Docs
A lending protocol on tokenized stocks.
Wall Street rings the closing bell at 4:00 PM and goes dark on weekends. Robinhood Chain does not. Lending dollars against NVDA or TSLA on a chain that never sleeps takes more than wrapping an equity: it takes isolated custody, a rate curve that defends the reserve, and an oracle that knows when the market was closed.
- Deposit a tokenized stock or T-Bill. It goes into that asset's escrow.
- Borrow USDG up to the asset's LTV, adjusted for how old the price is.
- Keep the upside. The collateral stays yours; repay any time and withdraw it.
Architecture
Four contracts, each with one job.
| LendingPool | The global USDG reserve. Lenders hold fUSDG (ERC-4626). Debt is tracked as shares of total debt, so one accrual updates every borrower. No stock token ever enters it. |
| CollateralEscrow | One per listed asset, created at listing. Holds exactly one token. Only the market can move it: in from a depositor, out to its owner or a liquidator. |
| FletcherMarket | Positions keyed by owner and asset. Deposit, borrow, repay, withdraw, liquidate. The owner lists assets inside hard bounds and can freeze borrows; it cannot move funds, change an oracle or raise a liquidation threshold. |
| PriceGuard | Stateless, ownerless. Reads a Chainlink Robinhood feed and its previous rounds and returns a price, a state and a borrow factor. |
A position is isolated: NVDA backs its own loan and nothing else. A user with NVDA and SGOV has two positions, two health factors, and a crash on one cannot liquidate the other.
Interest rates
utilization = debt / (cash + debt - reserves)
borrow APR = 4% x u / 80% when u <= 80%
= 4% + 75% x (u - 80%) / 20% above
supply APR = borrow APR x u x 90%
reserve = 10% of interest, sent to the operator
Interest accrues every time the pool is touched. Shares are minted rounding up and burned rounding down, so rounding always favours lenders. The fUSDG share carries six extra decimals, which makes the first-depositor donation attack cost a million times what it could steal.
Risk parameters
| Asset | Class | LTV | Liq. threshold | Bonus | Max age haircut | Reopen gap |
|---|
Hard bounds, enforced for any listing: LTV at most 85%, threshold at most 90%, bonus at most 10%, and threshold x (1 + bonus) never above 100%, so a liquidation can never seize more value than the position holds. The owner can only lower an LTV.
Oracle & circuit breaker
Chainlink's Robinhood feeds report a total return price per token (market price times the token's dividend multiplier), 8 decimals, updating 24/5 on a 0.5% deviation with a 24 h heartbeat. Off hours they hold the last price.
age <= 1 h full borrowing power 1 h < age < 72 h power x (1 - haircut x (age - 1 h) / 71 h) age > 96 h STALE: no borrows, no liquidations oraclePaused() PAUSED: same latest print after a gap SETTLING until +30 min print confirming it within 2% SETTLING until max(reopen + 10 min, print)
The gap is per asset: 6 hours for stocks, 30 hours for SGOV, whose feed prints mostly on its daily heartbeat. Nothing here is stored or set by anyone: every answer is recomputed from the feed's rounds.
Never locked. Repay works in every state. Collateral with no debt against it withdraws whatever the oracle is doing.
Liquidation
- Open when debt exceeds collateral value x liquidation threshold, on a LIVE price only.
- A liquidator repays up to 50% of the debt (all of it under 100 USDG) and receives collateral worth the repayment plus the asset's bonus, at the oracle price.
minSeizeprotects the liquidator against a price move between signing and inclusion.- If the collateral runs out before the debt, the remainder is written off against the pool: lenders absorb it openly instead of carrying debt nobody will repay.
Permissioned tokens
Robinhood stock tokens are ERC-20s behind a beacon proxy, with an issuer that can pause the token, pause its oracle during corporate actions, burn from any account, and block addresses through an access registry (ACCESS_CONTROLLED_REGISTRY, isBlocked).
Fletcher reads that registry at listing and checks it before anything moves: a deposit into a blocked escrow, a withdrawal or a liquidation to a blocked recipient reverts with Blocked(account) before the transfer, instead of freezing collateral halfway through. A liquidator who is blocked can name any other recipient.
The tokens implement EIP-2612, so a deposit takes one signature and one transaction: depositWithPermit names the asset's escrow as spender.
Testing
Every test forks Robinhood Chain: the real USDG, the real stock tokens and their registry, and the real Chainlink feeds, with a controllable feed where a test replays a weekend or a reopen. The suite includes fuzzed rate and haircut properties and a stateful invariant run where random lenders, borrowers, price gaps and liquidations must never break these:
- every escrow holds at least what its positions are owed;
- debt shares add up across positions, assets and the pool;
- the pool never owes lenders more than cash plus debt;
- no position carries debt without collateral;
- stock tokens never reach the pool, USDG never reaches an escrow.
The app reads everything through one Multicall3 call per refresh, down a list of RPC endpoints.
Contracts
FLETCH
1,000,000,000 fixed at construction, burnable, EIP-2612 permit, on-chain logo through contractURI. No owner, no mint, no pause, no tax. It holds no privilege over the lending contracts.
Limits
- USDG is valued at one dollar. There is no USDC with liquidity on Robinhood Chain.
- Robinhood Chain has no L2 sequencer uptime feed; staleness and the reopen rules are the defence.
- The issuer's pause, burn and blocklist powers sit above any protocol. Isolation limits the damage to one market.
- The asset owner can freeze new borrows and list new assets; it cannot touch funds.
- Tested on a fork, not audited.