The wallet where dollars become assets and actions.
1. GitHub: https://github.com/Aaditya1273/BLOOM
2. Live Link: https://bloom-page.vercel.app/
3. Vedio: https://youtu.be/8crMpT9Bd8U
4. WhitePaper: https://drive.google.com/file/d/1yaxMUIO-uTIR6JFx5ZynW0lEWmK2wWsY/view?usp=sharing
5. PPT: https://drive.google.com/file/d/1iM8E9Hn46Y3KiUri8w6zrMqep_9EUfBm/view?usp=sharing
6. Deployed Contract: https://explorer.testnet.chain.robinhood.com/address/0xc464c03bfe7efa388457b8b392454b99fa18b124
Save in USDG. Send Robinhood Stock Tokens. Let your agent act under your rules.
Bloom is a consumer wallet on Robinhood Chain. Users save in USDG, use supported Robinhood Stock Tokens as programmable assets, and let an AI agent act under explicit risk and spending rules.
What it is | A consumer wallet on Robinhood Chain for USDG savings, Stock Token sends and goal-based AI automation |
The core idea | A price is not a permission. Borrowing, liquidation and agent actions are gated by a risk engine that understands halts, corporate actions, staleness and deviation |
What is live | 12 contracts plus mock assets on Robinhood Chain Testnet, the Stylus risk engine, a halt-aware reporter fed by the live Robinhood API, a hosted API and the full web app |
Proof | 139 Hardhat · 11 Foundry fuzz/invariant · 16 Stylus Rust · 9 reporter · 22 backend tests; 13/13 end-to-end checks against the live testnet |
Robinhood is bringing US equities onchain. On July 1, 2026 it announced that Robinhood Chain, built on the Arbitrum platform, is live, with Stock Tokens available in the Robinhood Wallet in more than 120 countries, and that Agentic Accounts would let people connect an AI model to their account while humans "set the specific safety guardrails" (Robinhood newsroom).
That creates two new kinds of money: dollars (USDG) and stock tokens that move 24/7, and agents that move them. Bloom is the wallet built for both. It is three screens, Home, Chat and Goals, on top of four onchain systems: an ERC-4626 savings vault, a canonical-only stock router with claim links, ERC-4337 smart accounts with policy-scoped agent keys, and the Bloom Risk Engine, a default-deny state machine for equity risk running as an Arbitrum Stylus contract.
Robinhood's own documentation says end users can trade Stock Tokens onchain outside the window in which market makers mint and burn them, that corporate actions are applied through an onchain uiMultiplier, and that tradability varies per session (Robinhood Chain docs). So the token keeps moving while the underlying market can be:
Event | What happens to the stock | What a plain price feed sees |
|---|---|---|
Trading halt | The exchange stops trading | A normal-looking last price |
Split or corporate action | Price and shares-per-token re-base; the oracle may pause | A sudden jump, or a frozen value |
After hours | No regular-session trading for most of the day | A price that is hours old |
Oracle divergence | The feed drifts from the real market | One confident, wrong number |
A lending market that treats a fresh price as permission to lend keeps lending and liquidating straight through all of it. Lending against stock tokens today is flying blind.
Agents that turn "save for my laptop" into transactions are arriving now. In most systems the only thing between the model and the money is a system prompt: injectable, nondeterministic and confident when wrong. In finance the failure mode is not a bad answer. It is a transfer.
Stable dollars on a new chain need real consumer jobs: saving, sending, investing, paying someone new. Not just vault deposits.
Wallet | Goal-bound AI agent | Stylus risk engine |
The AI proposes. Your policy decides. The chain enforces.
Bloom doesn't replace the price oracle. It adds equity-specific risk interpretation around it.
Price-feed lending | Prompt-guarded agents | Bloom | |
|---|---|---|---|
Sees trading halts | No | No | Yes: signed market reports |
Handles splits and corporate actions | No | No | Yes: oracle pause, report flag and multiplier checks |
Knows a price is stale | Heartbeat only | No | Yes: feed heartbeat and report age |
Blocks liquidations on bad data | No | n/a | Yes: protected mode reverts liquidation if any collateral isn't NORMAL |
Agent limits | n/a | A prompt | Onchain policy: closed call set, caps, allowlist, expiry |
Survives a compromised server | n/a | No | Yes: enforcement lives in contracts, not in the app |
Reusable by other protocols | No | No | Yes: one call, |
Five properties hold by construction (proofs in the whitepaper, ):
Default deny. An asset is NORMAL only if all seven adverse predicates are false. Anything missing, malformed, stale or contradictory denies.
Adverse monotonicity. No additional signal can move an asset into NORMAL.
Silence denies. If the reporter, feed or sequencer goes quiet, the asset becomes STALE and its max LTV drops to 0.
Portfolio default deny. One non-NORMAL collateral asset zeroes the whole position's borrow capacity.
Protected liquidation. Nobody is liquidated on a halted, stale, deviating or corporate-action price.
And one honest result nobody else will show you: Stylus costs more gas than the EVM for this workload (1.57× to ingest a report, 1.95× to evaluate risk), because the engine is call-bound rather than compute-bound. We measured it, explain it, and keep Stylus for the memory-safe, natively tested Rust core (§9).
Save $100 in USDG | "Save $500 for my laptop." |
|---|---|
 |  |
One tap into the savings vault; the user's wallet signs. | The sentence becomes an onchain policy; the user signs once and the agent is active. |
"Send Sarah $5 of QQQ." | Live halt: borrowing stops |
|---|---|
 |  |
Risk check, policy check, a plain-English plan, then the agent executes onchain. | A signed report lands on the Stylus engine; AAPL flips to HALTED, LTV 0%, and the agent refuses. |
The four frames above come from the product film, which rebuilds the app's UI with its exact design tokens. The screenshots below are captures of the running app.
Landing | Home | Chat | Risk: halted |
|---|---|---|---|
 |  |  |  |
Mobile (390px): home · chat · goals · risk · activity · claim
Every red state returns max LTV 0%, disables borrowing and pauses liquidations. Facts about the data are checked before facts about the market, so a market signal is never read from untrustworthy data.
More detail: ARCHITECTURE.md, and the formal model in the whitepaper.
Every figure below is quoted from its source; none is a Bloom estimate.
Metric | Value | Source |
|---|---|---|
Tokenized real-world assets, total market cap | $19.3B at the end of Q1 2026, up 256.7% from $5.42B at the start of 2025 | |
Tokenized stocks, market cap | $486.69M on Mar 31, 2026, up from $2.09M on Jun 30, 2025 (about 233× in nine months) | |
Largest tokenized stocks | Circle $171.39M (35.2%), Tesla $61.70M (12.7%), Nvidia $42.59M (8.8%) | |
Robinhood Chain | Mainnet live Jul 1, 2026, built on the Arbitrum platform; Stock Tokens in the Robinhood Wallet in 120+ countries | |
Agentic finance | Robinhood Agentic Accounts: users connect their AI model of choice; "humans remain in control by deciding exactly how much capital to allocate and set the specific safety guardrails" | |
Stock Token mechanics | Every Stock Token has a live Chainlink feed; corporate actions apply through an onchain |
Why now. Tokenized stocks are the fastest-growing slice of the RWA market, the largest US retail broker has put them onchain on an Arbitrum chain, and the same company is handing wallets to AI agents with human-set guardrails. Every lending market, agent and wallet built on top of that needs to know whether it is safe to act on a stock token right now, and to enforce the guardrails somewhere a model can't talk its way past. Bloom is the consumer app and the risk primitive for that world.
Who uses what.
Customer | What they use | Why |
|---|---|---|
Retail users | The Bloom wallet | Save in USDG, send stock tokens, automate goals safely |
Lending protocols and money markets |
| Stop lending and liquidating through halts and corporate actions |
Agent and wallet builders | BloomPolicy + BloomAccount pattern | Give agents real limits the chain enforces |
Structured-product and vault builders | Risk states as a gate | Pause strategies automatically on market events |
Planned, not implemented. Nothing below is live today.
Revenue line | How it would work |
|---|---|
Savings spread | A small share of vault yield, disclosed in-app |
Swap and send fees | A transparent fee on Stock Token swaps routed through the StockRouter |
Risk-engine access for protocols | Free |
Premium agent goals | Advanced automation (rebalancing, recurring investing) inside the same onchain policy model |
Stage | Milestones |
|---|---|
Now: testnet release candidate | Live Stylus engine, full app, 197 tests, 13/13 live E2E, hosting configs |
Next | k-of-n reporter quorum, guardian agent denylist, Stylus source verification, external audit, ERC-1271 sign-in |
Mainnet | Canonical USDG and Stock Tokens with Chainlink stock feeds (the gated deploy script already supports this), an interest-rate model, the USDG/USD feed |
Scale |
|
All measured on September 25, 2026 at tag bloom-v2-rc1 (details and methods in the whitepaper, §10).
Suite | Result |
|---|---|
Hardhat (engine vectors onchain, vault, router, claims, policy, account, ERC-4337, role separation, demo flow) | 139 / 139 |
Foundry (property fuzzing at 1,000 runs per property, vault invariants at 128 runs × depth 64) | 11 / 11 |
Stylus Rust (43 shared spec vectors, EIP-712 parity, contract tests) | 16 / 16 |
Reporter | 9 / 9 |
Backend (intents, sign-in and replay, authorization matrix, rate limits, CORS, key separation) | 22 / 22 |
End-to-end demo against the live testnet | 13 / 13 |
Wallet flow against the live testnet (a fresh wallet signs every owner action) | 7 / 7 |
Frontend |
|
Stylus versus EVM, measured with scripts/bench-risk-engine.js (sends no transactions):
Operation | EVM twin | Stylus | Ratio |
|---|---|---|---|
| 100,811 | 158,613 (median of 12 live receipts) | 1.57× |
| ≈ 55,500 | ≈ 108,200 | 1.95× |
Runtime code size | 8,931 B | 32,795 B compressed | 3.67× |
Live reporter cycle. One cycle advanced every asset's report nonce by exactly one (AAPL 70→71, NVDA 64→65, QQQ 69→70, SPY 65→66); the AAPL report (tx 0x57e3…dec0) carried $336.31 while the Robinhood API quoted a bid of $336.14 and an ask of $336.26. Running cost at a 120-second cycle over four assets: about 0.005 testnet ETH per day.
Live on Robinhood Chain Testnet (chain 46630), deployed 2026-09-25, with the risk engine running as a real Arbitrum Stylus (Rust/WASM) contract. Manifest: deployments/robinhood-testnet.json. Integrity is checkable read-only with npx hardhat run scripts/verify-deployment.js --network robinhoodTestnet.
Canonical mainnet dependencies Bloom is configured for (mainnet not deployed; the gated script refuses above its cost limit):
Asset | Address | Chainlink feed |
|---|---|---|
USDG |
| USDG/USD |
AAPL |
|
|
NVDA |
|
|
QQQ |
|
|
SPY |
|
|
EntryPoint v0.8 |
| — |
MIT. See LICENSE. Bloom evolved from the Aura codebase: its smart-account, vault and Stylus foundations were reused and hardened, and the original sources are archived in legacy/aura/ with attribution preserved. Account abstraction builds on eth-infinitism's ERC-4337 contracts, and the token and access-control primitives come from OpenZeppelin.
Completed on Testnet.
NA
