Built for Robinhood Chain mainnet · settled in USDG
$700M of USDG on Robinhood Chain. Only $1.24M of it is lent against stock tokens.
People want leverage on stocks. The dollars to fund it are not there. TORQUE brings its own: pick NVDA, choose 2–5× and pay in USDG. The most you can lose is what you put in.
Read-only reads of Robinhood Chain mainnet at block 78,338,439 (2026-10-02 15:28 UTC): USDG totalSupply, and 167 Morpho markets lending USDG against a Robinhood Stock Token. Reproducible from the snapshot and script in the repo.
A knock-out, in one sentence
A leveraged bet with a built-in floor: if NVDA falls to a set level, the position closes itself, and you can never lose more than the money you put in.
Open
You post margin in USDG. The vault lends the rest, and the whole position is bought as real NVDA in the on-chain pool.
Knock-out
If Chainlink prints at your knock-out level, anyone can close the position. The vault is repaid first; what is left is yours.
Close
Sell back into the pool whenever the vault can be repaid in full. You keep the rest, in USDG.
Your loss stops at your margin.
Example: $2 of margin at 5× on NVDA at $231.40 (Chainlink RHNVDA / USD, 2026-10-01), from TORQUE's own formulas. Above the knock-out, each 1% move in NVDA is about 5% on your margin.
Chart scrolls sideways →
Two safety checks before every action.
They run inside TORQUE on every open, knock-out, deposit and withdrawal. If either fails, TORQUE waits.
Fresh price
Chainlink's NVDA price must have printed in the last 12 hours.
The feed updates on a ~0.5% move and freezes for about 52 hours every weekend (Fri 20:00 → Mon 00:00 UTC), measured over 601 rounds.
Market agrees
The NVDA/USDG pool's 30-minute average must sit within 1.5% of Chainlink.
Over 122,163 real swaps, the 30-minute average sat within 0.54% of Chainlink 99% of weekday time (worst 1.35%), and within 0.51% across the weekend of 09-26/27.
A Chainlink print from the last 30 minutes is trusted for knock-outs, so a fast sell-off can't hold up the knock-outs that protect the vault. Opens and LP flows stay strict.
How the vault stays solvent.
Fully hedged
Every position's whole size is bought as real NVDA and held by the contract. The vault is a secured lender, never short NVDA.
Capped in the contract
Vault $20. Open interest $30. Lending at most 80% of the vault. Leverage 2–5×. Every fill within 1% of Chainlink. No admin key, no pause, no upgrade.
Weekend gap, tested
If Monday opens below a position's financing level, the first fresh price knocks it out. The trader loses the margin, never more. LPs absorb exactly the shortfall, which was already in NAV.
Knock-outs can't be blocked
Residuals are credited for the trader to claim, never pushed, so a frozen USDG address can never hold up a knock-out.
Before mainnet
An attacker's pass on the contracts.
Found
A dead price feed could have locked LP money.
If the NVDA feed stopped for good or started reverting, LPs could never withdraw, even with every position closed and all USDG idle.
Fixed before deployment
- A broken feed reads as "no price"; it never reverts.
- With no open positions, LPs can always withdraw.
- After 7 days without a usable price, anyone can unwind a position at the pool's 30-minute average. The vault is repaid first.
Reentrancy through a hook-calling token
Every re-entry into the market reverts. Removing the guards makes the test fail.
First-depositor inflation
The victim loses dust; the attacker cannot take out more than they put in.
Sandwich on the real pool
$1k, $10k and $100k front-runs lose about $1, $10 and $100. The victim fills within 0.53% of Chainlink.
Knock-out at a manipulated price
The trigger is Chainlink, not the pool. A forced sale must fill within 1% or it reverts.
Same-block ordering
An LP cannot withdraw ahead of a known loss. LP and trader in one account cannot come out ahead.
Free position
Borrow is always below notional, and every round trip costs the open fee.
Invariants first, then the product.
solvency invariants, 1,024 runs × 128 calls each, written before the product code
attacks tried on the contracts, plus a sandwich on the real pool: all held
planted bugs caught. The 25th removes one of two duplicate cap checks and changes nothing.
fork tests against live Robinhood Chain state: real USDG, NVDA, pool and feed
USDG is the whole product.
Traders post USDG.
LPs deposit USDG.
The vault lends USDG.
Everyone is paid in USDG.
Buildathon cap
LP vault capped at $20 USDG for the buildathon.
At $20 the vault can lend up to $16: two $2 positions at 5×, or four $1 positions at 5×. The cap is enforced in the contract.
Deploys to Robinhood Chain mainnet with real USDG: testnet has no real stock feeds or stock pools, so a testnet version would prove nothing.
Prior art, side by side.
The two buildathon entries that offer leverage on stock tokens, as read from their code and contracts on 2026-10-01. Sources for every cell are below the table.
Table scrolls sideways →
| Question | TORQUE | Gauntlet | Undertow |
|---|---|---|---|
| Network (as read) | Mainnet deployment in progress | Robinhood testnet (2026-10-01) | Robinhood testnet (2026-10-01) |
| Where leverage and settlement happen | On chain, in TorqueMarket | Off chain, in the operator's game server; payouts through operator-posted merkle claims | On chain: SpanCreditVault lends against a computed risk number |
| Price source | Chainlink RHNVDA / USD, cross-checked against the pool's 30-minute average | A seeded ETH game price on the operator's server | PriceRelay, set by a single updater key |
| What backs the loan | Real NVDA, bought at open and held by the contract | No loan: payouts are split between players | Deposited collateral (MockNVDA on testnet) |
| Counterparty | A USDG LP vault | Other players (pari-mutuel) | uUSD, a stablecoin the vault mints itself |
| Who can close a position | The owner closes; anyone can knock it out at the barrier | The operator's game server | Anyone can liquidate (liquidate() has no access check) |
| Admin key / pause / upgrades | None. One-shot setMarket at deployment | Vault has pause and unpause, an owner and an operator; no proxy | Single price-updater key; no pause or upgrade in the contract source |
Read how it works, line by line.
The spec, the solvency invariants, the adversarial report and the research data behind every number on this page are open.