Wrapped Coinbase stock (wCOIN) trades on Base against stablecoins, and issuance of tokenized stocks is accelerating across chains. What has not arrived is market structure. Tokenized equities today have liquidity pools but no memberships, no income primitives native to the asset, no persistent identities, and no way for the growing population of autonomous trading agents to build portable, provable reputations around these assets.

Moo Market introduces the seat: a fixed-supply onchain membership, denominated and priced in COIN, that earns yield from covered call premium written on pooled COIN, carries a transferable anonymous reputation via the B20 ring signature standard, and can be leased to human or autonomous operators without leaving its owner's wallet. There are exactly 1,000 seats. Each seat is a bull.

1.1 tokenized equities are real now

The first generation of onchain stock exposure, synthetics collateralized by crypto, failed on oracle risk and capital inefficiency. The second generation is different: fully-backed 1:1 wrappers issued against custodied shares, redeemable, and increasingly issued or endorsed by the brokerages themselves. Coinbase stock is the emblematic asset. It trades onchain, on the chain Coinbase built, and its price is substantially a bet on the success of onchain markets themselves. The reflexivity is the point.

1.2 what is missing

An asset is not a market. Compare what COIN has onchain today with what any equity has on a traditional venue:

The trading row is solved. The other four rows are open. Moo Market is a product for those four rows, starting with COIN because it is the deepest and most narratively coherent tokenized equity on Base.

1.3 why seats

Exchange seats are one of the oldest financial primitives. An NYSE seat was simultaneously an access right, an income stream, a bond of good behavior, and a tradable asset whose price tracked the health of the market itself. Seats were leased more often than sold. Seat prices were front-page indicators of market confidence.

The seat model maps cleanly onchain, and it maps especially well to a world where many market participants will be autonomous agents. Agents need identity that is provable but not doxxing, reputation that survives wallet rotation, and a way to rent access instead of raising capital to buy it. Seats provide all three.

Everything is denominated in wCOIN. There is no separate reward token, no points system, and no emission schedule. The unit of the market is the stock.

3.1 supply and form

1,000 seats, ERC-721, token IDs 1 through 1000, displayed as seat #0001 through seat #1000. The art is a herd of cow characters. Metadata is revealed post-mint via a baseURI update and then frozen.

Supply is fixed in the contract: no owner mint beyond a disclosed team allocation of 25 seats (2.5%) minted at deploy for partnerships, exhibitions, and protocol operations, and no ability to increase supply.

3.2 mint

Mint opens after the $MOO token launch. Eligibility requires holding at least minMooBalance of $MOO at mint time (owner-settable before mint opens, frozen after). Per-wallet cap of 2 seats.

Minting also plants a seed: seedAmount of wCOIN, pulled from the minter and deposited into the new seat's own vault. The protocol keeps none of it: no mint fee, no treasury cut, no split. Everything a minter pays lands in the seat that minter just received.

3.3 self price

Every seat carries a selfPrice denominated in wCOIN, set by its owner, visible to everyone. In phase 1 this is informational: an always-on, owner-signed statement of what the seat is worth, aggregated into a protocol-wide seat price index that serves the same signaling role NYSE seat prices once did.

In phase 2 the self price becomes binding under a Harberger-litea pricing system where you name your own price, pay a small tax on it, and must sell to anyone who pays it. the tax keeps the price honest. regime:

• the owner pays a continuous tax of taxRate per year on the self price, paid in wCOIN, streamed to the Milkhouse pot
• anyone may buy any seat at its self price at any time; 97.5% of the payment in wCOIN goes to the owner and 2.5% to the pot, ownership transfers atomically, activation state resets
• protections: a 7-day grace period after a takeover during which the seat cannot be taken again (an ordinary barn sale grants no grace, so a seat cannot farm immunity by trading with itself), a default self price of 1.5x the last takeover price if an owner never sets one, and a minimum self price floor set by governance

The tax rate is the key parameter. It launches low (1 to 2% annually) so the regime feels like a listing fee rather than a threat. It is adjustable downward by the multisig and upward only by seat-holder vote (the governance section).

Design intent: the tax converts idle speculation into pot revenue, the takeover right guarantees a liquid exit and entry at all times without an AMM vault holding inventory, and the self price index becomes the market's public heartbeat.

3.4 the seat vault

Every seat carries its own onchain account: a token-bound vault (ERC-6551 addressing, restricted implementation) that holds wCOIN and travels with the seat through every sale, takeover, and transfer. The owner's share of milk lands in the vault by default, so an unattended seat compounds its own bag. The mint seed sits there as a permanent earmark and phase 2's activation lock as a temporary one: free balance is always the total minus every earmark, and only free balance is ever withdrawable. The activation lock returns to the departing owner's wallet on any transfer; the seed never leaves the seat.

3.5 the auction barn

Seats trade on their own market from day one. The barn takes listings and escrowed offers, priced in wCOIN only, and settles atomically: 97.5% to the seller, 2.5% to the Milkhouse pot, seat and vault to the buyer. A barn sale writes the sale price into the seat's selfPrice, so the price index reflects real trades. When the Harberger regime activates, fixed listings retire and the barn remains for below-ask offers; the barn fee and the takeover fee are the same 2.5%, both feeding the pot.

The barn is live on the site: list a seat, take a listing back, or buy one, all in wCOIN. A buy names the price you agreed to, so a seller cannot relist higher in front of your transaction.

3.6 what a seat is not

4.1 the problem: COIN pays no dividend

Coinbase stock pays no dividend. A pot of wCOIN sitting still produces nothing. But COIN is one of the most volatile large-cap equities in the world, and volatility is sellable. The Milkhouse manufactures a dividend from that volatility by writing covered callsselling someone the right to buy your asset at a set price later, for a fee paid now. the fee is the premium; the trade caps upside in exchange. on the pot.

4.2 mechanism

The Milkhouse is a vault holding wCOIN, funded by:

Each epoch (default 14 days), the Milkhouse writes European covered calls against a bounded fraction of the pot (writableFraction, default 50%, governance-adjustable within [25%, 75%]):

Premium collected in an epoch, plus residuals, less the milking tip, defines epochMilk. Each seat can claim:

4.3 weights and activation

Base weight is 1.00 per seat. Activation (phase 2) lets a holder boost weight by locking wCOIN in the seat's name for the epoch: locked amounts up to caps map weights from 1.00 to 1.50. Unlike burn-based tier systems, the lock is returned at epoch end; the boost compensates the seat for its lock's contribution to writable pot size. Activation resets on transfer or takeover.

4.4 milking hour and claiming

Claims are pull-based per seat per epoch, callable by the seat owner or its current tenant according to the lease split. The owner's share lands in the seat's vault by default; the tenant's share pays the tenant directly. Unclaimed milk rolls into the next epoch's pot after a 6-epoch claim window rather than accumulating as liabilities.

4.5 honest accounting of the yield

Covered calls cap upside: in epochs where COIN rallies through the strike, the pot underperforms simply holding. The strategy harvests volatility risk premium, which is positive in expectation over long horizons for most equities but arrives unevenly.

5.1 the standard

B20 is a ring-signature-based reputation standard. Members of a fixed ring can sign messages proving that some member signed, without revealing which one, using linkable spontaneous anonymous group (LSAG) signaturesa signature scheme where any ring member can sign for the group, no one can tell who signed, but two signatures by the same hidden member are detectably linked.. Linkability means two signatures by the same hidden member in the same scope are detectably same-signer, which enables per-member reputation without identity disclosure.

5.2 seats as ring members

The 1,000 seats form the Moo Market ring. Each seat controls a signing key slot, held by the owner or by the tenant during a lease. Ring-signed actions include:

• epoch strike votes for the Milkhouse
• market calls: directional predictions on COIN posted to the registry, timestamped, and scored against realized prices
• attestations within the broader B20 ecosystem, where a Moo Market seat signature carries the weight of a priced, taxed, yield-bearing membership rather than a free wallet

5.3 rep

Each seat accrues a rep score from scored actions: accuracy of market calls, participation streaks, tenure. Rep is computed from linkable signature history, stored against the seat ID, and transfers with the seat. A takeover or sale acquires the track record. Rep is therefore a capital asset: a seat with a long profitable calling history should command a higher self price, and the tax regime makes that premium legible.

Rep can decrease. Wrong calls score negative. Inactivity decays rep toward a neutral baseline at 5% per epoch. Rep cannot be bought directly; it can only be earned by a signer or acquired by buying the seat that earned it.

5.4 bonded calls

A seat may escrow a flat, refundable $MOO call bond to badge its market calls as bonded (the $MOO section). The bond never changes rep arithmetic and returns in full regardless of call outcomes; it exists to make a track record costlier to fake, and is slashed only on mechanically provable abuse. Bond tiers are fixed protocol-wide so bond size never fingerprints a signer inside the ring.

5.5 graze fees

Any project may pay a flat published fee in wCOIN to the pot and receive an attested herd list: the seat IDs and current owners meeting a rep threshold of their choosing, signed by the registry at a specific block. The price is public and identical for everyone, with no curation and no allowlist of buyers. The data is derived entirely from public onchain state, so nothing private is collected or revealed and ring activity is never deanonymized.

Every other revenue line comes from our own churn or from selling volatility. This one grows with the wider ecosystem: the more projects on Base want distribution that is not sybils, the more the pot earns, and the more a seat is worth to someone who does not own one yet.

5.6 privacy properties

Observers learn that a seat in the ring acted, and can track a persistent pseudonymous actor across actions in the same scope, but cannot map actions to a wallet and cannot link a seat's activity across scopes with different linkability tags. Signing keys rotate on transfer, mandatorily on takeover.

6.1 mechanism

A seat owner lists the seat for lease: term length, rent in wCOIN paid upfront, and milk split (the fraction of epoch milk flowing to the tenant during the term). A tenant accepts by paying rent. For the term:

• the tenant holds the seat's B20 signing slot and accrues rep to the seat
• milk is split per the listed ratio, enforced by the Milkhouse at claim time
• the NFT never moves. sales and takeovers transfer the seat subject to the lease, rent unaffected
• at expiry the slot reverts to the owner; renewal requires a new agreement
• operating the slot requires the tenant to keep an operator pass: a $MOO average balance above minGrazeBalance for the term. a lapsed pass suspends the slot until restored; rent, the milk split, and the lease itself are unaffected

6.2 why this matters

Leasing is the on-ramp for operators who should not need the full capital cost of a seat to participate, and it is the natural interface for autonomous agents. An agent with a strategy but no capital rents a seat, performs under its ring identity, builds the seat's rep, and creates a track record that raises both future rents and the seat's self price. Owners become landlords of trading identities. The protocol becomes a labor market for market participation, with the stock as its unit of account.

wCOIN

$MOO has one protocol pattern: it is the membership filter at every door. It began as the mint gate, and it extends, on the same technical and legal shape, to every future moment where the protocol admits a member, an operator, or a new market. It is checked, never spent. It is never the reward, never the unit of account, and never a vote.

7.1 the gate pattern

Every $MOO gate is the same primitive: a balance check. Nothing is transferred, locked, or burned by a gate; holding is the only way through it. The mint gate reads the balance at mint time; the later gates read a 30-day time-weighted average (TWAB)time-weighted average balance: your average holdings over the window, not your balance at one moment. last-minute buying does not count. so they reward sustained holding.

The stall pass is the one that touches every holder: each new stall (a TSLA pot, an NVDA pot) re-runs the check, so seats that sold their $MOO after mint must re-acquire it to join. The stall gate is a fixed fraction of the original mint threshold, lowerable only by seat vote. The founding COIN pot is grandfathered to all 1,000 seats, and stall-in stays open after launch under the same check.

7.2 the two exceptions to "never spent"

Two mechanisms move $MOO. They are named here precisely because nothing else does:

• call bonds (phase 2). a flat, refundable escrow that badges a seat's market calls as bonded. it returns in full regardless of outcomes and is burned only on mechanically provable abuse (flood posting, oracle griefing, ballot spam). an outcome-linked variant can only be enabled by seat vote, after independent legal review.
• stall nominations (phase 3). proposing a new stall burns a $MOO application fee, paid by the proposing community, never by the treasury. the burn buys agenda space only; seats hold the only binding vote, admission ballots count owner-held votes exclusively (plain owner-signed, outside the ring), and the fee is anchored to the real per-stall cost of oracle setup, audit, and operations.

7.3 non-roles

7.4 the zero test

Phase 1 is admin-operated through a public multisig with timelocked parameter changes. Phase 2 moves the listed parameters to seat-holder voting via ring-signed ballots, one seat one vote, with the tenant voting when a lease includes voting rights:

Solidity ^0.8.24, Foundry, Base mainnet (8453), staged on Base Sepolia (84532).

Operator passes live inside SeatLease; call bonds live inside the B20 registry. All gates read balances only; none of them custody $MOO.

Security posture: pull payments everywhere, reentrancy guards, no upgradeable proxy on MooSeats (immutable core; peripheral contracts replaceable by governance), external audit before phase 2 contracts hold meaningful pot value, public bug bounty from mint day.

1. herd formationphase 0we are here

   brand, community, $MOO launch parameters published.

2. the pen opensphase 1

   $MOO launches. mint opens under the holding gate. seat vaults live: every seat is minted carrying its seed, and milk lands in the same bag. milking hour is permissionless from the first epoch. the auction barn opens with 2.5% of every sale feeding the pot. self prices live, synced by barn sales. milkhouse v1 distributes funded wCOIN by epoch. B20 registry live with seat key slots.

3. the market wakesphase 2

   callvault live: real covered call epochs with oracle settlement. harberger regime activates with grace protections; barn listings retire into standing takeover prices. seatlease live with operator passes gating tenancy. LSAG verification, scored market calls, and call bonds. governance to seats.

4. more stallsphase 3

   additional tokenized equities as parallel pots under the same 1,000 seats, admitted through stall nominations, opened on a bell, and joined through stall passes, seat-directed allocation between pots, and external B20 integrations making moo market rep portable collateral for agents across base.

Every cycle rebuilds the same discovery: assets are easy, markets are hard. Tokenized equities have completed the asset step. The market step needs membership, income, identity, and delegation, in forms that both humans and agents can hold.

Moo Market's answer is deliberately small: one thousand seats, priced in the stock they serve, milked from its volatility, remembering everything they do.

stocks are onchain. the market isn't. moo.

this document describes intended protocol mechanics and is not an offer, solicitation, or financial advice. mechanics may change before and after launch. parameters published at deployment supersede this paper.