Quick Links:

1. GitHub: https://github.com/Aaditya1273/BLOOM
2. Live Link: https://bloom-page.vercel.app/
3. Vedio: https://youtu.be/8crMpT9Bd8U
4. WhitePaper: https://drive.google.com/file/d/1yaxMUIO-uTIR6JFx5ZynW0lEWmK2wWsY/view?usp=sharing
5. PPT: https://drive.google.com/file/d/1iM8E9Hn46Y3KiUri8w6zrMqep_9EUfBm/view?usp=sharing
6. Deployed Contract: https://explorer.testnet.chain.robinhood.com/address/0xc464c03bfe7efa388457b8b392454b99fa18b124

Bloom

The wallet where dollars become assets and actions.

Save in USDG. Send Robinhood Stock Tokens. Let your agent act under your rules.

Bloom is a consumer wallet on Robinhood Chain. Users save in USDG, use supported Robinhood Stock Tokens as programmable assets, and let an AI agent act under explicit risk and spending rules.

At a glance

1. Introduction

Robinhood is bringing US equities onchain. On July 1, 2026 it announced that Robinhood Chain, built on the Arbitrum platform, is live, with Stock Tokens available in the Robinhood Wallet in more than 120 countries, and that Agentic Accounts would let people connect an AI model to their account while humans "set the specific safety guardrails" (Robinhood newsroom).

That creates two new kinds of money: dollars (USDG) and stock tokens that move 24/7, and agents that move them. Bloom is the wallet built for both. It is three screens, Home, Chat and Goals, on top of four onchain systems: an ERC-4626 savings vault, a canonical-only stock router with claim links, ERC-4337 smart accounts with policy-scoped agent keys, and the Bloom Risk Engine, a default-deny state machine for equity risk running as an Arbitrum Stylus contract.

2. The problem

Tokenized stocks trade around the clock. The stock market does not.

Robinhood's own documentation says end users can trade Stock Tokens onchain outside the window in which market makers mint and burn them, that corporate actions are applied through an onchain uiMultiplier, and that tradability varies per session (Robinhood Chain docs). So the token keeps moving while the underlying market can be:

A lending market that treats a fresh price as permission to lend keeps lending and liquidating straight through all of it. Lending against stock tokens today is flying blind.

AI agents are getting wallets, guarded by a prompt

Agents that turn "save for my laptop" into transactions are arriving now. In most systems the only thing between the model and the money is a system prompt: injectable, nondeterministic and confident when wrong. In finance the failure mode is not a bad answer. It is a transfer.

USDG needs everyday use

Stable dollars on a new chain need real consumer jobs: saving, sending, investing, paying someone new. Not just vault deposits.

3. The solution

The AI proposes. Your policy decides. The chain enforces.

Bloom doesn't replace the price oracle. It adds equity-specific risk interpretation around it.

4. What makes Bloom different

Five properties hold by construction (proofs in the whitepaper, ):

1. Default deny. An asset is NORMAL only if all seven adverse predicates are false. Anything missing, malformed, stale or contradictory denies.

2. Adverse monotonicity. No additional signal can move an asset into NORMAL.

3. Silence denies. If the reporter, feed or sequencer goes quiet, the asset becomes STALE and its max LTV drops to 0.

4. Portfolio default deny. One non-NORMAL collateral asset zeroes the whole position's borrow capacity.

5. Protected liquidation. Nobody is liquidated on a halted, stale, deviating or corporate-action price.

And one honest result nobody else will show you: Stylus costs more gas than the EVM for this workload (1.57× to ingest a report, 1.95× to evaluate risk), because the engine is call-bound rather than compute-bound. We measured it, explain it, and keep Stylus for the memory-safe, natively tested Rust core (§9).

5. Product tour

Save $100 in USDG	"Save $500 for my laptop."
One tap into the savings vault; the user's wallet signs.	The sentence becomes an onchain policy; the user signs once and the agent is active.

"Send Sarah $5 of QQQ."	Live halt: borrowing stops
Risk check, policy check, a plain-English plan, then the agent executes onchain.	A signed report lands on the Stylus engine; AAPL flips to HALTED, LTV 0%, and the agent refuses.

The four frames above come from the product film, which rebuilds the app's UI with its exact design tokens. The screenshots below are captures of the running app.

Landing	Home	Chat	Risk: halted

Mobile (390px): home · chat · goals · risk · activity · claim

6. Architecture and workflows

System architecture

Workflow: from a sentence to an agent action

The risk lattice: ordered checks, first failure wins, default deny

Every red state returns max LTV 0%, disables borrowing and pauses liquidations. Facts about the data are checked before facts about the market, so a market signal is never read from untrustworthy data.

Workflow: a live trading halt

More detail: ARCHITECTURE.md, and the formal model in the whitepaper.

7. Market

Every figure below is quoted from its source; none is a Bloom estimate.

Why now. Tokenized stocks are the fastest-growing slice of the RWA market, the largest US retail broker has put them onchain on an Arbitrum chain, and the same company is handing wallets to AI agents with human-set guardrails. Every lending market, agent and wallet built on top of that needs to know whether it is safe to act on a stock token right now, and to enforce the guardrails somewhere a model can't talk its way past. Bloom is the consumer app and the risk primitive for that world.

Who uses what.

8. Business model and roadmap

Planned, not implemented. Nothing below is live today.

9. Measured results

All measured on September 25, 2026 at tag bloom-v2-rc1 (details and methods in the whitepaper, §10).

Stylus versus EVM, measured with scripts/bench-risk-engine.js (sends no transactions):

Live reporter cycle. One cycle advanced every asset's report nonce by exactly one (AAPL 70→71, NVDA 64→65, QQQ 69→70, SPY 65→66); the AAPL report (tx 0x57e3…dec0) carried $336.31 while the Robinhood API quoted a bid of $336.14 and an ask of $336.26. Running cost at a 120-second cycle over four assets: about 0.005 testnet ETH per day.

10. Deployed contracts

Live on Robinhood Chain Testnet (chain 46630), deployed 2026-09-25, with the risk engine running as a real Arbitrum Stylus (Rust/WASM) contract. Manifest: deployments/robinhood-testnet.json. Integrity is checkable read-only with npx hardhat run scripts/verify-deployment.js --network robinhoodTestnet.

Canonical mainnet dependencies Bloom is configured for (mainnet not deployed; the gated script refuses above its cost limit):

11. License and attribution

MIT. See LICENSE. Bloom evolved from the Aura codebase: its smart-account, vault and Stylus foundations were reused and hardened, and the original sources are archived in legacy/aura/ with attribution preserved. Account abstraction builds on eth-infinitism's ERC-4337 contracts, and the token and access-control primitives come from OpenZeppelin.

Completed on Testnet.

NA