Vigil

Vigil is a session-aware collateral risk layer for tokenized equity (ERC-8056 stock tokens) on Morpho Blue, built for Robinhood Chain.

Problem. Robinhood's stock tokens trade 24/7, but their Chainlink feeds go silent from Friday's close until the Sunday 20:00 ET overnight open (48.9-52.2 h on 18-21 Sep 2026). In four years of NVDA data, both gaps that would have produced bad debt in an 86 % LLTV market came across a weekend - 5 Aug 2024 (-14.18 %) and 27 Jan 2025 (-12.49 %); utilization-based interest charged nothing for either. The demand is here: on Robinhood Chain mainnet the 167 stock-token Morpho markets that lend USDG went from 6,387 USDG borrowed on 23 Sep to 682,110 of 706,512 on 29 Sep (96.5 %; one address holds 88 %). 99.7 % of that money sits in 62.5 % LLTV markets whose oracles price the weekend at Friday's close or freeze; the 86 % markets are unused.

Mechanism. Vigil attaches to an unmodified Morpho Blue market at three points. Oracle: an on-chain NYSE calendar (verified against nyse.com) drives a haircut priced on the duration of the closure being entered, H(L) = clamp(H_floor + k*sigma*sqrt(L/tau_night)), ramped over 60 minutes, capped at 5 % for the market. Premium: opted-in borrowers pay a USDG session premium from an on-chain index. Backstop: an ERC-4626 first-loss tranche in USDG receives it. Members get a soft unwind before the close (session-aware Morpho PreLiquidation pattern, discount <= 3 %) and liquidateWithCover: the backstop repays the shortfall in the same transaction as the seizure, so Morpho never realizes bad debt. Keepers can only tighten; the calendar alone runs the cycle.

Live, with the real tokens. Deployment v4 on Robinhood Chain testnet (46630) runs five markets on one set of eight immutable core contracts: TSLA, AMD, AMZN, NFLX and PLTR, each collateralised by Robinhood's own testnet stock token (ERC-8056 BeaconProxy from Robinhood's registry, faucet-issued) and lent in Paxos's testnet USDG (Global Dollar), which also funds the premium escrow and the backstop. Nothing is minted. Each market adds its own VigilOracle with its calibrated sigma (0.0106-0.0197); only the price feeds and the interest-rate model are mocks, and Morpho Blue v1.0.0 is deployed from source, because the testnet has no Chainlink feeds or Morpho. All contracts are source-verified on the explorer. A 37-transaction end-to-end run replays TSLA's own 5 Aug 2024 weekend gap (-10.81 %) with real TSLA and real USDG: one member unwound Friday, the other's 0.24 USDG shortfall paid by the backstop inside liquidateWithCover, suppliers untouched - every transaction linked in the README, and the run is the middle of the demo video. The dashboard reads all five markets live and lets a wallet lend, borrow, join, fund the backstop and move a position out of a plain 62.5 % market in one transaction (VigilMigrator).

Evidence. 93 Foundry tests + 3 mainnet-fork tests (unit, replay scenarios, invariants, fuzz regressions), 94 % line coverage of src, 112 dashboard tests, keeper and calibrator tests, CI. The fork suite runs Vigil against the real Morpho, AdaptiveCurveIRM, Paxos USDG, NVDA ERC-8056 token and Chainlink feeds on mainnet 4663 - only the gap is injected. Calibration on NVDA, AAPL, TSLA, AMD, AMZN, NFLX and PLTR, 2022-2026: plain market 9 bad-debt closures, Vigil market 0; premium 122-131 bp/yr for a max-LTV borrower against an expected tail loss of 12-299 bp/yr depending on ticker and tail model - a wide band, hence a first-loss backstop with a cap.

Nitro-specific: block.timestamp only (block.number is an L1 estimate), evm paris, FCFS sequencing -> time-based unwind. Robinhood-specific: the testnet Stock implementation lacks Robinhood's oraclePaused() extension, which the mainnet token has - VigilSessionOracle probes it at registration. Prior art, named: Aftermarket on Base (7 Sep 2026: calendar, a Morpho oracle haircut growing with hours closed, a session interest multiplier), Kamino and Fluid (off-hours bands, corporate-action freezes), Robinhood Chain's calendars and oraclePaused-aware oracles, Morpho PreLiquidation, Venus' weekend buffer, the SSS paper. None combines an ex-ante closure haircut, a premium funding first loss, a same-transaction covered liquidation and a pre-close unwind.

Next: a security review, then mainnet with the real USDG and Morpho and a curator partner (Safe roles; deployment simulated: 24 tx, 25.3 M gas), the keeper as a hosted service (today a CLI - status, poke, unwind, liquidate, attest - plus scheduled feed heartbeat, index poke and status watch over every market), NVDA and AAPL on mainnet. Solo builder. Code: https://github.com/mdlog/vigil (MIT). Site: https://mdlog.github.io/vigil/ - dashboard: https://mdlog.github.io/vigil/dashboard/

Everything was built inside the buildathon window (opened 14 Sep 2026); the repo's first commit is 19 Sep 2026 and every commit is in-window, structured by feature:

1. PRD and risk model (haircut surface H(L), premium index, buffer multiplier), then the 8 contracts on Morpho Blue v1.0.0 with a full Foundry suite (unit, historical replay scenarios, invariants). The fuzzer found two real bugs (INV-7 accrual monotonicity, INV-3 keeper-tightening ramp) - both fixed and pinned as regression tests.

2. Deployment to Robinhood Chain testnet 46630 in four steps: v1, v2 after the ramp fix (all mocks), v3 on Paxos's real testnet USDG, v4 on Robinhood's own testnet TSLA stock token plus Paxos USDG - nothing minted - later extended to five markets (AMD, AMZN, NFLX and PLTR added without a redeploy); contracts source-verified on the explorer.

3. A 37-transaction end-to-end script on the live deployment (supply -> borrow -> membership -> backstop -> keeper attestation -> soft unwind -> 5 Aug 2024 gap replay -> liquidateWithCover -> restore), recorded from the dashboard by an automated video pipeline whose narration is generated from the numbers the run produced; filmed four times as the deployment moved from mocks to the real tokens. A second pipeline renders the pitch video from live data: the mainnet Morpho scan, the testnet oracles and the calibration report.

4. A mainnet-fork suite against the real Morpho, AdaptiveCurveIRM, Paxos USDG, NVDA ERC-8056 token and Chainlink feeds on chain 4663; a full calibrator (POT/GPD tails, 4-year backtest across seven tickers, charts) with a parity test against the on-chain curve in CI; the embedded NYSE calendar 2024-2028 verified against nyse.com and pinned by a test; oraclePaused() made optional after finding the testnet Stock implementation lacks it.

5. A React landing page and dashboard on GitHub Pages that read all five markets through Multicall3 and let a wallet transact (lend, borrow, membership, backstop, migrate); VigilMigrator, a periphery contract that moves a Morpho supply position out of a plain market in one transaction; an off-chain keeper (status, poke, unwind, liquidate, attest; dry-run by default) with scheduled jobs - feed heartbeat, premium-index poke, status watch - over every market; a mainnet preflight (27 checks), handover script and runbook.

Only open-source dependencies were imported: Morpho Blue v1.0.0, OpenZeppelin 4.9.6, forge-std. Full history: https://github.com/mdlog/vigil/commits/main

Bootstrapped, no funding raised and no token. Solo builder; the buildathon prize would fund the session keeper / unwind bot service and a security review ahead of a mainnet deployment with the real USDG and Morpho.