Your US stocks, managed while you sleep
Non-custodial autopilot for tokenized US stocks on Robinhood Chain: scheduled recurring buys + always-on stop-loss / take-profit protection, enforced by a session-aware onchain guard, settled in USDG, with a verifiable onchain trail.
US market hours are 21:30–04:00 in Singapore — Asian holders sleep through every session. Tokenized stocks trade 24/7 but are priced 24/5: Chainlink equity feeds go stale on weekends, so naive automation buys blind into dead prints. There is no onchain DCA and no spot protection for stock tokens (only perps have TP/SL).
Fund a plan once (stock, amount, cadence, stop-loss, take-profit, slippage, cooldown). A permissionless keeper buys on schedule; the guard screens every fill for freshness, volatility-adaptive bands computed trustlessly from feed round history, and corporate actions — refusals emit events. Protection sells to USDG the moment your levels break; after any rescue sale the plan cools down instead of buying straight back into the crash. Idle USDG sweeps to the Steakhouse Earn vault. Every fill, refusal, and protection links to its transaction.
1. First recurring-buy + spot-protection autopilot for tokenized equities.
2. Volatility-adaptive execution bands from Chainlink round history — no trusted inputs.
3. Honest Stylus workload (ratios + variance + integer sqrt) ported to Rust, deployed onchain: bit-identical outputs at 41% less gas (78,311 vs 133,746).
4. The refusal is the proof: GuardRejected events make safety visible; protection never acts on stale data.
Funded mainnet plan + public track record → oraclePaused() hardening → TWAMM execution + baskets → multisig + audit → family-office rails.
Built end-to-end during the buildathon:
Contracts (Foundry, OpenZeppelin)
- BatpilotVault — plans, custody, DCA + protection execution, ERC-8056 corporate-action tripwire, per-plan slippage floors, protection cooldown, Earn sweep, full exit
- SessionGuard + SessionVolEngine — staleness/band/pause firewall + volatility-adaptive bands from feed round history
- UniswapV3Adapter (oracle-anchored slippage) + MorphoEarnAdapter (ERC4626 Earn)
- 31 tests green: 16 vault-loop + 8 vol-engine + 4 mainnet-fork (real NVDA/feed/6-decimal USDG) + 3 live-venue tests (real Uniswap swaps both ways, real Steakhouse deposit/withdraw)
Stylus (Rust) — guard + vol math ported, 7/7 parity tests, deployed on testnet, benchmarked onchain bit-identical at 41% less gas
Offchain — permissionless keeper as a Cloudflare Workers cron (both chains, quiet-by-design logging), GitHub Actions cron syncing testnet demo feeds to live Yahoo quotes, Vite + wagmi app (chain switcher, living plan sentences, sparklines, P&L, infinite verifiable trail)
Live evidence
- Pitch deck: docs/pitch/Batpilot_Pitch.pptx in repo
- First real mainnet fill: 0x12e29b940cd94b683feda0bf1fe2c7ed27d784dec78722eb02c72df702db5689
One honest flag: I wrote "31 tests" — that's 16+8+4+3. The 7 Stylus host tests are separate (stated in the video as part of the suite). If the form has a test-count field, say 38 total (31 Foundry + 7 Stylus).
None