Tokenized stocks trade around the clock, but their price oracles go quiet when US markets close, so lending markets hold the last price through weekends and holidays and absorb the gap when the feed resumes. Sundown is a risk layer and isolated lending market built around that blind window. It includes an onchain US market calendar (DST-aware, NYSE holidays) checked against an independent calendar and 4,716 real Chainlink feed rounds with zero violations; a calendar-aware oracle adapter; an ERC-4626 lending market with a halt policy for issuer-control failures; and a guard that tightens boosted-tier borrowing before a weekend, gives borrowers a cure window, then deleverages. We kept the evidence honest. On AAPL at 93%, a replay of the 10 worst real gaps cut lender loss from $3,824 to $1,224, but the 2020 gap still produced a loss. Static LLTVs up to 86% were historically safe, and the shipped rule's economics are modest. The contracts are verified on Arbitrum Sepolia (231 tests, mutation-checked invariants), running against simulated tokens and feeds. The research is reproducible and the repo lists the claims we will not make.
Tokenized stocks trade almost around the clock, but the price oracles that feed lending markets go quiet when US markets close. Chainlink's 24/5 equity feeds hold their last value from Friday 20:00 ET to Sunday 20:00 ET, and across NYSE holidays. Lending markets keep running the whole time, so they carry that stale price through every weekend and absorb the gap when the feed resumes. Stock-collateral markets on Robinhood Chain's Morpho use fixed LLTVs of 38.5%, 62.5%, 77% and 86%, and a fixed number cannot tighten before a closure.
Sundown is a session-aware credit-risk layer and isolated lending market for tokenized-stock collateral on Arbitrum and Robinhood Chain.
Onchain US market calendar: DST-aware, with NYSE holidays by rule, that models the oracle's blind windows (Short, Weekend, Long).
Calendar-aware oracle adapter: it tells scheduled blindness from unexpected staleness, with a 0.5% deviation allowance and age haircut, instead of relying on heartbeat age, which cannot detect a market closure.
Isolated ERC-4626 lending market: kinked interest, partial liquidation with a non-worsening bonus cap, per-market collateral caps from measured exit liquidity, and a halt policy for issuer-control failures. The issuer can pause transfers, block addresses or burn tokens, and its roles are held by EOAs.
Swappable guard: FlatGuard is the control, and SundownGuard adds a static stress cap from six hours before a blind window, a three-hour cure window and permissionless deleveraging for an opt-in boosted tier. Standard accounts are never touched.
We treat the evidence as the product. At the highest LLTV in the wild (86%), weekend gaps cost lenders about 2.5 bps a year (95% CI [0.4, 5.6]), so we do not claim to fix today's markets. On AAPL at 93%, replaying the ten worst real gaps cut lender loss from $3,824 to $1,224, but the 2020-03-16 gap still produced a loss, and the shipped rule is not distinguishable from a flat market at its weekend-cap level. SPY is inert, and TSLA and NVDA are not recommended for a boosted tier. The repository lists the claims we will not make.