EquiFlow

EquiFlow is a permissionless lending protocol that turns tokenized US equities into instant on-chain liquidity. Holders of tokenized stocks (TSLA, AMZN, PLTR, NFLX, AMD) pledge their shares to a Solidity vault, borrow USDG stablecoin against them, and repay anytime — without ever selling the underlying asset. A second vault lets users borrow WETH against the same collateral.

The problem we solve

Retail stockholders face an impossible trade-off when they need cash. Selling stock triggers capital-gains tax and forfeits future upside. Holding stock locks up capital in an asset that can't pay for groceries. Traditional brokers do offer margin loans — but only to high-net-worth clients, behind KYC walls, with no transparency.

The same problem exists on-chain: tokenized equities (a USD 4 trillion market today, growing 38% YoY) sit idle in wallets because no protocol accepts them as collateral. Aave, Morpho, and Compound only list crypto-native assets.

Our solution

EquiFlow is the first borrow-against-tokenized-stock vault deployed on an Arbitrum Orbit chain (Robinhood Chain testnet today, Arbitrum One next). The protocol gives users:

Why now, why Arbitrum

Tokenized stocks live on Arbitrum Orbit (Robinhood Chain), Polygon, and Base — but none have a borrow market today. Arbitrum's RWA tailwind (BlackRock's BUIDL fund, Backed's bToken issuance, Robinhood Chain launch) makes this the right L2 to build on. Low-cost L2 settlement + EIP-7702 / ERC-4337 maturity makes the UX finally feel like a fintech app, not a DeFi app.

Live links

• USDG vault: 0x86c4AC25524560799863505F7650B24014eDB0FB on Robinhood Chain Testnet (chainId 46630)

• WETH vault: 0x1EcD5E7BaC4841d062C76Df408E4e3345CF9E0B2 (borrow WETH against the same collateral)

• Block explorer: https://explorer.testnet.chain.robinhood.com

We entered the buildathon with an empty repo and a thesis. We shipped a working end-to-end protocol with smart contracts, a polished frontend, account abstraction, and an autonomous keeper system — and have kept hardening it since.

Smart contracts (Solidity + Foundry)

• EquiFlowVault.sol — full lending vault: pledge/borrow/repay/withdraw, per-asset LTV + liquidation threshold, multi-collateral health factor, liquidation flow with 5% bonus, LP share accounting (ERC-4626-style), reserve factor, treasury. Hardened with Ownable2Step, 24h timelocks on risk changes, dead-shares inflation-attack mitigation, per-asset borrow caps, and a bad-debt write-off path (~1,850 lines).

• KinkedRateModel.sol + IInterestRateModel.sol — the kinked (two-slope, Aave-V3-style) interest-rate model is now a pluggable contract behind an interface, swapped into the vault via a 24h-timelocked scheduleIrm / executeIrm.

• PythPriceAdapter.sol + PythAdapterRegistry.sol — a Chainlink-compatible (AggregatorV3Interface) wrapper around Pyth/MockPyth, hardened with a deviation cap, force-update delay, and confidence circuit-breaker; a canonical registry maps each price feed to its adapter so multiple vaults share one adapter per feed.

• VaultMath.sol — an external math library extracted to keep the vault under the EIP-170 contract-size limit.

• Deploy.s.sol + DeployWethVault.s.sol — deployment scripts that publish the vault(s) and adapters, mint test USDG, list the 5 collateral assets (TSLA / AMZN / PLTR / NFLX / AMD) with realistic risk parameters, and seed liquidity. The second script stands up a WETH-borrow vault reusing the same collateral and adapter registry.

• Market-hours mode — setMarketStatus (OPEN / CLOSED / HALTED) gates new borrows and liquidations when the underlying market is closed.

• Tests + internal audit — 169 Foundry tests across 6 files (~3,100 lines) covering happy paths, edge cases (zero collateral, max LTV, stale-oracle revert), and liquidation arithmetic. An internal audit pass (EquiFlow-Audit-Report.md) with a reproducing PoC (AuditPoC.t.sol) drove a batch of fixes (AuditBatchFixes.t.sol).

Frontend (Next.js 16 + React 19 + wagmi + RainbowKit)

14 routes shipped, each with live on-chain data:

The pledge flow now lives in a slide-in PledgeSidebar drawer launched from /markets or /markets/[sym], so the standalone /pledge page was retired.

Account Abstraction (ERC-4337 + EIP-7702)

• Modular Account v2 smart wallets — built directly on viem's toSmartAccount targeting Alchemy's canonical Modular Account v2 (SemiModular) factory + implementation, with sponsored UserOps via a Pimlico/Alchemy Gas Manager paymaster (permissionless + viem, no SDK lock-in). Every write (pledge, borrow, repay, LP, liquidate, withdraw) can run as a single sponsored signature.

• EIP-7702 delegation is implemented (authorization-tuple signing + on-chain delegation fallback); the factory-deployed account is currently the default path, with 7702 disabled for injected wallets that can't sponsor delegation.

• Session keys for Auto-Defender (BETA) — the user signs an EIP-712 grant, and the server keeper reads health factor vs. threshold and computes a health-factor-based repay. It runs in dry-run today (the on-chain validator install is a no-op and the keeper will not move funds yet); weekly USDG limits are tracked off-chain.

• USDG-as-gas (Tier-5 paymaster) is wired at the library level (ERC-20 paymaster policy) but not yet surfaced in the UI — every caller currently uses sponsored gas.

Oracle infrastructure

• Pyth Hermes proxy at /api/pyth/by-symbol/[sym] — fetches the freshest of 4 sessions (regular/pre/post/overnight) for true 24/5 coverage.

• Server-side keeper at /api/keeper/tick (per-adapter) and /api/keeper/cron (full-sweep) — signs updatePrice() / forceUpdatePrice() transactions using KEEPER_PRIVATE_KEY server-side; key never reaches the browser. It also infers market-open status from feed freshness and calls setMarketStatus(), and respects an on-chain deviation cap with a 30-minute force-update escape hatch.

• Stale-oracle UX: when prices age past staleAfter, the UI surfaces a banner with a manual "Refresh oracle" button and disables actions that would revert. No silent failures.

• /api/keeper/health — public JSON healthcheck consumable by UptimeRobot / Better Stack for production monitoring.

• Market data — /api/markets/24h, /api/markets/history/[sym], and /api/markets/sparkline serve price history via Pyth Benchmarks with an optional Upstash Redis cache.

DevOps & deployment

• vercel.json with cron schedule (*/2 * * * *) to auto-tick all adapters every 2 minutes — zero-touch oracle freshness in production.

• CRON_SECRET-gated endpoints; Vercel Cron auto-injects the bearer token.

• .env.example documents every required variable with setup steps.

• Per-route hardening: per-IP rate limiting, bounded JSON bodies, fetch timeouts, and stable sanitized error codes.

• Multi-session Pyth substitution lets us run on a single regular-session priceId per asset, even when only the overnight session is active.

Numbers shipped

• Smart contracts: ~2,450 lines of Solidity across 8 contracts, plus ~3,100 lines of Foundry tests (169 tests)

• Frontend: 36 React components, 14 pages, 22 custom hooks

• API routes: 12 (Pyth proxy, keeper, defender CRUD, market data)

• Lines of TypeScript: ~34,000

What's working end-to-end (demoable)

1. Connect wallet → opt into smart-wallet mode; the counterfactual wallet deploys on your first UserOp.

2. Visit /markets → see the live assets (TSLA / AMZN / PLTR / NFLX / AMD, plus AAPL / NVDA / SPY reference feeds) with live Pyth prices and 24h changes.

3. Open the Pledge drawer → one signature approves + locks collateral + mints USDG debt (pledgeAndBorrow).

4. Visit /portfolio → see health factor compute live from on-chain state, and repay / borrow more / withdraw / supply LP.

5. Auto-Defender (BETA) → sign once to grant a session key; the keeper sweep monitors your health factor (dry-run today).

6. Drop price (simulated wick via keeper) → liquidator dashboard surfaces the position → execute liquidation with 5% bonus.

Bootstrapped — no external funding raised.

EquiFlow is a self-funded prototype built entirely during the Arbitrum Open House London Buildathon. The project has:

• No outside investors

• No SAFE, SAFT, or token allocations issued

• No grants or sponsorships received

• No committed term sheets

• 100% founder equity / ownership

We are not currently running an active fundraise. If the buildathon submission demonstrates strong product-market signal, we may explore a pre-seed round post-event to fund a professional third-party security audit (an internal audit pass and fixes are already complete) and an Arbitrum One mainnet deployment — but no fundraising process is underway today.

Open to introductory conversations with investors interested in RWA, DeFi credit markets, or oracle infrastructure after the demo. No prior commitments to honor.