The other side of every trade, stress-tested first.

Novation clears options on Robinhood Chain stock tokens, re-pricing both sides’ whole books across 39 scenarios on-chain before any trade settles in USDG.

Open the app Read the risk model

Stock tokens are not available to US persons.⁷

Initial margin, demo account 7596.51USDG
The cyan ring sits at −IM. Every node above it is a scenario the margin covers. Drag to turn it. Arrow keys step through the scenarios.

Scenario PnL in USDG, Regular session. Initial margin 596.51 USDG.
Volatility	price −R	price −5/6 R	price −2/3 R	price −1/2 R	price −1/3 R	price −1/6 R	price 0	price +1/6 R	price +1/3 R	price +1/2 R	price +2/3 R	price +5/6 R	price +R
vol ×0.7	−373.66	−253.21	−168.98	−106.71	−56.07	−14.52	+16.36	+35.78	+45.79	+49.96	+51.35	+51.73	+51.81
vol ×1.0	−420.08	−295.85	−200.31	−127.87	−72.76	−30.91	0.00	+21.58	+35.52	+43.74	+48.15	+50.29	+51.24
vol ×1.4	−483.46	−358.97	−257.17	−176.09	−112.93	−64.69	−28.57	−2.14	+16.69	+29.68	+38.34	+43.90	+47.33

The tokens are on-chain. The hedges belong there too.

195 stock tokens are live on Robinhood Chain.¹ There is no options market to hedge them with.
Without options, a holder can sell the token or keep it. A put caps the downside at a known price, for a known premium.
Tokenized assets hold about $125M of the chain’s $1.0B in value locked.²
Held tokens can also earn. A covered call collects premium on a token its holder means to keep, with the token itself as the collateral.
The stock market closes on Friday. The tokens keep trading.³
In 13 weeks of round history, the Chainlink equity feeds published no round on a Saturday, or on a Sunday before 20:00 ET. A margin system has to price that gap before it starts, not after it ends.

How a trade clears

Buyer and seller agree a price. Novation steps between them: each side ends up holding its position against the clearinghouse, and neither position exists until both whole books pass the same stress test.⁶

Step 1: Stress-test the whole book
Each side’s options and collateral are re-priced across 13 price shocks and 3 volatility shocks. The worst of the 39, with a floor for short options, sets its initial margin.
Step 2: Refuse before risk
If either side’s initial margin would exceed its equity, the transaction reverts. Nothing half-clears, and no position exists without its check.
Step 3: Settle in USDG
Premium and fees move in the same transaction. Each side now holds its position against Novation, not against the other trader.

The margin check that outgrows an EVM transaction

Portfolio margin re-prices every option in the book 39 times. Hand-optimized Solidity pays about 92,500 gas per position for that; the Stylus kernel about 5,000.⁴ A trade runs at least two margin checks. At 256 positions, two checks take 46.5M gas in Solidity, over Arbitrum’s 32M per-transaction limit, and 2.65M on Stylus.

Solidity, hand-optimizedStylus kernelOne trade: two checks at 256 positions

Execution gas of one margin check, measured on Robinhood Chain testnet
Positions	Solidity, hand-optimized	Stylus kernel
1	109,700	42,597
8	745,420	76,352
32	2,922,648	199,415
64	5,828,423	351,072
128	11,646,851	685,075
256	23,269,339	1,323,108

Measured on Robinhood Chain testnet: execution gas of one margin call, same algorithm and integer math in both.⁴

The deployed kernel⁵

At 32 positions, a margin call to the deployed Stylus kernel costs 262,876 gas as a transaction. The plain Solidity reference, which returns the same bytes, costs 22,092,627.

At 256 positions the kernel needs 1,664,367. The reference runs out of gas.

Kernel 0x6d07…ceaA Reference 0xB7d9…50C6

Three ways in

Vaults
Earn premium on stock tokens you already hold.
Covered-call and put-write vaults write options against deposited stock tokens or USDG. Deposits and withdrawals price at live mark-to-market, so nobody enters or leaves at a stale value.
See the vaults
RFQ desk
Market makers quote; the clearinghouse enforces.
Quotes are signed EIP-712 messages. When a taker fills one, both sides pass the margin check inside the same transaction, or nothing moves.
Trade on the desk
Agents
A risk budget, not a spending limit.
Grant an agent a ceiling on your account’s initial margin. The demo’s hedge-bot works under a 1,500 USDG budget, and account 7 needs 596.51 today. A ticket that would push the margin past the budget reverts on-chain.⁶
Set an agent’s budget

When something breaks

Most failures are refused before they can happen. The ones that get through walk a fixed order, on-chain.

If an account defaults

An account owes more than it holds
A net payer at expiry can’t cover its payoff, or a liquidation finds equity below zero.
Tier 1: First, the defaulter’s own collateral
Sold by Dutch auction: by default the discount rises from 2% to 12% over 30 minutes. Proceeds repay the expiry pool first. No bids are taken on weekends or while the underlying is halted, so nothing sells without a live price.
Tier 2: Then the insurance fund
Filled by a share of every trading fee and by liquidation penalties. At settlement it bridges the shortfall as far as its balance goes, and the sale repays it after the pool.
Tier 3: Last, every cash balance, pro rata
Only if the collateral and the fund run out: one cash index scales every account’s USDG cash down by the same fraction, and the chain emits LossSocialized.

The orange stream is the unpaid loss. Each basin keeps what it can and spills the rest to the next. The order is fixed in the contracts, and no step needs an admin to run it.

Refused before it can break

Weekend widening
From Friday 20:00 ET to Sunday 20:00 ET the default shocks are 1.75× wider. The same demo book needs 596.51 USDG of initial margin on a weekday and 1,373.29 over the weekend, so a trade that clears on Friday can be refused on Saturday.⁶
The same refusal on-chain, on testnet
Corporate-action halt
When the token issuer pauses its oracle for a split or a dividend, the underlying is halted. Opening trades revert; trades that only reduce risk still clear.
The same refusal on-chain, on testnet
Stale-feed halt
A price older than its session’s limit halts the underlying the same way, and auctions on it take no bids until a fresh round.
Over-budget agent
In the demo, the hedge-bot agent tries to sell 60 NVDA 200 calls for account 7. Its worst case after the trade, the account’s initial margin, comes to 1,762.72 USDG, past the agent’s 1,500.00 USDG budget, so the trade reverts with AgentRiskBudgetExceeded.⁶
The same refusal on-chain, on testnet

Built to be checked

Immutable core
The clearinghouse and the kernel cannot be upgraded, and the list of venues is fixed once setup ends. There is no proxy and no admin path to positions or cash; a guardian can only pause new openings.
Read the contracts
Bounded parameters behind a timelock
Risk parameters change only through a timelock, and only inside minimums and maximums written into the contracts.
Read the parameter bounds
Solvency invariants under test
Unit, fuzz and mutation tests check after every settlement step that the clearinghouse holds every cash balance and every expiry pool. A stateful invariant suite is in progress.
Read the tests
Bit-exact kernel parity⁵
The Stylus kernel, its Solidity twin and the Python reference compute the same integers. On testnet the deployed kernel and the Solidity reference return byte-identical margin results.
Read the parity tests Kernel on testnet
Self-review report
A security self-review with its threat model, and a claims file that marks each claim as reproducible, verified live, modeled or not claimed.
Read the report

Protocol

Demo snapshot, Sep 29, 16:00 UTC⁶

Open interest: $1,440,901
Vault deposits: $1,344,232
Insurance fund: $25,000
Premium, 7 days: $5,662
Liquidations, 7 days: 1
Loss socialized: $0

Sources

1195 active stock tokens on Robinhood Chain (chain 4663), from Robinhood’s public stock-token asset list, read Sep 25, 2026. docs.robinhood.com/chain, api.robinhood.com/rhj/assets
2Robinhood Chain value locked about $1.00B on Sep 24, 2026 (DefiLlama). Tokenized assets, stock tokens among them, about $124.8M on DefiLlama’s broad count; about $32M on the narrower measure the same article cites. cryptoticker.io
3Chainlink equity feeds on Robinhood Chain follow 24/5 US market hours and have no heartbeat off-hours. In 13 weeks of on-chain round history for NVDA, TSLA, AAPL and SPY there was no round on a Saturday or on a Sunday before 20:00 ET, and rounds after the Friday 16:00 ET close were rare. data.chain.link, docs.robinhood.com/chain/oracles-and-price-feeds
4Execution gas of one margin() call on Robinhood Chain testnet (chain 46630), measured with a gasleft() probe inside eth_call. Stylus: the Novation risk kernel, on a book spread over 8 underlyings. Solidity: a hand-optimized version of the same 39-scenario grid and integer math, on a one-underlying book, without the short-option minimum the kernel adds. Marginal cost about 5,000 gas per position on Stylus and 92,452 in Solidity. The 32,000,000 per-transaction limit is ArbGasInfo.getMaxTxGasLimit() on the same chain. Kernel 0x6d07…ceaA, Solidity baseline 0x9F5a…eCEe, docs/gas.md
5The Novation risk kernel (Stylus) and KernelReference, its plain Solidity twin, deployed on Robinhood Chain testnet. Byte-identical return data on margin() books of 4, 8 and 32 positions. Gas from eth_estimateGas on margin() on Sep 30, 2026, one-underlying books, including intrinsic, calldata and L1 costs. At 64 positions and more the reference needs more than the RPC’s 50M call allowance. Kernel 0x6d07…ceaA, Reference 0xB7d9…50C6, docs/gas.md
6Demo account 7 and the hedge-bot ticket are computed by the Novation kernel reference with the default risk parameters (weekend shock multiplier 1.75). The Stylus kernel returns the same integers.
7Stock tokens are issued by Robinhood Assets (Jersey) Ltd and are not available to US persons. robinhood.com newsroom

The other side of every trade, stress-tested first.

Vaults

RFQ desk

Agents

If an account defaults

Refused before it can break

Protocol

Sources