Borrow against tokenized stock

What Root is

A lending market for tokenized equities, denominated in USDG.

A borrower locks an approved Stock Token in an isolated market and receives USDG as debt. The collateral is not sold when the loan opens. It stays locked until the borrower repays, withdraws only the amount that keeps the position healthy, or is liquidated.

The USDG does not appear from the collateral deposit. It comes from lenders who supplied USDG to that market, directly or through a Root liquidity vault. Borrowers pay variable interest for using that liquidity, the interest is added to their debt, and it becomes yield for suppliers after any configured fee.

Borrower provides

A canonical tokenized asset as collateral

Borrower receives

USDG already supplied by lenders

Protocol records

Collateral balance and debt shares onchain

Position closes when

Debt is repaid and collateral is withdrawn

How a loan works

The full path from connecting a wallet to closing or being liquidated.

1. Connect and identify assets

   The app checks it is on Robinhood Chain, resolves canonical contracts from the official registry, and reads the wallet's actual ERC-20 balances.

2. Approve collateral

   The borrower signs an ERC-20 approval permitting the market or router to transfer only the selected Stock Token.

3. Supply collateral

   The market transfers the token out of the wallet and credits the borrower's onchain collateral position. No debt exists yet.

4. Borrow USDG

   The market checks price, LLTV, liquidity, caps and pauses, records debt shares, then transfers USDG to the borrower.

5. Manage the position

   Interest increases debt over time and price changes alter collateral value. The borrower can add collateral, repay USDG, or withdraw safe excess.

6. Close or be liquidated

   A healthy borrower repays and withdraws. If LTV passes the liquidation threshold, an external liquidator can repay debt and seize discounted collateral.

A router may batch approval-compatible actions such as supply-and-borrow. Batching changes how many wallet prompts you see, not the underlying accounting.

System components

Which part owns which responsibility, and which it does not.

Collateral: Stock Tokens

Root accepts contract addresses, not ticker symbols.

Before a market can be supported, its collateral address must match a deployment returned by Robinhood's asset registry for chain ID 4663. A token called “AAPL” at any other address is not canonical collateral and is not accepted.

GET https://api.robinhood.com/rhj/assets

const canonical = asset.deployments.find(
  (deployment) => deployment.chainId === 4663
);

require(canonical.contractAddress === market.collateralToken);

What one token represents

A Stock Token is an ERC-20 instrument giving economic exposure to an underlying security. It is not the underlying common share and does not grant ordinary shareholder rights. Its exposure can change through a corporate-action multiplier: after a split, one token may represent a different number of underlying shares even though your token balance is unchanged.

Market admission checks

• Registry status is active and the chain deployment matches Robinhood Chain.
• A supported multiplier-aware oracle exists with defined stale-price behaviour.
• Transfer restrictions do not make the collateral unusable by the market or by liquidators.
• Onchain exit liquidity is deep enough for the proposed supply cap and liquidation incentive.
• Trading halts and pending corporate actions have explicit pause rules.

USDG, the loan asset

Root borrows and repays canonical USDG. It does not mint its own stablecoin.

USDG is transferred from existing market liquidity to the borrower. Repayment transfers USDG back into the market, where it becomes withdrawable by suppliers.

Asset

Global Dollar (USDG)

Network

Robinhood Chain · 4663

Canonical contract

0x5fc5…d168 ↗

Borrowers must separately obtain USDG to repay principal and accrued interest. Supplying more collateral improves health but does not pay down USDG debt.

Isolated markets

One market per collateral asset, so stress in one cannot spill into another.

Each supported collateral is paired with USDG in its own market. An AAPL/USDG market and a TSLA/USDG market have separate liquidity, utilization, caps, prices and borrower positions. A failure in one does not automatically consume liquidity or collateral in another.

The reference design uses the five immutable parameters of an isolated Morpho-style market:

Loan token

Canonical USDG

Collateral token

One canonical Stock Token

Oracle

Collateral value expressed in USDG

IRM

Contract that calculates variable borrow rates

LLTV

The liquidation loan-to-value boundary

Market ID

Hash of the complete parameter set

Interest and debt shares

Debt is held in shares, so every borrower accrues the market rate without per-account updates.

Borrow interest is variable. The interest-rate model reads market utilization (the share of supplied USDG currently borrowed) and returns a per-second rate. High utilization raises the cost of borrowing and encourages repayment or new supply; low utilization reduces the rate and encourages borrowing.

Utilization

Total USDG borrowed ÷ total USDG supplied

Supplier rate, before vault fees

Borrow rate × utilization × (1 − market fee)

The market accrues interest before state-changing actions. Accrued interest increases total borrow assets while your debt shares stay constant, so each share becomes redeemable for more USDG debt over time.

“Repay max” should repay debt shares, or include a small buffer. Using an old quoted token amount can leave dust behind, because more interest accrues before the repayment transaction is included.

Health and liquidation

A position is healthy while its health factor is above 1.0.

collateralValue  = tokenAmount × validatedTokenPrice
liquidationLimit = collateralValue × LLTV
currentLTV       = debtValue ÷ collateralValue
healthFactor     = liquidationLimit ÷ debtValue

liquidationPrice = currentDebt ÷ (collateralAmount × LLTV)

If health falls below 1.0, any external liquidator may repay part or all of the eligible USDG debt and receive collateral worth more than the repaid debt at the oracle price. That discount compensates them for gas, price movement and the cost of selling the seized token.

1. Detection

   A bot observes an account whose LTV is above LLTV after interest accrual and oracle validation.

2. Repayment

   The liquidator transfers USDG into the market to reduce the borrower's debt.

3. Seizure

   The market transfers the corresponding collateral plus the liquidation incentive to the liquidator.

4. Exit

   The liquidator may keep the token or sell it into whatever onchain depth is available.

Oracles and corporate actions

The contracts need the USDG value of one complete onchain Stock Token.

Robinhood's REST price endpoint reports the raw underlying equity quote, while the supported onchain feed is multiplier-adjusted. Root must use one pricing path consistently, and must never apply the corporate-action multiplier twice.

Oracle adapter checks

• Confirm the collateral contract is the registry deployment for chain ID 4663.
• Read a signed, supported Chainlink price report or feed.
• Validate report age, timestamp, answer bounds and expected feed identifier.
• Check Robinhood Chain sequencer status and enforce a recovery grace period.
• Confirm whether the price already includes currentMultiplier.
• Return the collateral price in the exact scale the market expects.

Forward splits, reverse splits, dividends, mergers and redemptions can all change token economics. If a multiplier is pending or a feed is paused, Root should block new borrows and collateral withdrawals while still allowing repayment and safe collateral top-ups. A trading halt should trigger the same conservative behaviour, because liquidators may be unable to exit seized collateral.

Deposit collateral

Lock a supported Stock Token in its market and open borrowing capacity.

A deposit transfers the canonical token into the market and credits your onchain collateral balance. It does not create debt, and it does not require an oracle update to succeed.

Requirements

• Read balanceOf(wallet) from the canonical collateral contract.
• Approve the market router for an exact amount, or sign a supported permit.
• Call the market's collateral-supply function for the borrower address.
• Confirm the receipt succeeded, then re-read the position from the market.
• Show the transaction hash, confirmed collateral, oracle value and new capacity.

Collateral is locked, not staked. It does not earn the market's USDG supply yield and should not be rehypothecated. Its only purpose is to secure that borrower's debt.

Borrow USDG

Draw USDG against deposited collateral, up to the market's limit.

Borrowing succeeds only when the account stays below the market's LLTV and the market holds enough unborrowed USDG. Root applies a lower interface limit than the liquidation boundary, so you cannot open a position with no safety margin.

availableUSDG = min(
  interfaceBorrowLimit - currentDebt,
  marketUSDGLiquidity,
  remainingBorrowCap
);

On execution the market converts the borrowed amount into debt shares, adds them to the borrower, reduces available USDG liquidity, and transfers USDG to the requested recipient.

A borrow must revert when

• The resulting LTV exceeds the market's LLTV or the configured front-end limit.
• The oracle answer is invalid, stale, paused, or unsafe after a sequencer outage.
• The collateral market or the borrowing action is paused.
• Available USDG is below the requested amount.
• A market-level or asset-level borrow cap would be exceeded.

Repay debt

Return USDG to the market and burn the corresponding debt shares.

Repayment transfers USDG from your wallet to the market and burns debt shares. A partial repayment immediately lowers LTV. A full repayment burns all debt shares, including accrued interest.

Requirements

• Read the freshly accrued debt-share value, not a cached amount.
• Approve enough USDG to cover principal and interest.
• Repay by debt shares where possible, so nothing is left behind.
• Confirm the position debt reads zero onchain before withdrawing.

Withdraw collateral

Release collateral, provided the remaining position stays healthy.

Withdrawal is a separate action from repayment. The market calculates health after the proposed withdrawal and releases tokens only if the remaining position is still above the required threshold. You do not have to repay in full to withdraw, only to withdraw everything.

A router can batch repayment and withdrawal atomically. If any check fails the whole transaction reverts, and neither action is partially applied.

Supply USDG

Deposit USDG into the vault and receive shares in the liquidity borrowers draw on.

The supplier vault is separate from borrower positions. You deposit USDG and receive vault shares representing a proportional claim on total assets. The vault allocates that USDG across approved Stock Token/USDG markets, subject to per-market caps and a liquidity buffer.

Vault share price

Total USDG assets ÷ shares outstanding

The supplier approves USDG and calls the vault's ERC-4626-style deposit function. The vault transfers the USDG, mints shares, and may allocate idle balance into approved markets. The share amount comes from the current exchange rate, never from a locally stored balance.

Borrow interest earned by the underlying markets increases the vault's asset value, and therefore the USDG redeemable per share. Suppliers do not receive a fixed rate: yield moves with utilization, market rates, allocations, losses and fees.

Withdraw USDG

Burn vault shares and receive the available USDG behind them.

A withdrawal burns shares and returns available USDG. If too much capital is currently borrowed, immediate withdrawals may be limited to idle liquidity plus withdrawable market supply. A production design must document its queues, liquidity buffers, and any curator ability to reallocate funds.

Supplier risk

What the yield is actually compensating you for.

Supplier yield is payment for borrower, collateral, oracle, liquidation, smart-contract, stablecoin and liquidity risk. If a liquidation cannot recover all of the debt, the shortfall can reduce the vault share price.

Swap stock and USDG

Buy a Stock Token with USDG, or sell one back, from your own wallet.

The Swap page executes a real onchain trade. Your wallet signs it, a Uniswap v3 pool fills it, and the bought token is delivered straight to the address you nominate. Root never takes custody of either side, and no balance passes through the app.

Buying

USDG in, Stock Token out

Selling

Stock Token in, USDG out

Signed by

Your wallet, on Robinhood Chain

Filled by

A Uniswap v3 pool, through SwapRouter02

Where the stock is delivered

A buy can settle in two places, and the card asks which before you sign. My wallet sends the token to your own address, where Root never sees it. My vault sends it to a deposit address the protocol watches for that market's token, so the arrival is credited as collateral once the transfer confirms. The two are one transaction either way: the recipient is a field in the swap itself, not a second transfer afterwards.

Selling always settles to your wallet. The proceeds are USDG, and there is no USDG collateral vault for them to land in.

Routing and settlement

How a quote becomes calldata, and what the transaction guarantees.

Quotes are read from the Uniswap quoter against live pool depth. The quote names the exact pair, the scale it priced at, and the route it found, and the calldata is encoded against that answer rather than against a configuration file that could have drifted from it.

Route selection

A market with a direct USDG pool is swapped through exactInputSingle at the quoted fee tier. A market with no direct pool is routed through WETH and swapped through exactInput with the encoded two-hop path. Which entrypoint is used is decided by the quote, not by a list of tickers, so a market that gains or loses a direct pool changes nothing in the interface. The path is re-validated against the pair before anything is signed.

// The router pulls exactly the amount being spent, never an
// open-ended allowance that would outlive the transaction.
approve(SwapRouter02, amountIn);

amountOutMinimum = quotedOut × (1 − slippageTolerance);

route.hops === 1
  ? exactInputSingle({ tokenIn, tokenOut, fee, recipient,
                       amountIn, amountOutMinimum })
  : exactInput({ path, recipient, amountIn, amountOutMinimum });

Slippage

You choose the tolerance before signing: 0.1%, 0.5% or 1%, with 0.5% selected by default. It is applied to the quote as integer arithmetic to produce amountOutMinimum, the floor written into the calldata. The pool must return at least that amount or the transaction reverts and nothing moves except the gas. A tight tolerance catches a bad fill; a loose one survives ordinary drift between the quote and the block that includes you.

What the receipt reports

The amount shown after a swap is read from the ERC-20 transfer log addressed to the recipient, not from the quote. On a multi-hop route the receipt also carries the intermediate leg's transfers, so the log has to be both the final token and addressed to the recipient before it is believed. If no such log is present, the app reports that the swap confirmed and names no figure.

How points accrue

Points are paid on balances held and on how long they are held, not on deposits made.

Every qualifying dollar earns 8 points per day for as long as it is held, multiplied by a factor for the method that holds it. Points run from the moment a balance exists, so time in the protocol counts for as much as size: a smaller position opened earlier can and does outrank a larger one opened later.

Vault collateral is tokenized stock locked in an isolated vault, counted at its oracle value, and it is the base every other method is a multiple of. Active USDG debt is USDG drawn against that collateral and still outstanding. Supplied USDG is USDG supplied to a market for borrowers to draw on. Swap volume is the value of each swap that settles into one of the collateral markets.

The first three are balances, so they pay every day they are held. Swap volume is an event, so it pays once. That is the whole rule:

// All balances in USD, at the values the snapshot read.
dailyRate = 8 × (collateral + debt × 2 + supplied × 3)

points    = dailyRate × daysHeld
          + 8 × 0.5 × swapVolume

Borrowing and supplying are weighted above bare collateral because they put capital to work: debt is what pays suppliers, and supplied USDG is what borrowers draw on. Depositing collateral and leaving it idle still earns, at the base rate.

Why size alone does not win

Because the rate is multiplied by days held, two wallets with the same dollars can be far apart on the table.

This is also why the leaderboard's collateral column reads out of order in places. It ranks by points, and points are not a restatement of a dollar balance.

Seasons and the leaderboard

One snapshot a day, one pool split by accrual rate, one table ranked by points.

The protocol reads balances once per UTC day, at 00:00 UTC. Each reading settles a snapshot, and the number of settled snapshots is the number of whole days the protocol has been live. The Season page counts down to the next one.

Snapshot

00:00 UTC, daily

Settles

One per whole day the protocol has been live

Ranked by

Points, not collateral

Your share

Your daily rate ÷ the season pool

The season pool

The pool is what the model issues per day at the balances currently held: the sum of every participating wallet's own accrual rate. It is not a fixed allocation set in advance. It rises when wallets add collateral, borrow or supply, and falls when they unwind, so your share of it moves whenever anyone's balances move, including your own.

Your standing

The Season page reports your points, your rank among participating wallets, your share of the daily pool, and the collateral behind it. Rank is your points measured against the same ledger the Leaderboard is drawn from, so the two pages cannot disagree. Until a vault holds collateral there is nothing to accrue on, and the figures read empty rather than zero.

Your points are a live figure, not a running total: the balances you hold now, multiplied by how long the position has been open. It therefore moves with what you hold as well as with time, and unwinding a position lowers it.

Worked position example

One token at 200 USDG, 100 tokens deposited, 65% LLTV, opened at 50% LTV.

Now let interest push debt to 10,200 USDG while the token price falls to 150 USDG. Collateral is worth 15,000 USDG, so health becomes (15,000 × 0.65) ÷ 10,200 = 0.956. The position is liquidatable even though the borrower never touched it.

Contract interactions

Every user action, the tokens it moves, and the state it changes.

Every displayed balance should come from contracts or a reproducible indexer. A transaction is pending until included, failed if the receipt status is zero, and confirmed only after the configured confirmation policy. Local storage may remember UI preferences; it must never be the accounting ledger.

Risk controls

The controls a production deployment has to publish and enforce.

Collateral caps

Based on executable onchain depth, volatility, trading halts and expected liquidation size.

Conservative LLTV

Must account for overnight and weekend gaps, oracle latency, slippage and liquidator incentives.

Oracle circuit breakers

Stale reports, invalid multipliers, sequencer downtime and corporate-action transitions block risk-increasing operations.

Isolated markets

Each Stock Token has separate accounting and limits rather than sharing one cross-collateral pool.

Vault allocation caps

Restrict how much supplier capital can enter any single market.

Emergency actions

Borrowing and collateral withdrawal may pause while repayment and top-ups stay available, when technically safe.

Each market publishes its exact LLTV, caps, oracle address, IRM address, vault allocation policy, fee recipients, upgrade and pause powers, timelocks, audits and bad-debt handling, so every parameter above can be checked against the deployment rather than taken on trust.

Frequently asked questions

Short answers to the questions that come up most.

Sources

Primary references behind the behaviour described here.

• Robinhood ChainNetwork architecture and ecosystem infrastructure
• Stock Token APIsCanonical deployments, raw prices, multipliers, corporate actions
• Canonical token contractsUSDG and Stock Token addresses
• Chainlink Data StreamsSigned reports and the Robinhood Chain verifier
• Isolated market modelMarket parameters, supply, borrow, repay, liquidation
• Interest-rate modelUtilization, borrower rates, supplier yield
• Liquidation mechanicsLTV, health factor, incentives, bad debt
• Uniswap v3Pool routing, SwapRouter02 entrypoints, quoter and path encoding
• Paxos USDGUSDG network deployments and technical documentation