Session-aware collateral risk layer for tokenized equity on Morpho Blue, built for Robinhood Chain
Vigil is a session-aware collateral risk layer for tokenized equity (ERC-8056 stock tokens) on Morpho Blue, built for Robinhood Chain.
Problem. Robinhood Chain runs 24/7; Chainlink equity feeds run 24/5 and freeze all weekend. In four years of NVDA data, both gaps that would have produced bad debt in an 86 % LLTV market came at Monday open - 5 Aug 2024 (-14.18 %) and 27 Jan 2025 (-12.49 %) - after ~65 hours in which no liquidation could execute. Utilization-based interest charged nothing for either. Lenders write a free weekend option; curators answer with borrow cap 0.
Mechanism. Vigil attaches to an unmodified Morpho Blue market at three points. Oracle: an on-chain NYSE calendar (verified against nyse.com) drives a haircut priced on the duration of the closure being entered, H(L) = clamp(H_floor + k*sigma*sqrt(L/tau_night)), ramped over 60 minutes, capped at 5 % for the market. Premium: opted-in borrowers pay a USDG session premium from an on-chain index. Backstop: an ERC-4626 first-loss tranche in USDG receives it. Members get a soft unwind before the close (session-aware Morpho PreLiquidation pattern, discount <= 3 %) and liquidateWithCover: the backstop repays the shortfall in the same transaction as the seizure, so Morpho never realizes bad debt. Keepers can only tighten; the calendar alone runs the cycle.
Live, with the real tokens. Deployment v4 on Robinhood Chain testnet (46630) is a TSLA/USDG market whose collateral is Robinhood's own testnet TSLA stock token (ERC-8056 BeaconProxy from Robinhood's registry, faucet-issued) and whose loan token, premium escrow and backstop are Paxos's testnet USDG (Global Dollar). Nothing is minted. Only the TSLA/USD price feed and the interest-rate model are mocks, and Morpho Blue v1.0.0 is deployed from source, because the testnet has no Chainlink feeds or Morpho. Eight immutable Vigil contracts, all source-verified. A 37-transaction end-to-end run replays TSLA's own 5 Aug 2024 weekend gap (-10.81 %) with real TSLA and real USDG: one member unwound Friday, the other's 0.24 USDG shortfall paid by the backstop inside liquidateWithCover, suppliers untouched - every transaction linked in the README, and the run is the middle of the demo video.
Evidence. 80 Foundry tests + 3 mainnet-fork tests, invariants, ~93 % line coverage, CI. The fork suite runs Vigil against the real Morpho, AdaptiveCurveIRM, Paxos USDG, NVDA ERC-8056 token and Chainlink feeds on mainnet 4663 - only the gap is injected. Calibration on NVDA/AAPL/TSLA 2022-2026: plain market 3 bad-debt closures, Vigil market 0; premium ~122 bp/yr against an expected tail loss of 12-299 bp/yr depending on ticker and tail model - a wide band, hence a first-loss backstop with a cap. The live market uses the TSLA surface (sigma 0.0176).
Nitro-specific: block.timestamp only (block.number is an L1 estimate), evm paris, FCFS sequencing -> time-based unwind. Robinhood-specific: the testnet Stock implementation lacks oraclePaused(), which the mainnet token has - VigilSessionOracle probes it at registration. Prior art named: Morpho PreLiquidation, SSS Protocol (arXiv 2510.05711), Venus bStocks weekend buffer, ZircoFi, Chaos Labs / Gauntlet.
Next: session keeper and unwind bot, mainnet with the real USDG and Morpho (deployment simulated: 24.9 M gas), AAPL and NVDA markets. Solo builder. Code: https://github.com/mdlog/vigil (MIT). Dashboard: https://mdlog.github.io/vigil/
Everything was built inside the buildathon window (opened 14 Sep 2026); the repo's first commit is 19 Sep 2026 and every commit is in-window, structured by feature:
PRD and risk model (haircut surface H(L), premium index, buffer multiplier), then the 8 contracts on Morpho Blue v1.0.0 with a full Foundry suite (unit, historical replay scenarios, invariants). The fuzzer found two real bugs (INV-7 accrual monotonicity, INV-3 keeper-tightening ramp) - both fixed and pinned as regression tests.
Deployment to Robinhood Chain testnet 46630 in four steps: v1, v2 after the ramp fix (all mocks), v3 on Paxos's real testnet USDG, v4 on Robinhood's own testnet TSLA stock token plus Paxos USDG - nothing minted; all contracts source-verified on the explorer; a read-only live dashboard on GitHub Pages reading the chain through Multicall3.
A 37-transaction end-to-end script on the live deployment (supply -> borrow -> membership -> backstop -> keeper attestation -> soft unwind -> 5 Aug 2024 gap replay -> liquidateWithCover -> restore), recorded from the dashboard by an automated video pipeline whose narration is generated from the numbers the run produced; filmed four times as the deployment moved from mocks to the real tokens.
A mainnet-fork suite against the real Morpho, AdaptiveCurveIRM, Paxos USDG, NVDA ERC-8056 token and Chainlink feeds on chain 4663; a full calibrator (POT/GPD tails, 4-year backtest across NVDA/AAPL/TSLA, charts) with a parity test against the on-chain curve in CI; the embedded NYSE calendar 2024-2028 verified against nyse.com and pinned by a test; a weekday feed heartbeat so the testnet demo never goes stale; oraclePaused() made optional after finding the testnet Stock implementation lacks it.
Only open-source dependencies were imported: Morpho Blue v1.0.0, OpenZeppelin 4.9.6, forge-std. Full history: https://github.com/mdlog/vigil/commits/main
Bootstrapped, no funding raised and no token. Solo builder; the buildathon prize would fund the session keeper / unwind bot service and a security review ahead of a mainnet deployment with the real USDG and Morpho.