Documentation
How ARCWELL works
Everything the interface reads and writes, with the addresses it relies on. All contracts are verified on Robinhood Chain and every figure in the app comes from them.
Overview
ARCWELL is a set of isolated Morpho Blue lending markets where tokenized stocks and ETFs serve as collateral and USDG (Global Dollar) is the asset borrowed. Three layers: sealed markets, an ERC-4626 vault that spreads lender USDG across them under caps, and equity aware oracles that wrap Chainlink feeds with staleness, corporate action and sequencer guards.
A market is the tuple (loanToken, collateralToken, oracle, irm, lltv). Its id is the keccak256 of that tuple and nothing in it can change after creation. Equity markets settle on the protocol's own Morpho Blue instance; the on-chain native PONS market settles on the canonical Morpho deployment.
Network
| Chain | Robinhood Chain mainnet (Arbitrum Orbit L2), chain id 4663, gas paid in ETH |
| Public RPC | https://rpc.mainnet.chain.robinhood.com (about 5 requests per second per IP, no CORS) |
| App proxy | /api/rpc: same origin, read-only allow list, request spacing and backoff |
| Explorer | https://robinhoodchain.blockscout.com |
| Multicall3 | 0xcA11bde05977b3631167028862bE2a173976CA11 |
Contracts
| USDG (6 decimals) | 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 |
| Equity Morpho Blue | 0xf0A0a33729270586cDD66010B1cedE649745c3A5 |
| Equity AdaptiveCurveIrm | 0x9316E7eDAB60eF0f489b1E4D11DDcDaa560aCbfD |
| Arcwell USDG Vault (MetaMorpho v1.1) | 0xF0E6AD006080c48766ddb95b8c568D72bC059050 |
| Canonical Morpho Blue | 0x9D53d5E3bd5E8d4Cbfa6DB1ca238AEA02E651010 |
| Canonical AdaptiveCurveIrm | 0x2BD3d5965B26B51814AC95127B2b80dD6CcC0fa1 |
| Frontier vault (Vault V2) | 0x338b2f252dae1deb00Afb700128e592a19F8918c |
| Frontier adapter | 0xF2656B3277480979712c5aC451c82A3125227Ffe |
| USDG / USD feed | 0x61B7e5650328764B076A108EFF5fa7282a1B9aD2 |
| ETH / USD feed | 0x78F3556b67E17Df817D51Ef5a990cDaF09E8d3A9 |
Markets
| Market | LLTV | Core | Collateral | Oracle | Market id |
|---|---|---|---|---|---|
| PONS / USDG | 38.5% | Morpho Blue (canonical) | 0x39dBED3a2bd333467115dE45665cC57F813C4571 | 0x07a8b7c2efe8cb37b4a3FE01f87d711B205c5aFf | 0x0b6969a5312a72617720a9c992760b12884a6faab277ce8f410b939b17ce52d5 |
| NVDA / USDG | 62.5% | Equity Morpho Blue | 0xd0601CE157Db5bdC3162BbaC2a2C8aF5320D9EEC | 0x8633cbf28eC16E9aF167E26F2E8775f5FF3f148a | 0x467464ebfe2988ca5b2d2b4273aa688c4855d79270fdfafd64ef83088d917c48 |
| AAPL / USDG | 62.5% | Equity Morpho Blue | 0xaF3D76f1834A1d425780943C99Ea8A608f8a93f9 | 0xa8C510c4A240bb230340150fEe83d943043Db858 | 0x8865149ec23deeaa41a76a96cfc6ae1daac0a07196a4f22000dad0f0d559cb3e |
| MSFT / USDG | 62.5% | Equity Morpho Blue | 0xe93237C50D904957Cf27E7B1133b510C669c2e74 | 0x8aeED6BF3F332CB8b0aC6D3aFbE610C1012D8e91 | 0x2a05a82771c3843a9ac24b36147c469431df7fa35ac586bf2b0d4b91680d3467 |
| TSLA / USDG | 62.5% | Equity Morpho Blue | 0x322F0929c4625eD5bAd873c95208D54E1c003b2d | 0xb2Df94538ba8c6273A528617A9D16e48EE082dbC | 0x7b0a7e894164df14f0422c18c218f6104c5ca5a626c33e2f0e9f77189bbd42f2 |
| SPY / USDG | 77% | Equity Morpho Blue | 0x117cc2133c37B721F49dE2A7a74833232B3B4C0C | 0xD2D04D0e5886fC3Bb47BdE1E7571FB83d187cfF7 | 0xf24077f2777a4b87110cf317c629c34e8096e79d580ee319cb5205937dd0cb16 |
| QQQ / USDG | 77% | Equity Morpho Blue | 0xD5f3879160bc7c32ebb4dC785F8a4F505888de68 | 0x7B57d0E0be56289F5C3427B0b161d44181b108FF | 0xdab32d3a57485b0de3856eea808332456c4d053df20777ece55ccba21c091561 |
Ids are derived in the app from the market parameters, never hard coded, and pinned by unit tests.
Oracles and trading hours
Equity oracles return baseFeed / quoteFeed scaled to Morpho's 36 decimal convention, where the base feed is the stock's Chainlink USD feed and the quote feed is USDG / USD. USDG is never assumed to be worth one dollar. The guards run in order: sequencer up and past its grace period, issuer pause flag clear, every feed answer positive and fresher than its bound (97 hours for stocks, to survive long weekends, 25 hours for USDG).
If a guard trips, price() reverts. That freezes borrowing, collateral withdrawal while in debt, and liquidations. Repaying, adding collateral and lending never depend on the oracle. PONS is priced by a 5 minute Uniswap v3 TWAP against WETH, converted through the ETH / USD and USDG / USD feeds, with pool idle and liquidity guards.
The session badge in the header is informational only: core session 09:30 to 16:00 New York, weekends flagged. The chain decides what is paused.
Vault
Arcwell USDG Vault is a MetaMorpho v1.1 vault over USDG with a supply queue of the six equity market ids and a cap per market. Deposits fill the queue in order; withdrawals follow the withdraw queue and need unborrowed liquidity. Raising a cap goes through an on-chain timelock; lowering is immediate. The performance fee is read from the contract. The interface reads totalAssets, totalSupply, balanceOf, maxWithdraw, maxDeposit, convertToAssets, config, pendingCap and the supply queue; allocation per market is the vault's supplyShares in each market.
The Frontier vault is a Morpho Vault V2 that lends to the PONS market through an adapter. Only its ERC-4626 surface is used.
Formulas
| Utilisation | totalBorrowAssets / totalSupplyAssets |
| Free liquidity | totalSupplyAssets − totalBorrowAssets |
| Borrow APR | borrowRateView × 31,536,000 (simple annualisation) |
| Supply APR | borrowAPR × utilisation × (1 − market fee) |
| Debt | borrowShares → assets, rounded up, with Morpho virtual shares (1e6) and virtual assets (1) |
| Collateral value | collateral × oracle price / 1e36 |
| Borrow limit | collateral value × LLTV |
| Health factor | borrow limit / debt |
| Liquidation price | debt × 1e36 / (collateral × LLTV) |
| Liquidation incentive | min(1.15, 1 / (1 − 0.3 × (1 − LLTV))) |
| Vault APR | allocation weighted supply APR over totalAssets |
| Net APY | (Σ supplyAPR × lent + vaultAPR × deposits − Σ borrowAPR × debt) / (lent + collateral) |
| Rate curve | AdaptiveCurveIrm: target 90%, steepness 4, rate = (coeff × err + 1) × rateAtTarget |
Actions
Every write follows one path: network check and switch, allowance read, approval when needed (waiting for the receipt and for the node to reflect the new allowance), simulation, signature, receipt. Only a receipt with status success marks the action as done.
| Add collateral | approve collateral → supplyCollateral(params, assets, user, 0x) |
| Remove collateral | withdrawCollateral(params, assets, user, user); while in debt it needs health ≥ 1 and a live price |
| Borrow | borrow(params, assets, 0, user, user); bounded by the borrow limit and market liquidity |
| Repay (partial) | approve USDG → repay(params, assets, 0, user, 0x) |
| Repay (all) | approve debt + 0.1% → repay(params, 0, borrowShares, user, 0x) |
| Lend | approve USDG → supply(params, assets, 0, user, 0x) |
| Unlend | withdraw(params, assets, 0, user, user), or by shares to exit fully |
| Vault deposit | approve USDG → deposit(assets, user) |
| Vault withdraw | withdraw(assets, user, user), or redeem(shares, user, user) to exit fully |
Liquidations are permissionless on Morpho Blue and are not part of the interface.
Points
One point per USDG per day, lent (vault or direct) or borrowed. Computed in the browser from the wallet's own Supply, Withdraw, Borrow, Repay and Liquidate events on both Morpho cores, plus Deposit and Withdraw on both vaults, weighted by how long each balance was held. Nothing is stored server side and nothing has to be claimed.
aUSD design
aUSD is a planned dollar issued 1:1 against USDG. Its treasury keeps a liquid USDG floor, lends part of the reserve through this vault and holds tokenized T-bills; all reserve income vests to saUSD stakers over seven days. It launches once the markets have depth. Nothing in this section is live on chain today and the interface exposes no aUSD action.
Security notes
- No private keys, no custody, no secrets in the client. The only environment values are RPC URLs and an optional WalletConnect id.
- Addresses, chain id and decimals are checked against the chain by the verify script and pinned by unit tests.
- USDG is priced through its own feed inside the oracles; the interface never assumes one dollar.
- A transaction is shown as confirmed only after its receipt reports success.
- The RPC proxy forwards read-only methods only. Wallets broadcast transactions over their own connection.