App

Risks & Mitigations

A lending market backed by tokenized equities carries the usual DeFi risks plus several specific to the collateral. Here is the list, what the protocol does about each, and what is left over.

Market-hours and gap risk

Even with 24/5 borrowing, collateral prices can stop updating during a weekend, holiday or issuer event and then reprice in a single jump. A position that looked healthy during the closure can become liquidatable as soon as a valid new price arrives.

Mitigation

  • When a price is unusable the protocol refuses to quote it rather than serving a stale number: new borrowing, indebted collateral withdrawal and liquidation for that asset stop
  • Ordinary borrowing and price closures leave repayment available; an emergency reserve pause can also block transactions
  • Every stock adapter uses a 24-hour source limit and validates Robinhood issuer state directly; AWS is not part of the valuation path
  • The gap between max LTV and the liquidation threshold is set wider than a crypto market's precisely to absorb a gap

Liquidation risk

If your health factor falls below 1.0 against a valid price, anyone can repay part of your debt and take collateral in exchange at a discount. There is no margin call and no human in the loop.

Mitigation

  • Initial loans are overcollateralised, and LTV limits plus debt ceilings reduce the chance that a price gap creates bad debt
  • Health factor is shown live, and projected for every action before you sign it
  • Partial repayment and collateral top-ups both restore a slipping position, at any hour
  • Isolation mode caps how much debt can ever sit against any one collateral asset

Oracle risk

Everything the protocol decides rests on a price. A wrong, stale or manipulated feed means wrong health factors and unfair liquidations, and historical SPY and QQQ rounds contained scale errors.

Mitigation

  • Prices come from Chainlink Standard Proxies native to Robinhood Chain, read through a validating adapter rather than raw
  • The adapter checks positivity, timestamp sanity, maximum age, declared precision, issuer state, corporate-action timing and an absolute price band before it will quote
  • The absolute band exists because the SPY feed once published answers about 10^8 times too large while still reporting correct decimals; it is immutable, so it cannot be widened to admit a bad price
  • USDG debt is valued at a fixed $1 so a stablecoin feed failure cannot stop health checks or liquidation; the live feed is used only to gate new borrowing

Chain liveness and session trust

Robinhood Chain does not have a Chainlink L2 Sequencer Uptime Feed. The protocol therefore cannot rely on a cryptographic uptime signal before accepting a price.

Mitigation

  • New borrowing follows the approved 24/5 calendar, including holiday and early-close blackouts, and needs a valid certificate with liveness refreshed on a 15-minute cadence
  • If AWS monitoring disappears, liveness expires within 30 minutes and new borrowing closes while direct Chainlink valuation and liquidation continue
  • The asset gate can set one stock's LTV to zero while other eligible stocks remain available; it preserves the liquidation threshold and bonus and requires 30 continuous healthy minutes before restoring borrowing power
  • The reporter can recover a missed certificate or liveness gap after fresh checks, but only governance can clear an explicit global restriction or governance hold

Concentration and single-name risk

An isolated position rests on one asset. A single company can gap on one earnings report or one regulatory action, and SPCX is a private company whose valuation is not set by a public market at all.

Mitigation

  • Supply caps and per-reserve debt ceilings bound total exposure to any one ticker
  • Equities are collateral-only, so nobody can build a leveraged short the pool would have to unwind
  • SPCX has the lowest LTV and highest liquidation penalty in the current set because it is a private mark
  • Feed cadence, price bounds and liquidation routes are measured per asset before listing

Issuer, token and eligibility risk

These tokens are claims on Robinhood's records, not bearer shares, and Robinhood describes them as debt securities with jurisdiction restrictions. The issuer controls minting, redemption, the shares-per-token multiplier, and can restrict or halt an asset.

Mitigation

  • Only the exact native issuer token addresses are listed; the deployment manifest rejects a same-symbol alternative, a third-party wrapper, an xStock or a Zona receipt token
  • No wrapper or ERC-4626 collateral is listed, which avoids the conversion-rate attack surface that has drained other lending markets
  • The app reads issuer status, multiplier and tradable sessions live from Robinhood's own catalogue, so a restriction surfaces rather than hiding
  • A pending corporate action can close borrowing power 30 minutes before its effective time; once effective, valuation needs the updated multiplier and a post-effective Chainlink round, and borrowing power needs the gate's separate recovery checks

USDG depeg risk

The loan asset is designed to track $1, but it can trade above or below that value. A Chainlink deviation trigger is an upstream service policy, not an onchain promise of a prompt update.

Mitigation

  • USDG debt is valued at $1 and USDG cannot be used as collateral, so a depeg cannot increase borrowing power or block liquidation
  • The live Chainlink feed blocks new borrowing outside $0.98 to $1.02 or when its round is more than 26 hours old
  • The live feed is read directly by the borrow sentinel, with no separate USDG observation transaction

Liquidity risk

Two versions. As a supplier, you can only withdraw what is not currently lent out. As a borrower, a liquidator needs somewhere to sell your seized collateral, and DEX depth for tokenized equities is still building.

Mitigation

  • The interest rate model prices utilisation directly: a drained pool becomes expensive to borrow from, pulling supply in and pushing repayment
  • The liquidation bonus is set wide enough to make liquidating worthwhile even when unwinding takes work
  • Supply caps and debt ceilings keep market size proportionate to the liquidity behind it
  • The app links to the venues where each asset trades, so the exit route is visible before you enter

Smart contract risk

Bugs in protocol code can lose funds. This is true of every DeFi protocol, including well-audited ones.

Mitigation

  • Zona is an Aave V3 deployment: the pool, rate model and liquidation logic are the audited upstream code rather than a fresh implementation
  • Beosin audited an earlier set of Zona contracts; the report is disclosed separately from the Robinhood-specific review status
  • The price adapters and borrowing controls carry regression tests for donations, corporate actions, stale and out-of-band prices, certificate expiry, incident recovery and collateral reduction while in debt
  • Reserves are created and frozen in one transaction so nobody can deposit between initialisation and configuration, and bootstrap deployer privileges are revoked before handover

Practical advice

  • Start with a small supply, borrow, repay and withdraw cycle
  • Start small enough that a mistake is a lesson rather than a loss
  • Borrow a fraction of your limit, not all of it, the difference in safety is far larger than the difference in liquidity
  • Hold more headroom going into a weekend, a holiday or an earnings date than on an ordinary Tuesday
  • Keep ETH for gas, always
  • Check the health factor after any collateral move, not only when you borrow