Acre protocol

A lending market for tokenized real-world assets on Robinhood Chain. Suppliers deposit USDG and earn the borrowing rate. Borrowers post tokenized equities as collateral and draw USDG against them without selling the position.

What the protocol does

Acre operates a single lending pool. One asset is lent, USDG, and many assets can be posted as collateral: tokenized equities and exchange traded funds issued on Robinhood Chain.

The pool is cross margined. A borrower's collateral is assessed as a portfolio rather than position by position, and a single debt balance is drawn against the whole of it. Collateral is held separately from the lending pool and is never lent out, so one borrower's position can never be diluted by another's.

The protocol is open at every block. What changes through the week is how much it will lend against a given asset, and what that borrowing costs.

Why terms move

A tokenized equity trades continuously. The security it tracks does not. The New York Stock Exchange closes at 16:00 Eastern and reopens the following morning, and across a weekend that gap stretches past sixty hours.

Every lending protocol in decentralised finance assumes continuous price discovery and continuous liquidation depth. That assumption holds for a governance token and fails for a tokenized share of Nvidia. A borrower can be comfortably collateralised at the Friday close and deeply underwater at the Monday open, with no opportunity to liquidate at a fair price in between.

A protocol that ignores this has two options, both bad. Set collateral requirements loosely and accumulate bad debt on the first serious gap. Or set them tightly enough to survive a weekend, and be uncompetitive during the ninety percent of the week when that risk is not present.

Acre takes a third option: treat time as an input. Borrowing capacity is widest while the underlying market is open and liquidation can execute into real depth, and tightens as the distance to the next session grows.

These multipliers are enforced as monotonic in the contract. Governance cannot configure a state in which capacity widens as the market moves further from an open.

Supplying

Suppliers deposit USDG and receive a position token representing their share of the pool. That position accrues interest continuously from borrower payments.

The position is an ordinary ERC-20

It can be held, transferred, or used elsewhere on the network while it continues to earn. A supplier who wants to exit before redeeming can sell the position directly rather than waiting on pool liquidity.

Redemption

Redeemable at any block, with no lockup, no vesting and no withdrawal queue under normal utilisation. If borrowing has consumed most of the pool, withdrawal is limited by available cash until borrowers repay or new supply arrives. This is the standard constraint of any lending market and is not specific to Acre.

Where the yield comes from

Suppliers earn the interest borrowers pay. There is no other source. Acre operates at a small protocol reserve factor, currently five percent, so the substantial majority of interest reaches the suppliers who funded it.

Because the borrowing rate rises when the underlying market is closed, supplier yield is highest across nights and weekends. That is the period when carrying leveraged exposure is genuinely riskiest, and pricing it accordingly is what pays the supply side.

Borrowing

Borrowers post tokenized equities or exchange traded funds as collateral and draw USDG against them. The position remains theirs throughout, so exposure to the underlying asset is retained while liquidity is released.

Three inputs set borrowing capacity

The trading calendar

Capacity follows the table above. It is at its widest during a regular session and tightest across a weekend, and returns to full capacity when the next session begins.

The earnings schedule

Individual equities move hardest around earnings announcements, and those dates are published well in advance. Capacity against a given name tightens automatically across a window surrounding its report, currently two days either side at a multiplier of seventy percent. The schedule is published, so borrowers can plan around it rather than discovering it during a liquidation.

Portfolio composition

A borrower holding several large capitalisation technology names holds one correlated exposure, not several independent ones. Acre groups collateral into correlation groups and measures concentration across them, so a genuinely diversified basket receives better terms than the same assets assessed individually.

The uplift is capped, currently at ten percent, and a portfolio wholly inside one group receives none of it. This is the same property Uniswap exploits with its correlated pools on the network, applied to credit rather than liquidity provision.

What is not time varying

The liquidation threshold does not follow the clock. Only new borrowing is restricted by time.

This is deliberate and it is the most important safety decision in the risk engine. If the threshold tightened at the Friday close, thousands of solvent positions would become liquidatable at the same instant, into the thinnest depth of the week. An existing position is judged against a static threshold; the clock only affects how much new debt can be drawn.

The market calendar

The calendar is an on-chain model of the United States equity trading calendar. Everything else in the protocol reads from it.

What it resolves

Regular sessions, extended hours, weekends, market holidays, half days and daylight saving. Eastern Time is UTC minus four or five hours depending on the date, and the transition rules have been in force since 2007: clocks advance on the second Sunday of March and retreat on the first Sunday of November. Getting this wrong shifts every session boundary by an hour for roughly eight months of the year.

Why it fails closed

Weekdays and daylight saving can be computed from a timestamp. Market holidays cannot, because they include Good Friday and occasional unscheduled closures. Holidays are therefore supplied by an operator up to a stated horizon.

Any query beyond that horizon returns Unknown, which is the zero value of the enum and which every consumer treats as the most restrictive state. An uninitialised or neglected calendar reports the tightest possible terms rather than an accidentally permissive one. Forgetting to extend the calendar degrades the protocol into conservatism; it never exposes it to an unmodelled closure.

The horizon can only move forward. Allowing an operator to move it backwards would retroactively invalidate calendar data that live positions were priced against.

Collateral valuation

Collateral is priced from Chainlink feeds covering the underlying equities. Every failure mode reverts: a stale answer beyond the configured heartbeat, a non positive price, an incomplete round, or an unconfigured asset. There is no fallback price and no last known good value, because a borrow or a liquidation priced from a stale feed is worse than one that does not execute.

Corporate actions

Tokenized stock on Robinhood Chain implements ERC-8056, the scaled amount extension. When a corporate action occurs, a multiplier scales the effective amount held while raw balances and total supply remain unchanged.

Chainlink's feed for these tokens already reports the token price as the underlying equity price multiplied by that value. Acre therefore does not apply the multiplier itself. Doing so would double count it, an error that is invisible while the multiplier sits at exactly one and becomes a large mispricing the moment a dividend or split moves it.

What Acre does instead is treat the multiplier as a consistency check. It is read on every valuation and bounded on both sides, so a token whose convention has changed halts pricing rather than being trusted silently.

Corporate action pauses

The tokenized equity standard describes a pause flag an issuer can set while a corporate action is processed. Acre can read it and halt every valuation of an affected asset while it is set.

None of the Robinhood tokens currently implement that function, so the check is disabled at present. Acre refuses to enable it for an asset that cannot answer it, rather than accepting the setting and reverting on every valuation afterwards. If the issuer adds it, the check can be turned on per asset without redeploying.

Staleness bounds remain the protection that is actually active. A feed that stops updating beyond its heartbeat halts valuation regardless of any pause flag.

Sequencer availability

Robinhood Chain is an optimistic rollup. A price read while its sequencer is down is a price read against a chain nobody can submit a transaction to: borrowers cannot post collateral and liquidators cannot act. Acre checks Chainlink's sequencer uptime feed before every valuation, and applies a grace period after an outage so that borrowers have time to react before liquidation resumes.

Liquidation

A position becomes liquidatable when its debt exceeds its liquidation limit, which is the sum of each collateral holding valued at that asset's liquidation threshold.

Why it is auctioned rather than instant

Close to all secondary liquidity for tokenized equities on the network sits on a single venue, and it is thinnest at exactly the hours liquidations are most likely to trigger. A design that seizes an entire position and dumps it produces a worse price for everyone, including the other borrowers still solvent at the time.

How it works

1. An auction is opened. Anyone may open one against an unhealthy account.
2. A grace period runs. Currently fifteen minutes, during which no collateral can be seized. This gives the borrower an opportunity to repay and gives liquidators time to arrange a hedge rather than selling spot immediately.
3. The discount ramps. From zero to its maximum over a configurable window, currently two hours. Liquidators compete on time rather than demanding a wide discount up front.
4. Seizure is partial. A close factor caps how much of the debt any single call may repay, currently fifty percent.
5. A per block cap applies. Set per asset, limiting how much collateral can reach the market in any one block.

The result is a lower liquidation discount than a conventional design requires. That discount is a cost borne by the borrower, so reducing it improves terms across the whole market.

Recovery

If a position becomes healthy again, the auction closes automatically when the borrower repays or deposits collateral. A ripened auction cannot survive a recovery and be used against the borrower later.

Bad debt

If collateral is exhausted and debt remains, the loss is recognised on the supply ledger and borne by suppliers in proportion to their shares. This is the honest treatment. The alternative is a phantom asset that overstates every supplier's redemption value until the pool runs dry and the last participant absorbs the whole loss.

Interest and rates

The borrowing rate has two components: a utilisation curve and a session multiplier.

Utilisation

A standard two slope curve. The rate rises gently up to an optimal utilisation point, currently eighty five percent, and steeply above it. That steepness is what makes withdrawal possible: it prices borrowing high enough to attract new supply and encourage repayment when the pool is nearly fully lent.

Session multiplier

The rate is multiplied according to the same market clock that governs capacity. Borrowing is cheapest during a regular session and most expensive across a weekend, currently double the open market rate.

This is not a fee. It is the correct price for carrying leveraged exposure through a window in which the protocol cannot liquidate into live depth.

Accrual

Interest is integrated across session boundaries rather than sampled once. Sampling would be a hole in the mechanism: a borrower could avoid touching their position from the Friday close to the Monday open and pay the weekday rate for the entire weekend. Instead the elapsed interval is split at each point where the rate multiplier changes, and each segment accrues at its own rate. A weekend produces five segments.

Every state changing action requires the interest ledger to be current first, so nobody can act against an understated debt figure.

Governance

Every parameter that matters sits behind a timelock. Governance actions are queued, publicly visible for the delay period, and only then executable.

This is what makes the protocol's parameters credible rather than merely promised. Anyone watching can see a change coming and exit before it takes effect.

The guardian's asymmetry is deliberate. A compromised guardian can stall the protocol but can never take anything from it.

What is never pausable

Repayment, collateral withdrawal and liquidation. A borrower must always be able to reduce risk, and the protocol must always be able to close a bad position, regardless of any pause or parameter state.

Launch caps

The protocol launches with hard caps on total supply, total borrowing, and per account exposure. Those caps define the maximum that can be lost to a contract bug.

Raising a cap is a governance action and passes through the timelock, visible before it lands. Lowering one is available to the operator immediately, because reducing exposure during an incident cannot wait. The operator can never loosen a cap and can never remove one.

Caps never restrict exit. Withdrawal, repayment and collateral withdrawal are unaffected by them under any configuration.

Risks

The protocol has not been audited

The test suite is extensive and the design fails conservative throughout, but no external party has reviewed this code. Launch caps exist because of this, and they should be read as a statement about how much confidence is warranted.

Weekend and overnight gaps

Collateral can reprice sharply while the protocol has no ability to liquidate. Conservative closed window terms reduce this exposure without eliminating it.

Liquidity concentration

Almost all secondary liquidity for these assets sits on one venue. Auctioned partial liquidation mitigates thin depth but does not remove the dependency.

Oracle

One Chainlink feed per asset, with no second source to cross check against. Staleness, non positive answers and incomplete rounds all revert, and the corporate action multiplier is bounded, but a feed reporting a wrong yet fresh and positive price would be believed.

Issuer credit

Tokenized stock on Robinhood Chain is a tokenized debt security. Holders carry the credit risk of the token issuer in addition to the price risk of the underlying asset, and hold no ownership, voting rights or legal claim against the company whose share price the token tracks.

Availability

Tokenized equities are not available to users in the United States, and Acre restricts access accordingly.

How assets get listed

Every collateral asset is listed against a published risk tier rather than parameterised by hand. Governance defines the tiers; listing an asset is then a single decision about which tier it belongs in, and that decision is recorded on chain for anyone who wants to argue with it.

The alternative, choosing four numbers per asset in private, works for three assets and stops working somewhere before thirty. It also makes every listing a fresh argument with no rule to appeal to.

Loan to value figures are the starting point before the market calendar adjusts them. Everything above tightens as the underlying market approaches its close.

Exposure caps

The last column is the one that matters most at scale. It is the largest dollar value of a single asset the protocol will hold as collateral, across every account combined.

Without it, every listing shares one global limit, and a single thin name could end up backing the entire borrow book. The protocol would inherit the liquidity of its worst asset, and a gap in that one name would be a gap in everything. Capping each asset separately means a bad listing is a bounded mistake rather than a systemic one.

Caps are per tier, so raising one lifts every asset listed under it at once, and lowering one tightens them all. That is deliberate: it keeps the rule and the exception in the same place.

Current listings

Six of the eight share one correlation group. That is deliberate and it is the most important line in the table: someone holding Apple, Microsoft, Alphabet, Amazon, Meta and NVIDIA has one exposure to large technology, not six separate ones, and Acre scores it that way when calculating capacity.

NVIDIA sits in the volatile tier rather than mega cap because it moves considerably more than the others, but it stays in the technology group because it moves with them. Tesla is technology adjacent and trades on things the rest do not, so it has its own group.

Correlation groups

Assets sharing a group are treated as one exposure when calculating borrowing capacity. Two mega-cap technology names in the same group is not diversification, and scoring it as though it were is how a portfolio that looks balanced turns out not to be.

Defined outcome pools

One party buys a floor under a name for a fixed window. Another party earns a premium for providing it. At expiry the floor either paid or it did not, and both sides are settled from a pot that was funded in full before any protection was sold.

Fully collateralised

Sellers post the most they could ever owe before a single unit is sold. There is no margin, no liquidation, and no way to be short more than was funded. This is what lets the contract promise a payout rather than merely intend one, and it is why capacity is finite: a series can only sell as much protection as its collateral covers if the asset went to zero.

How the premium is set

Not by a model. Option pricing on chain is neither practical nor honest, because the inputs it needs are not observable here. The premium is a governance-set base rate for the asset, scaled by how much of the available protection has already been sold, and scaled again by how much of the window falls while the underlying market is shut.

That third term is the point. The risk being sold sits almost entirely in the hours when nobody can trade out of a position, so that is what the price should follow.

What happens if settlement fails

A series expires and is settled against the oracle. If the oracle is unavailable for the whole three day settlement window, the series voids: buyers get their premium back and sellers get their collateral back. Nobody is paid from a price nobody can verify.

The alternative would be to settle later at whatever the oracle eventually reports, which would let the outcome drift arbitrarily far from the window that was actually sold. Refunding is the safe failure, and it is chosen deliberately.

Limitations worth knowing

Collateral is locked from the moment it is posted until the series settles. There is no early exit for a seller who changes their mind, and no secondary market for either side of a position.

The closed-market term in the premium counts weekend days rather than walking the calendar hour by hour. It is an approximation, chosen because the extra precision would cost more gas than it is worth against a premium that is already an estimate.

Contract addresses

Deployed to Robinhood Chain mainnet, chain ID 4663, on 29 August 2026.

Previous deployments

Acre's contracts are immutable. Nobody can replace the code holding your funds, including us, and that guarantee is the reason a new version means new addresses rather than an upgrade in place.

The trade-off is that positions do not move by themselves. Rather than announcing a deadline and asking people to withdraw, the app reads every past deployment and shows what an account still holds in each, with the controls to retrieve it. A position in an old deployment stays valid and withdrawable indefinitely. There is no expiry and nothing at risk.

Old contracts also remain live, which means they still accept deposits from anyone who has the address. Use the interface rather than interacting with an old address directly.

Governance status

Governance of the calendar, oracle, risk engine and pool is being transferred to the timelock. Until each transfer is accepted, the deploying address retains control. Every parameter change thereafter passes through a three day delay and is publicly visible in the timelock queue before it takes effect.

Glossary

Loan to value

The proportion of a collateral holding's value that may be borrowed against it. Acre's varies with the market clock and the earnings calendar.

Liquidation threshold

The debt to collateral ratio above which a position may be liquidated. Always higher than the loan to value, so a new borrow is never immediately liquidatable. Does not vary with time.

Close factor

The maximum proportion of a borrower's debt that a single liquidation call may repay.

Correlation group

A set of collateral assets treated as one exposure when measuring portfolio concentration.

Utilisation

Borrowed assets divided by supplied assets. Drives the base borrowing rate.

Reserve factor

The share of interest retained by the protocol rather than paid to suppliers.

Corporate action multiplier

The ERC-8056 scaling factor by which a tokenized stock expresses splits and dividends without changing raw balances.

Provisioned horizon

The last date for which the market calendar holds holiday data. Beyond it the calendar reports Unknown and the protocol applies its most conservative parameters.