RRivora
INDEPENDENT PROTOCOLBUILT FOR ROBINHOOD CHAIN

EVERYMARKET.ONEMARGIN.

Trade crypto, tokenized equities, ETFs, indices, commodities and FX through one unified onchain account. Professional order-book execution, self-custody, transparent risk and programmable liquidity in a single multi-asset protocol.

Launch terminal Read the protocol
SettlementUSDG
Markets11 perps · 4 tiers
MarginIsolated → cross → portfolio
NetworkRobinhood Chain Testnet · 46630
Riva, the Rivora trader, glancing back over her shoulder with a quiet smile
LONGSHORTHEALTH 2.41×
One margin. Every market.

Rivora is an independent proposed protocol. It is not operated, endorsed, sponsored, guaranteed or affiliated with Robinhood Markets, Inc. or its affiliates.

CONNECTING
  • ABTC-PERP—
  • AETH-PERP—
  • BSOL-PERP—
  • BARB-PERP—
  • BLINK-PERP—
  • CtSPY-PERP—
  • CtNVDA-PERP—
  • CtTSLA-PERP—
  • DXAU-PERP—
  • DEURUSD-PERP—
  • DNDX-PERP—
  • ABTC-PERP—
  • AETH-PERP—
  • BSOL-PERP—
  • BARB-PERP—
  • BLINK-PERP—
  • CtSPY-PERP—
  • CtNVDA-PERP—
  • CtTSLA-PERP—
  • DXAU-PERP—
  • DEURUSD-PERP—
  • DNDX-PERP—
03 · The problem

Markets moved onchain.
Access stayed fragmented.

Crypto traders use one platform for spot, another for perps and a third for yield. Equity investors sit in brokerage accounts with their own hours and settlement. Every platform keeps its own balance, margin, interface and liquidity.

3.1

Capital fragmentation

Stablecoins on one DEX, spot on another chain, stocks at a broker, hedges on a derivatives venue. Capital in one place cannot support a position anywhere else, so everyone over-collateralizes.

3.2

Market fragmentation

Crypto, equities, ETFs, FX and commodities live behind different venues and infrastructure. Even tokenized, their liquidity and UX stay isolated.

3.3

Inconsistent execution

Onchain trading asks you to choose: a simple but limited AMM, or a professional order book with unclear custody and settlement.

3.4

Opaque risk

Centralized venues hide leverage and liabilities. Many DEXs are transparent at the contract level yet unreadable for users. Health, thresholds, oracle state and reserves should be visible in the interface.

3.5

RWA-specific complexity

Market closures, corporate actions, regional eligibility, issuer restrictions, delayed reference prices, dividends and session gaps. Rivora treats these as core requirements, not afterthoughts.

UNIFY

Rivora unifies these markets: one non-custodial account, one risk engine, professional execution, and risk rules you can read.

05 · Positioning

Not another
perp DEX.

Robinhood Chain already has perpetual protocols. Rivora's defensible position is a chain-native cross-asset liquidity and portfolio-margin layer: the bridge between crypto-native liquidity and tokenized financial assets.

Hyperliquid showed onchain trading can feel professional. Aster showed demand for broad access. Rivora extends the model toward a unified market for crypto and tokenized finance on Robinhood Chain.
Unified access
Multiple asset classes through one interface and one account.
Self-custody
Assets stay under smart-contract control, never an opaque balance sheet.
Transparent risk
Margin, funding, liquidations, reserves and exposure can be inspected by anyone.
Programmability
Wallets, bots, vaults and agents build on the same liquidity and risk primitives.
Five product layers
  1. 01

    Perpetual markets

    Leveraged long and short exposure

    Highest
  2. 02

    Spot markets

    Direct asset exchange and collateral acquisition — Uniswap V2 pools on Robinhood Chain

    High
  3. 03

    Unified margin

    Shared collateral across approved markets

    Progressive
  4. 04

    Strategy vaults

    Transparent automated strategies

    Later
  5. 05

    Developer liquidity layer

    APIs and contracts for external applications

    Later
06 · Market architecture

Five risk tiers.
Different rules for each.

Every group gets its own collateral factors, leverage ceiling, position limits, oracle requirements and liquidation rules. Long-tail markets never share the core insurance pool.

20× max

Tier A — Core crypto

BTC, ETH

Deepest books, continuous reference pricing, cross-margin eligible after the isolated phase.

Initial margin
5%
Maintenance
2.5%
Risk multiplier
1×
Maker / taker
1bp rebate / 5 bp
Liq. penalty
0.75%
Funding cap
0.05%/h
10× max

Tier B — Growth crypto

SOL, ARB, LINK

Established alts with real spot liquidity. Lower leverage, tighter OI caps, extra oracle-deviation checks.

Initial margin
10%
Maintenance
5.0%
Risk multiplier
1.2×
Maker / taker
0bp / 7 bp
Liq. penalty
1.00%
Funding cap
0.10%/h
5× max

Tier C — Tokenized equities & ETFs

tSPY, tNVDA, tTSLA

Only when issuer terms, oracle data and regional access permit. Corporate-action and stale-price protection.

Initial margin
20%
Maintenance
10.0%
Risk multiplier
1.5×
Maker / taker
2bp / 10 bp
Liq. penalty
1.25%
Funding cap
0.10%/h
5× max

Tier D — Indices, commodities, FX

XAU, EURUSD, NDX

Cash-settled synthetic exposure, multiple reference sources, session-aware funding and isolated insurance.

Initial margin
20%
Maintenance
10.0%
Risk multiplier
1.5×
Maker / taker
2bp / 12 bp
Liq. penalty
1.25%
Funding cap
0.10%/h
2× max

Tier E — Permissionless

Anything with a bond

Isolated collateral and liquidity, strict caps, creator bond. Never touches the main cross-margin pool.

Initial margin
50%
Maintenance
25.0%
Risk multiplier
2×
Maker / taker
5bp / 15 bp
Liq. penalty
1.50%
Funding cap
0.20%/h

Illustrative launch parameters. Final values require quantitative risk testing and governance approval.

07 · End-to-end user flow

Feels like a pro exchange.
Settles like a chain.

01STEP

Connect wallet

Any Robinhood Chain wallet. Nothing leaves your keys.

02STEP

Smart account

Optional ERC-4337 account: gas sponsorship, batching, session keys with expiry, notional caps and no withdrawal rights.

03STEP

Deposit USDG

One approved settlement asset at launch. The interface shows available margin, equity, liquidation distance and max order size.

04STEP

Pick a market

Spot or perpetual, tiered by risk. Session-aware markets show their state before you size up.

05STEP

Margin mode

Isolated first. Cross and portfolio margin arrive as separate, proven upgrades.

06STEP

Set the order

Market, limit, stop, take-profit. Reduce-only, post-only, GTC or IOC.

07
GATE

Pre-trade risk check

The risk engine simulates the order. Rejected? Reduce size or add collateral, then retry.

08STEP

Sign

A typed EIP-712 order: account, market, side, price, size, time-in-force, nonce, expiry.

09STEP

Match & settle

Relayers find execution; contracts verify signature, nonce, balances and limits before updating your account onchain.

10STEP

Manage

Monitor PnL, funding and health. Modify, close, realize PnL, reuse collateral or withdraw.

Then reuse the collateral anywhere in the account.

08 · Protocol architecture

Hybrid signed orders.
Custody stays onchain.

Matching runs on high-performance relayers; custody, margin, positions, settlement, liquidations and withdrawals are enforced by contracts. More feasible for a first EVM deployment than promising a fully onchain high-frequency order book before the infrastructure exists.

System map
Web · mobile · API · agentsWallet / smart accountSigned-order gatewayMatcher + permissionless relayersOnchain settlement contractsMargin & position engineCollateral vaultFunding & fee engineLiquidation & insuranceOracle adapters & data streamsIndexers & analytics
A relayer can never
  • change an order's price or size
  • settle an expired or cancelled order
  • bypass a reduce-only condition
  • withdraw collateral
  • create a position that fails the onchain risk check
Contracts are the source of truth for
  • collateral ownership
  • active positions
  • average entry price
  • realized & unrealized PnL
  • funding payments
  • trading fees
  • margin requirements
  • liquidation state
  • withdrawable balance

If an indexer fails, users can still verify state and withdraw through the contracts or a minimal recovery interface.

10 · Margin model

Read the equations.
Then move the sliders.

Rivora starts with isolated margin. Cross-margin and portfolio margin ship as separate upgrades, only after risk performance is proven. The formulas below run in the terminal and in the relayer.

$10,000
5×
0.0%
Position notional
$50,000
0.4577 BTC @ 109,250.0
Required collateral
$10,000
max(notional ÷ leverage, notional × 5% IM)
Account equity
$10,000
$10,000 collateral + $0.00 uPnL
Maintenance margin
$1,250.00
notional × 2.5% × 1 risk multiplier
Liquidation price
89,641.0
-17.9% from entry
Account health
8.00×
01.0× liq3×+

Healthy. Equity ÷ maintenance margin.

Equity = Adjusted collateral + Σ uPnL − fees − accrued funding

Initial margin = Σ (notional × IM rate)

Maintenance = Σ (notional × MM rate × risk multiplier)

Health = Equity ÷ Maintenance margin

Collateral haircuts
Collateral typeConceptual treatmentMain risks
Approved stablecoinLowest haircutDepeg and issuer risk
ETH or BTC representationModerate haircutVolatility and bridge risk
Tokenized ETFAsset-specific haircutSession gaps and issuer restrictions
Tokenized single stockHigher haircutConcentration and corporate actions
Long-tail tokenIsolated or ineligibleLiquidity and manipulation

One dollar of volatile collateral never buys one dollar of borrowing power. Correlation benefits in portfolio margin are capped because correlations break under stress.

11 · Liquidation flow

Orderly deleveraging.
Never a cliff.

Rivora prioritizes partial liquidation and orderly deleveraging over immediate full account closure. The risk engine recalculates health continuously; every step down the ladder is visible in the terminal before it happens.

  1. 1

    Active

    Health above warning threshold

    Account trades normally.

  2. 2

    Warning

    Health below 1.25×

    Interface warns; risk-increasing orders restricted.

  3. 3

    Maintenance breach

    Equity below maintenance margin

    Cancel open risk-increasing orders.

  4. 4

    Partial liquidation

    Attempt to restore health

    Reduce a slice of the position at mark price. Restored? Back to active.

  5. 5

    Auction / backstop

    Partial reduction insufficient

    Liquidation auction or backstop vault takes the remainder.

  6. 6

    Insurance

    Residual loss

    Market-specific insurance reserve absorbs the deficit.

  7. 7

    Last resort

    Reserve insufficient

    Documented auto-deleveraging rules apply — never silently.

PROTECTIONS
  • Mark price, never a single last trade
  • Minimum oracle confidence before any liquidation
  • Partial position reduction first
  • Liquidation auctions where practical
  • Market-specific insurance accounting
  • Capped liquidator incentives
  • Open-interest and concentration limits
  • Emergency pause bounded by governance rules
  • Auto-deleveraging only as a documented last resort
12 · Oracle & price integrity

A market is only as safe
as its price data.

Primary feed, secondary reference and venue data flow through an adapter that checks freshness and deviation. Pass: compute index and mark. Fail: protective state — reduce leverage, block new risk, or pause settlement. The protocol never silently continues liquidations on stale or contradictory data.

Rivora Risk · live oracle board

Loading oracle telemetry…

Required controls
  1. 01Maximum price age
  2. 02Maximum deviation between sources
  3. 03Confidence-interval checks
  4. 04Circuit breakers
  5. 05Last-good-price handling
  6. 06Market-specific fallback policy
  7. 07Manipulation-resistant mark price
  8. 08Delayed liquidation during invalid data
  9. 09Public oracle-status dashboard
13 · RWA market handling

Stocks have hours.
The risk engine knows.

Tokenized assets need a dedicated state machine. The existence of a token on Robinhood Chain does not make it eligible: Rivora reviews token contracts, transfer restrictions, issuer terms, oracle licensing, jurisdiction and user eligibility before enabling any market.

Open

Underlying market open. Normal trading parameters, continuous pricing and funding.

state · open

After-hours

Scheduled close. Lower leverage, higher margins, smaller max order, wider protection bands, tighter OI caps.

state · after_hours

Protective

Halt or stale feed. Block new risk or pause the market; resume only after feed and risk validation.

state · protective

Corporate action

Adjustment review and public notice. Contract specification adjusted deterministically with an onchain record.

state · corporate_action

Corporate-action policy
  • Stock splits and reverse splits
  • Cash and stock dividends
  • Mergers and acquisitions
  • Spin-offs
  • Delistings
  • Ticker changes
  • Prolonged trading halts

Every adjustment gets a public notice period when possible, deterministic calculation rules, and an auditable onchain record.

Funding, session-aware

Funding keeps a perpetual near its index and is exchanged between longs and shorts — it is not protocol yield. It considers the premium, the index, time-weighted observations, bounded rates, market-specific intervals, open-interest imbalance and protective rules during oracle disruption. For RWA-linked markets the parameters differ between the underlying's open and closed sessions.

14 · 17 · Liquidity & vaults

Market makers, community vaults,
no endless emissions.

Professional market makers and community vaults feed the order book; cross-chain deposits feed collateral. Trading fees flow back to market-maker incentives, the insurance reserve, security and operations, and the treasury. Raw volume is a poor incentive metric — it invites wash trading.

Fee flow
Professional market makersCommunity liquidity vaultsCross-chain depositsOrder-book liquidityCollateral liquidityUser tradeexecutionTrading feesMM incentivesInsurance reserveSecurity & opsTreasury
Incentives reward
  • Time at best bid and offer
  • Competitive spread
  • Depth close to mark
  • Uptime
  • Balanced liquidity
  • Real counterparty volume
Every vault discloses
  • Strategy logic
  • Manager permissions
  • Withdrawal rules
  • Current positions
  • Historical drawdown
  • Fees
  • Oracle dependencies
  • Maximum risk limits

Vault deposits are at risk. Never marketed as guaranteed yield.

01

Market-making vault

Quotes both sides of approved markets.

02

Basis vault

Captures spot–perpetual basis.

03

Delta-neutral vault

Offsets direction while pursuing fees or funding.

04

Index vault

Tracks a defined crypto or RWA basket.

05

Liquidation vault

Capital for discounted liquidations under strict limits.

Vault lifecycle: proposal → code, permissions and risk review → guarded deployment with deposit cap → public monitoring → limits scale only if performance and risk stay acceptable; otherwise freeze deposits and unwind.

16 · Fee model

Simple for retail.
Flexible for makers.

Illustrative launch ranges — product assumptions, not commitments. Final fees depend on liquidity, market-maker agreements, infrastructure cost, risk and regional requirements.

Illustrative launch ranges
ActivityRange
Core crypto maker feerebate → 2 bp
Core crypto taker fee4 – 7 bp
RWA-linked taker fee6 – 12 bp
Liquidation penalty0.5% – 1.5%
Vault performance fee10% – 20% of positive performance
Sources
  • · Maker and taker trading fees
  • · Liquidation penalties
  • · Strategy-vault management or performance fees
  • · Premium API services
  • · Market-creation bonds or fees
  • · Cross-chain convenience fees where applicable
Revenue supports
  • · Insurance reserves
  • · Security audits and bug bounties
  • · Liquidity programs
  • · Oracle and infrastructure costs
  • · Development and operations
  • · Ecosystem grants

No fixed revenue or guaranteed returns are promised to any token holder without appropriate legal analysis.

18 · Token design

Optional for the MVP.
Useful if it exists.

Rivora should prove product demand before a token becomes central. If introduced, it carries operational utility — never equity, ownership in Robinhood, guaranteed revenue or a guaranteed appreciation mechanism.

Illustrative allocation — a starting framework, not final tokenomics
AllocationShare
Community & trading incentives35%
Ecosystem treasury & grants20%
Core contributors18%
Liquidity & market-maker programs15%
Strategic partners & backers8%
Security & insurance reserve4%
Utility
  • · Governance over markets and risk parameters
  • · Staking-based fee benefits
  • · Liquidity and market-maker coordination
  • · Ecosystem incentives
  • · Market-creation bonds
  • · Delegation to risk councils
Anti-farming: incentives weigh
  • Fees paid
  • Liquidity quality
  • Time-weighted participation
  • Counterparty diversity
  • Open-interest contribution
  • Vault risk
  • Suspected self-trading patterns

Volume is never rewarded without measuring whether it provides real market utility.

22 · 23 · MVP & roadmap

Narrow first release.
Credible path to every market.

The MVP's objective is to validate execution quality, risk controls, market-maker demand and user retention — not to list every market as quickly as possible.

IN THE MVP
  • ✓ Robinhood Chain wallet connection
  • ✓ USDG collateral
  • ✓ BTC, ETH + a few liquid perps
  • ✓ Isolated margin only
  • ✓ Market, limit, stop-loss, take-profit
  • ✓ Transparent funding, fees, liquidation price
  • ✓ Partial liquidation
  • ✓ Guarded OI and deposit caps
  • ✓ Public analytics dashboard
  • ✓ Market-maker API
  • ✓ Independent audit
  • ✓ Bug bounty
NOT IN THE MVP
  • ✕ Permissionless market creation
  • ✕ Volatile assets as collateral
  • ✕ Uncapped leverage
  • ✕ Full portfolio margin
  • ✕ Community-created vaults
  • ✕ Stock tokens without issuer and legal review
  • ✕ Volume-only token emissions
  • ✕ Unrestricted cross-chain collateral
P0in progress

Research & specification

  • · Legal and product structure
  • · Asset and oracle permissions
  • · Public protocol spec
  • · Risk simulator
  • · Initial market makers
  • · Guarded upgrade system
  • · Threat modeling
P1next

Private testnet

  • · Core contracts
  • · Wallet and smart accounts
  • · Signed-order matching
  • · Funding and liquidation sims
  • · Adversarial oracle tests
  • · Capped test positions
P2next

Public testnet

  • · Trading competitions (valueless assets)
  • · Bug bounty
  • · Open API
  • · Stress and latency monitoring
  • · Keeper onboarding
  • · Audit remediation
P3later

Guarded mainnet

  • · Stablecoin collateral
  • · Limited core crypto markets
  • · Isolated margin
  • · Conservative leverage
  • · Deposit and OI caps
  • · Monitored insurance reserve
P4later

Unified liquidity

  • · Spot trading
  • · Approved crypto collateral
  • · Cross-margin subaccounts
  • · Community vaults
  • · Advanced order types
  • · Referrals and fee tiers
P5later

Onchain global markets

  • · Eligible tokenized equities and ETFs
  • · Session-aware RWA risk engine
  • · Sector and thematic indices
  • · Commodity and FX markets
  • · Corporate-action engine
  • · Region-aware access
P6later

Open market layer

  • · Strategy-vault framework
  • · Permissionless isolated markets
  • · Decentralized relayer network
  • · Developer SDKs
  • · Trading-agent permissions
  • · Progressive decentralization
19 · 24 · Governance & metrics

Volume is not the score.
Health is.

Governance decentralizes progressively: early multisig powers, signers, timelocks and upgrade paths are public; emergency actions expire unless confirmed. Success is measured on liquidity quality and account health, never raw volume alone.

Liquidity quality

  • · Median bid-ask spread
  • · Depth within price bands
  • · Market-maker uptime
  • · Slippage by order size
  • · Oracle-to-execution deviation
  • · Order-fill rate

User health

  • · Weekly active traders
  • · Retained funded accounts
  • · Average deposit duration
  • · Repeat trading behaviour
  • · Liquidation rate by market
  • · Share of users using risk controls

Protocol health

  • · Open interest vs insurance reserves
  • · Revenue excluding incentives
  • · Bad debt
  • · Insurance-fund drawdowns
  • · Relayer concentration
  • · Oracle incidents · uptime · governance participation

RWA health

  • · Session-gap losses
  • · Stale-price events
  • · Corporate-action accuracy
  • · Market availability
  • · Regional eligibility incidents

Governance scope

  • Market listing and delisting
  • Collateral eligibility
  • Position and OI limits
  • Margin and liquidation parameters
  • Fee ranges
  • Treasury budgets
  • Liquidity programs
  • Upgrade authorization
  • Risk-council selection

Proposal → technical and economic review → public discussion → routine vote or risk-council recommendation → timelock → onchain execution → post-execution monitoring. Emergency actors may pause new risk, disable a compromised oracle or cap a market — never withdraw user assets.

26 · Brand system

Liquid, modern,
asset-neutral.

The name reads as a trading terminal today and a market network later, and deliberately avoids putting “Robin” or “Hood” in the brand so nobody mistakes it for an official product. Name, domains, handles, ticker and trademarks still need a professional availability review before launch.

Riva · protocol guide
Character sheet for Riva: full-body standing view on the left, close-up portrait on the right, in white cap, headset and blue-panelled techwear jacket

One locked reference sheet drives every pose, expression and banner on this site, so the guide is the same person wherever she appears. She reacts to real numbers rather than decorating them — the face beside the margin lab reads the health figure the reader is moving.

neutral · happy · surprised · focused
Tagline hierarchy
Primary
Every Market. One Margin.
Secondary
The Universal Markets Layer.
Launch
Professional onchain trading, built for Robinhood Chain.
RWA expansion
Crypto and global markets in one portfolio.
Idle loop
Palette
  • Ink#0A1024
  • Paper#F4F6FB
  • Electric blue#1F5BFF
  • Sky#8EC5FF

Dark mode re-steps these against the dark surface rather than inverting them, so blue stays the accent in both themes.

Riva, the Rivora trader, glancing back over her shoulder with a quiet smile
LONGSHORTHEALTH 2.41×
Terminal's warm. Wallet's yours.
RIVORA TRADE

Enter the
terminal.

Same chrome, same risk engine, live data. Connect a wallet, sign a typed order, watch the account health meter move. Testnet collateral is credited automatically.

Equity25,000.00 USDG
Health∞
Free collateral25,000.00
ModeIsolated
  • — — ———
  • — — ———
  • — — ———
  • — — ———
  • — — ———
Open Rivora Trade Spot swap · Uniswap V2
Rivora — Every Market. One Margin.