Lifelong USDG income for migrant workers' parents. A Stylus actuary prices each pension on-chain from UN life tables in one call; savings earn in S&P 500 and T-bills on Robinhood Chain.
"How much would your mother get, every month, for the rest of her life?"
Tonti answers that question on Robinhood Chain in about a second, and then pays it, in USDG, for as long as she lives.
▶ Demo video (3 min): https://youtu.be/z-4RYJNPF18
▶ Live app, English and Filipino: https://tonti-life.vercel.app
▶ Code: https://github.com/iamdflame/tonti
THE PROBLEM
Singapore employs 1,635,700 foreign workers (Ministry of Manpower, Dec 2025). None of them can contribute to CPF, the city's pension. Most send money home to parents who have no pension either: only 24% of older people in South Asia receive one (ILO World Social Protection Report 2024–26). When the work stops, the money stops.
Saving alone doesn't fix it. Nobody knows how long they will live, so savers either spend too little or outlive their money. In our historical replay, money drawn alone ran out while 49% of the savers were still alive.
THE SOLUTION
Tonti is a pension pool with no pension fund: a fair, modern tontine whose rules are contracts.
1. Ask. Choose who it's for, their country, birth year, start age and savings. The Actuary contract simulates 512 possible lives and returns a monthly income range, in one eth_call, in about a second.
2. Join. Create a "life key": a passkey on your phone (Face ID or fingerprint). No seed phrase.
3. Pay in USDG, from your own wallet or from a child's wallet in Singapore.
4. It is invested along a glide path: S&P 500 (SPY) and US T-bill (SGOV) stock tokens via Uniswap v4, and USDG lent in Morpho.
5. From the chosen age, income arrives every month in USDG, for life. When a member dies, the savings they put at risk are shared fairly among those still alive (mortality credits). That is what lets the pool pay more than anyone can safely draw alone.
6. Every three months, one Face ID tap proves she is alive, verified on-chain.
WHAT IS LIVE ON ROBINHOOD CHAIN MAINNET (chain 4663)
• Six contracts, every one owned by a 48-hour timelock. The Solidity contracts are verified on Sourcify (exact match).
• A real member. Member #0 joined from an iPhone, checked in with Face ID (the passkey's P-256 signature verified on-chain), passed the identity check and paid in 25 USDG. The first monthly settlement invested it: $14.86 S&P 500, $7.06 T-bills and $3.04 USDG in Morpho, at 17 basis points of trading cost. The site shows the member's value live.
• The quote in the demo is a single eth_call. Anyone can re-run it on a public node and get the same number.
HOW TONTI MEETS THE JUDGING CRITERIA
Smart-contract quality
• Two Arbitrum Stylus (Rust) contracts do the heavy math on-chain. The Actuary does fixed-point mortality, the Monte Carlo quote and payout fractions. The TontiPool does cohort accounting, paged settlement, fair credits, exits and a ghost-member detector.
• A 512-path quote costs 9.5M gas. Our own Stylus ink meter predicted that before deployment, and mainnet matched it within 0.6%. The first design needed about 380M gas and could never have run.
• Settlement runs in pages that anyone can push. Paged and one-shot settlement end in byte-identical state, at about $0.03 per member-month.
• 68 Rust, 45 Solidity (10 against live mainnet state) and 6 TypeScript tests. Mutation testing caught 59 of 59 bugs we planted on purpose. Four independent adversarial reviews, with every finding fixed or disclosed.
• Governance is bounded in code. Mortality tables are sealed forever. Every parameter change waits 48 hours in public. Initialisation can't be front-run.
Product–market fit
• A named group with a monthly pain: Singapore's 1.6 million foreign workers and the parents they support. Citizens have CPF LIFE; nothing exists for them.
• Built for parents aged 55 to 80 on budget phones. Atkinson Hyperlegible type, English and Filipino, no seed phrases, a one-button Face ID check-in, and invite links a child can send over Messenger or WhatsApp.
• The first real member went through it on an iPhone and found six bugs our automated judge hadn't. All are fixed and now tested on every release.
Innovation
• An actuary on a blockchain: 1,846 cohort-specific mortality curves fitted to UN World Population Prospects 2024 (13 countries, both sexes, born 1935–2005; worst annuity-factor error 1.35%), sealed on-chain.
• A finite-pool correction we derived makes mortality credits fair even in small pools. At 100 members it cuts the bias from 4.8% to 0.26%.
• Proof of life without a trusted oracle: passkey check-ins, a 120-day death-report window answered by the member's own proof, revival for five years, and a statistical ghost-member detector (Wald's SPRT) inside every settlement.
Solving a real problem
• A historical replay, using UN mortality and real S&P 500 and T-bill returns: 2,000 Filipino women retire in 1965 with $10,000 each. Drawn alone, the money ran out in 1977 with 49% of them still alive. The pool paid every survivor, for life.
• By 1905 two-thirds of US life insurance was tontine insurance; New York banned it in 1906 after the insurers running it were found embezzling. Here the rules are contracts: no operator, not even us, can take the pot.
USDG
• Every dollar in and out is Paxos USDG: deposits, monthly income and death-report bonds. The cash sleeve earns in Morpho's USDG vault.
WHY ROBINHOOD CHAIN AND ARBITRUM STYLUS
• Robinhood Chain's SPY and SGOV stock tokens give a pension real equity and T-bill exposure, on-chain.
• Stylus makes actuarial math (exponentials, logarithms, Monte Carlo) cheap enough to run inside a single call.
TRY IT IN 60 SECONDS
1. Open https://tonti-life.vercel.app and ask about "Mother · Philippines · 1966 · income from 65".
2. Watch the answer arrive from the chain in about a second. Open "Run it yourself", then "Re-run it from this browser": a public node returns the same number.
3. Open "Live pool": members, holdings and the Actuary's odds by country, read live from mainnet.
HONEST LIMITS (research preview)
• Deposits are capped at 25 USDG per member.
• Identity is attested by the operator for now; ZKPassport and national-ID adapters are next.
• A longevity pool may count as insurance in Singapore: the path is the MAS FinTech Regulatory Sandbox or a licensed trustee.
• Not financial advice. Not an insurance product.
ROADMAP
1. Gasless onboarding for parents: Alchemy EIP-7702 smart wallets with sponsored gas.
2. Trust-minimised identity: ZKPassport and national-ID QR adapters.
3. The first 100 members, from Singapore's Filipino domestic-worker community. Caps rise as pools grow.
4. The MAS sandbox or a licensed trustee. More countries: each one is a new sealed Actuary.
Shipped during the buildathon, from first mainnet probe to a real member, dated:
• Sep 26. Recon on Robinhood Chain mainnet (token addresses, Uniswap v4 liquidity, Chainlink feeds). We built a Stylus ink meter that prices our WASM exactly as Stylus meters it, so gas was known before deploying. Activation dry-runs passed on mainnet.
• Sep 27. The first Actuary went live on mainnet: a 512-path quote in one eth_call, matching the meter's prediction within 0.6%.
• Sep 27. The same day, an independent adversarial review found two fund-level bugs: a top-up could take other members' income, and anyone could "kill" a living member for 10 USDG. Both were fixed with regression tests, along with 13 further findings. We added mutation testing to prove the tests can fail.
• Sep 27–28. We built the site, "Lifeline at dusk": Next.js, English and Filipino, passkeys, the live quote and "Run it yourself". A judge script runs against the public URL: 20/20 quotes equal a direct eth_call, 80/80 routes load clean, 0 accessibility violations.
• Sep 27–28. Reviews 2 to 4 hardened revival, estates, account recovery, guardians and presumption of death. Planted bugs: 59, caught: 59.
• Sep 28. Relaunch on mainnet: a sealed Actuary, TontiPool, Treasury, LifeRegistry and AttestedIdentity, with every contract handed to a 48-hour timelock. Solidity verified on Sourcify.
• Sep 30. Added Ghana, the first member's country. Actuary v3 holds 1,846 cohorts; every cohort was read back from its on-chain events and matched before sealing. New core and timelock.
• Oct 1. Member #0 joined from an iPhone, checked in with Face ID (verified on-chain), passed the identity check and paid in 25 USDG. The first monthly settlement invested it in SPY, SGOV and Morpho USDG. The attempt exposed six UX bugs, among them MetaMask's in-app browser refusing passkeys and an empty embedded wallet chosen over MetaMask. All six were fixed and added to the public-URL judge.
• Oct 2–3. The demo film was recorded from the live site and mainnet, one continuous take of the quote with the chain's real 1.2-second answer. Every number on screen is read from the chain.
Totals: 6 contracts on mainnet, 119 automated tests, 59/59 planted bugs caught, 4 adversarial reviews, 13 countries priced, 1 real member invested, 97 commits.
Not raised; self-funded so far. The team paid the mainnet gas and made the first real deposit.
What funding would unlock next:
• An external audit of the Stylus contracts (Actuary and TontiPool) before deposit caps rise.
• Gas sponsorship so parents can join and check in without holding ETH (Alchemy EIP-7702).
• A MAS FinTech Regulatory Sandbox application, or a partnership with a licensed trustee.
• Community onboarding with Singapore's Filipino domestic-worker groups for the first 100 members.
Open to Arbitrum and Robinhood Chain ecosystem grants and to accelerator conversations.