Rules a chain can enforce.

1. The problem

An index fund is a promise about behaviour: these assets, these weights, rebalanced on this schedule. Off chain, that promise is enforced by disclosure and audit after the fact. You find out the mandate was broken when someone publishes that it was.

Tokenized equities change what is possible. If the assets are on chain and priced by an oracle, the mandate can be a constraint the contract checks before it moves anything, rather than a claim you verify afterwards. That is the whole idea: an index whose rules are enforced at execution.

2. Design

AIndex is four moving parts. A vault holds the basket and issues shares. A bond puts the creator's capital at risk so deploying a vault is not free. A rebalancer trades the basket back toward target, subject to caps the contract enforces. A policy envelope bounds what an automated agent may propose, with a guardian able to veto before anything settles.

None of these components trusts the others. The rebalancer cannot pull funds to an arbitrary address. The agent cannot execute without a delay. The manager cannot change how the basket is priced. Each limit exists because its absence was, at some point, a way to drain the vault.

3. The vault

Deposits are made in USDG, a dollar stablecoin. In return the vault mints shares under ERC-4626-style accounting: a share is a claim on a pro-rata slice of everything the vault holds. Net asset value is computed by pricing each basket asset through Chainlink and summing.

Redemption returns a slice of every asset, not a stablecoin payout. This is deliberate. A vault that promises to return USDG must hold enough of it, or sell into whatever market exists at the moment you withdraw, which turns an orderly exit into a forced trade. Paying out in kind means a redemption cannot be front-run and cannot fail for lack of liquidity.

Share issuance carries a virtual offset, and the first deposit into an empty vault has a floor. Together these close the donation attack that lets a first depositor inflate the share price and capture the next depositor's money.

4. Rebalancing

Prices drift, so weights drift. A rebalance is allowed only when:

• the cadence has elapsed, currently seven days;
• at least one asset sits outside the drift band, currently 10%;
• the batch is within the turnover cap, currently 20% of NAV;
• the circuit breaker is clear and the protocol is not paused.

Execution routes through Uniswap V3. Each leg carries a minimum output derived on chain from the oracle price less a bounded slippage tolerance, and total NAV is re-checked after the batch. A searcher who moves the pool against the vault does not extract value; the transaction reverts. Caller-supplied slippage was the single largest MEV surface in the original design, and it no longer exists: the floor is computed by the contract, not passed to it.

5. Agents and the envelope

Rules handle drift. They do not handle regime changes. An agent may propose a trade outside the ordinary schedule, but only inside an envelope the guardian configures per vault: maximum turnover, maximum single-name weight, maximum drift, trades per day, and a cooldown after any breaker event.

The sequence is deliberate. An agent opens a time-boxed regime window, submits a proposal recorded on chain with a hash of its reasoning, then waits out a challenge window during which the guardian may veto. Only then can it execute, and the slippage floor is recomputed at that moment rather than trusted from proposal time, so a price move during the window cannot be absorbed by the vault.

An agent is scoped to the vaults it is assigned. Holding the role is not enough. Whether a proposal originates from a human or a language model is irrelevant to the contract: the envelope is the same either way, which is what makes automated strategies safe to allow at all.

6. Security model

An internal review in August 2026 found one critical and five high-severity issues in the first deployment. All were fixed and the contracts redeployed before any public deposit. No user funds were ever exposed: the vault was empty and deposits were allowlisted throughout. The fixes are structural rather than cosmetic:

• Share inflation. A virtual share offset plus a minimum first deposit make the donation attack cost more than it can capture.
• Allowance scope. Approvals are pinned to the wired rebalancer and to the caller. No role can point vault funds at an address of its choosing.
• Oracle authority. Only the guardian may introduce or change a price feed, because whoever controls pricing controls the share price.
• Execution. Oracle-derived minimum outputs, an explicit deadline, and a post-trade NAV assertion across the whole batch.
• Oracle validity. Every read checks round completeness and a per-feed staleness budget, since equity feeds legitimately pause when markets close while the stablecoin feed does not.
• Emergency stop. The circuit breaker halts every rebalancing route, not just the agent path.

Each fix is paired with a test that first demonstrates the exploit and then demonstrates it failing. This is an internal review, not an external audit. That distinction matters and is not glossed over below.

7. The AINDEX token

AINDEX has four jobs. Only the first is live today.

1. Bond. Creating a vault locks 1,000 AINDEX in escrow, returned on wind-down and slashable by the guardian for proven misconduct. This is what makes deploying a vault a decision with consequences.
2. Stake. Curators will stake to signal on composition and earn a share of fees.
3. Settle. Marketplace performance fees will route through the token economy.
4. Govern. Holders will set fee caps, allowlists, and regime thresholds.

Depositors never need AINDEX. You deposit USDG and receive vault shares. The token is for the people who create and curate vaults, not the people who use them. Supply is fixed with no mint function.

8. Build order

1. Phase 1 · Vault core. Bond, fees, rule rebalancer. Live on mainnet, capped.
2. Phase 2 · Agentic engine. Policy envelope, regime windows, guardian veto, circuit breaker. Live.
3. Phase 3 · One-click agents. Natural-language goals compiled into a vault policy.
4. Phase 4 · Swarm curation. Curator reputation and vault forks.
5. Phase 5 · Marketplace. Performance-fee routing between creators and curators.

9. Risks and limits

Stated plainly, because a whitepaper that omits them is marketing.

• No external audit. The August 2026 review was internal. An independent audit is required before caps rise.
• Trusted roles. The guardian can pause and set caps; the admin can grant roles. Neither can move user funds, but both are single keys today and must move to a multisig before public launch.
• Capped launch. $5,000 per vault, $25,000 protocol-wide, with an allowlist, until custody checks and an audit clear.
• Tokenization risk. The equity tokens are issued by a third party. If they fail to track the underlying, the basket does too.
• Oracle risk. NAV depends on Chainlink. A wrong price is a wrong share price, which is why the breaker exists and why feeds are validated for completeness and staleness.
• Liquidity risk. Rebalances need pool depth. A thin pool makes a rebalance revert. That fails safe, but the basket stays drifted.
• Market risk. The basket holds equities. Equities fall.

Nothing here is investment advice or an offer. Vault shares are not offered in the US, CA, UK, CH, or UAE.