Once upon a blockchain, the arrows only flew one way. From the many to the few. From the people who read the contract to the people who wrote it.
Robin Heroes exists because that arrangement got old. This is a band of 7777 hand-placed pixel outlaws minting on the Robinhood chain on 12 AUG at 2PM UTC for 0.00023 E. But the art is the invitation, not the product.
The product is what your hero does after you own it. Every Robin Hero is three things at once: a sprite that lives fully onchain, an identity your software can act through, and a guard posted at the door of your wallet. This is the manual for all three.
PIXELATED
Art small enough to survive forever.
Every hero is a 24x24 sprite. Hand-placed pixels, one-pixel outlines, a two-tone palette, and the family anatomy that runs through the whole band: protruding eyes, a deadpan mouth, a bust framed with headroom for hoods and crowns. They idle with a one-pixel bob and they blink on a loop. They are alive in the way an arcade cabinet is alive.
This is a deliberate constraint, not a style choice made in a vacuum. A 24x24 grid with a bounded palette compresses into a few hundred bytes. Bytes that small can be written directly into contract storage, which is what makes the next chapter possible. High-resolution art cannot live onchain at any sane cost. Pixel art can. The medium is the mechanism.
THE ART IS SMALL ON PURPOSE. SMALL ENOUGH TO LIVE IN THE BLOCK.
ONCHAIN
No servers. No landlords. No off switch.
Most NFTs are a pointer. The token holds a URL, the URL points at a file, and the file sits on somebody's infrastructure. When the pinning bill goes unpaid, when the gateway goes down, when the team walks away, the pointer survives and the picture does not. The collector is left holding a receipt for a missing painting.
Robin Heroes are stored in contract storage: the pixel data, the palette, the traits. Rendering happens on read, generated by the contract when the token is queried. There is no bucket to expire, no gateway to fail, no company to outlive.
WHAT THAT ACTUALLY BUYS YOU
Permanence is the obvious answer, but the useful one is composability. Because the art and traits are readable onchain, any other contract can read them too, without asking us, without an API key, without our servers being up. A game can read your hero's class. A protocol can gate on ownership. Your own agent can read its own mandate. The band does not need our permission to keep riding, which is exactly the point of an outlaw.
IF THE CHAIN IS RUNNING, YOUR HERO IS RUNNING. THAT IS THE WHOLE GUARANTEE.
AGENTIC
A hero that does something while you sleep.
An agent is software that watches, decides, and acts continuously, without being asked each time. The last cycle of NFTs gave you a picture that sat still. This one gives you something with a pulse.
Here is the split that matters. Your hero is the identity and the mandate: an onchain object that says who it serves and what it is permitted to do. The agent is the hand: the software that reads that mandate and acts inside it. The hero is the badge; the agent is the deputy wearing it. Transfer the hero, and the badge moves with it. Burn the mandate, and the deputy goes home.
WHY BIND AN AGENT TO AN NFT AT ALL
Because an agent needs three things that an NFT provides natively. An identity that other contracts can verify. A permission scope that is public and auditable rather than buried in a settings page. And a revocation switch that works even if every website we run disappears You can always transfer or burn, and the chain honors it.
The classes you saw on character select are not decoration. Archer, Rogue, Bard, Tank, Scout, Paladin. Traits are readable onchain, which means capability tiers can be tied to them. Your hero's stats become the shape of what your deputy is allowed to do.
HOW YOUR HERO GUARDS YOUR WALLET
Five posts on the wall. This is the heart of the manual.
Almost nobody loses a wallet to cryptography. Nobody is brute forcing your key. Wallets are emptied through signatures the owner actually made: an approval granted years ago and forgotten, a transaction whose payload nobody could read, an address copied from a history that had been quietly poisoned. The attack surface is not the math. It is the moment of clicking confirm, and the long silence afterward.
A guard is useful precisely because that silence is where the damage happens. Here are the five posts a Robin Hero is designed to stand.
GUARD 01
THE WATCHTOWER
Standing inventory of every door you have left open
THREAT: FORGOTTEN TOKEN APPROVALS
Every time you approve a contract to spend a token, you leave a door open. Most approvals are unlimited and permanent by default. A mint you did once in 2021 may still hold a standing claim on your entire balance of that token, and it will still hold it in 2031 unless you revoke it. If that contract is ever upgraded, exploited, or was malicious from the start, the door is already open, and no new signature from you required.
The Watchtower keeps a live inventory of every approval your wallet has ever granted, scored by exposure: unlimited or capped, active or dormant, upgradeable proxy or immutable, known contract or unknown. Not a list of hex, but a ranked ledger of what could leave, and who could take it.
GUARD 02
ARROW-CATCH
Reading the transaction out loud before you sign it
THREAT: BLIND SIGNING / MALICIOUS PAYLOADS
The most dangerous thing in crypto is a confirm dialog showing a wall of hex. You cannot audit what you cannot read, so people sign on vibes and hope.
Arrow-Catch simulates the transaction against forked state before it is ever broadcast, then reports the outcome in plain words. Instead of 0x23b872dd you get a sentence: this moves your entire USDC balance to a wallet that was created four minutes ago. If the simulated result and the website's promise disagree, your hero says so while it still costs you nothing.
GUARD 03
THE SHERIFF'S LEDGER
Knowing the enemy by name before you meet them
THREAT: DRAINERS, POISONED ADDRESSES, CLONE FRONT-ENDS
Attackers reuse infrastructure. The same drainer contracts, the same payout wallets, the same cloned mint pages with one character changed in the domain. That repetition is a weakness, and a shared ledger turns it into a warning system.
The Ledger checks counterparties against known-bad sets and, just as importantly, against near-misses. Address poisoning works by sending you dust from a vanity address engineered to match the first and last four characters of one you actually use, betting that you will copy the wrong line out of your own history. Your hero compares the full string, not the shape of it, and flags a lookalike before you paste it.
GUARD 04
THE SHERWOOD SIGNAL
A horn that sounds the moment something moves
THREAT: SILENT DRAINS WHILE YOU ARE ASLEEP
Drains do not announce themselves. The gap between the first unauthorized transfer and the owner noticing is usually measured in hours, and by then the funds have been bridged and split.
The Signal watches your wallet continuously and sounds the horn on the events that actually precede loss: a dormant approval suddenly being used, a contract you approved swapping its proxy implementation, an unusual outbound transfer, or a wallet you follow getting hit by a pattern that also touches yours. Minutes matter here. That is the entire product.
GUARD 05
DEAD MAN'S BOW
Standing orders your hero carries out without waking you
THREAT: THE WINDOW BETWEEN ALERT AND RESPONSE
An alert only helps if you are awake to read it. The last post is the one where the deputy is allowed to act, inside boundaries you wrote in advance.
You set standing orders: revoke any approval unused for ninety days. Revoke instantly if a contract I have approved appears on the Ledger. Cap my exposure to any single contract at a number I choose. Your hero executes them the moment the condition trips, whether you are at your desk or asleep. This is the only post with write permission, and it is deliberately narrow, which brings us to the part that matters most.
THE OATH
What your hero will never do. Read this part twice.
Any project offering to guard your wallet is asking for trust, and you should be hostile to that request by default. A guard with too much power is just a well-dressed thief. So the boundaries are part of the design, not a footnote to it.
THE OATH OF THE BAND
- 01Your hero never holds your private key. It cannot. Custody stays with you, always.
- 02Every post except the last is read-only. Watching costs you nothing and risks nothing.
- 03The one write permission is scoped to revocation. It can close doors. It can never open one, and it can never move funds anywhere.
- 04Nothing can be sent to us. There is no address in the mandate that routes value to the team.
- 05The mandate is public and readable onchain. You do not have to trust a description of it. You can read the scope yourself.
- 06You can revoke everything at any time, from the chain directly, even if every site we run is gone.
Read those constraints as the actual specification. A guard that could move your funds would be a strictly worse deal than no guard at all, because it would collapse your security down to whether our keys stay safe. The whole point is that it does not.
A GUARD THAT CAN MOVE YOUR MONEY IS NOT A GUARD. IT IS A SECOND ATTACK SURFACE.
THE ROAD AHEAD
Honest sequencing. Watching ships before acting does.
THE MINT
7777 heroes on the Robinhood chain. 12 AUG at 2PM UTC, 0.00023 E. Whitelist runs through the three deeds on the apply page.
THE WATCHTOWER
Read-only approval dashboard for holders. Every open door your wallet has, ranked by exposure. No permissions required beyond connecting to read.
ARROW-CATCH
Pre-signature simulation in plain language. What actually leaves your wallet if you sign this, checked against what the site claims.
LEDGER AND SIGNAL
Threat intelligence on counterparties plus continuous monitoring and alerts. The horn that sounds while you sleep.
DEAD MAN'S BOW
Scoped, revocation-only standing orders. The narrowest write permission we can ship, audited before it touches a single wallet.
OPEN THE ARMORY
Agent tooling opened up so anyone can build a deputy that reads a hero's mandate. The band was never meant to be closed.
WHY ANY OF THIS
Billions have been lost to approvals nobody remembered granting and payloads nobody could read. The industry's answer has largely been to tell people to be more careful, which is not a security model, it is a way of assigning blame after the fact.
The old story had a man in a hood taking back what the powerful had quietly extracted from everyone else. The mechanism has changed. The extraction now happens through a confirm dialog that nobody can read, and the man in the hood is 7777 pixels tall. The job is the same.
Steal the spotlight. Give back the vibes. And keep a hero posted at the door.
JOIN THE BAND
7777 heroes. Mint opens 12 AUG at 2PM UTC for 0.00023 E on the Robinhood chain. Coming soon to OpenSea.