Vigil

Vigil is a session-aware collateral risk layer for tokenized equity (ERC-8056 stock tokens) on Morpho Blue, built for Robinhood Chain.

Problem. Robinhood's stock tokens trade 24/7, but their Chainlink feeds go silent from Friday evening until the Sunday 20:00 ET overnight open (48.9-52.2 h on 18-21 Sep 2026). In four years of NVDA data, both gaps that would have produced bad debt in an 86 % LLTV market came across a weekend - 5 Aug 2024 (-14.18 %) and 27 Jan 2025 (-12.49 %); utilization-based interest charged nothing for either. On Robinhood Chain every oracle behind the 168 stock-token Morpho markets prices the weekend at Friday's close or freezes; curators answer with low LLTVs and 0.7 % utilization.

Mechanism. Vigil attaches to an unmodified Morpho Blue market at three points. Oracle: an on-chain NYSE calendar (verified against nyse.com) drives a haircut priced on the duration of the closure being entered, H(L) = clamp(H_floor + k*sigma*sqrt(L/tau_night)), ramped over 60 minutes, capped at 5 % for the market. Premium: opted-in borrowers pay a USDG session premium from an on-chain index. Backstop: an ERC-4626 first-loss tranche in USDG receives it. Members get a soft unwind before the close (session-aware Morpho PreLiquidation pattern, discount <= 3 %) and liquidateWithCover: the backstop repays the shortfall in the same transaction as the seizure, so Morpho never realizes bad debt. Keepers can only tighten; the calendar alone runs the cycle.

Live, with the real tokens. Deployment v4 on Robinhood Chain testnet (46630) is a TSLA/USDG market whose collateral is Robinhood's own testnet TSLA stock token (ERC-8056 BeaconProxy from Robinhood's registry, faucet-issued) and whose loan token, premium escrow and backstop are Paxos's testnet USDG (Global Dollar). Nothing is minted. Only the TSLA/USD price feed and the interest-rate model are mocks, and Morpho Blue v1.0.0 is deployed from source, because the testnet has no Chainlink feeds or Morpho. Eight immutable Vigil contracts, all source-verified. A 37-transaction end-to-end run replays TSLA's own 5 Aug 2024 weekend gap (-10.81 %) with real TSLA and real USDG: one member unwound Friday, the other's 0.24 USDG shortfall paid by the backstop inside liquidateWithCover, suppliers untouched - every transaction linked in the README, and the run is the middle of the demo video.

Evidence. 80 Foundry tests + 3 mainnet-fork tests, invariants, ~93 % line coverage, CI. The fork suite runs Vigil against the real Morpho, AdaptiveCurveIRM, Paxos USDG, NVDA ERC-8056 token and Chainlink feeds on mainnet 4663 - only the gap is injected. Calibration on NVDA/AAPL/TSLA 2022-2026: plain market 3 bad-debt closures, Vigil market 0; premium ~122 bp/yr against an expected tail loss of 12-299 bp/yr depending on ticker and tail model - a wide band, hence a first-loss backstop with a cap. The live market uses the TSLA surface (sigma 0.0176).

Nitro-specific: block.timestamp only (block.number is an L1 estimate), evm paris, FCFS sequencing -> time-based unwind. Robinhood-specific: the testnet Stock implementation lacks Robinhood's oraclePaused() extension, which the mainnet token has - VigilSessionOracle probes it at registration. Prior art, named: Aftermarket on Base (7 Sep 2026: calendar, a Morpho oracle haircut growing with hours closed, a session interest multiplier), Kamino and Fluid (off-hours bands, corporate-action freezes), Robinhood Chain's calendars and oraclePaused-aware oracles, Morpho PreLiquidation, Venus' weekend buffer, the SSS paper. None combines an ex-ante closure haircut, a premium funding first loss, a same-transaction covered liquidation and a pre-close unwind.

Next: session keeper and unwind bot, mainnet with the real USDG and Morpho (deployment simulated: 24.9 M gas), AAPL and NVDA markets. Solo builder. Code: https://github.com/mdlog/vigil (MIT). Site: https://mdlog.github.io/vigil/ - dashboard: https://mdlog.github.io/vigil/dashboard/