NLYRA: the risk layer for Robinhood Chain
Risk layer for Robinhood Chain: a live sell test and Risk Level for every token, a can't-sell gate in our Desk and non-custodial bots that stop buying traps. Own node, open contracts.
42% of new tokens stop trading within 24 hours (measured on our own node, 9,559 tokens, Aug 10 – Sep 22). On a chain like that, the most useful thing a trading platform can do is tell you, before you buy, whether you will be able to sell. That is what NLYRA is built around.
- The risk layer (hosted): a live sell test for every token, simulated against the real pool on our own node, and a Risk Level computed from launch facts. It blocks can't-sell buys on The Desk, blocks bot creation on can't-sell tokens, and brakes bots that would keep buying a trap. Anyone can query it at
nlyra.xyz/api/risk. See Risk layer.
- The Desk, a trading terminal on Robinhood Chain (Arbitrum Orbit, chainId 4663) running on our own full node and indexer, with the NERON forensic scanner tagging every new token within seconds.
- Non-custodial trading bots (spot and infinity grids, DCA, TWAP, martingale, ladder, copy trading, launch sniper), an OTC desk for block trades, a launchpad that locks liquidity forever, a verbatim Uniswap V2/V3 DEX, Lyra Shield private transfers (Privacy Pools) and NLYRA staking. Every bot and escrow is a smart contract where only the user can withdraw. Keepers can execute a strategy but can never move funds anywhere else.
- Beyond Robinhood Chain (October 2026): the Infinity Grid and Spot Grid bots run on BNB Chain too, on PancakeSwap (
bsc/), and $NLYRA circulates on Arbitrum One and BNB Chain through our LayerZero V2 bridge (bridge/; Arbitrum since 19 October, BNB Chain since 27 October 2026). Every contract is verified on BscScan, Arbiscan or Blockscout, and listed in CONTRACTS.md.
The Desk, the risk layer, the NERON scanner and the bot keepers are operated by us as hosted services (closed source). Everything that holds user funds, the smart contracts, is open, tested and verified on Blockscout and/or Sourcify.
Live
Measured on 2026-09-28 from the public APIs, which need no account:
Risk layer (hosted service, closed source)
What it does:
- Sell test. For every token we simulate a buy and a sell against the live pool with a single
eth_call plus a state override, on our own node, at the current block. It runs on ETH/WETH and USDG pools and reports whether the token can be sold, the round trip, and the effective buy and sell tax. Nothing is sent on-chain.
- CAN'T SELL gate. When the sell test fails, The Desk refuses the buy and the bot form refuses to create a bot on that token.
- Bot buy-brake. While a bot runs, our hosted services keep re-checking the token, and the keeper stops placing the bot's buys if it turns into a trap. The brake never sells and never touches the escrow: the owner can still stop and withdraw at any time.
- Risk Level v1. A score from five facts about the token's launch. Out of sample, on the newest 1,912 tokens, it ranks tokens that stop trading within 24 hours with an AUC of 0.801, versus 0.708 for our scanner's previous score.
- Public API, no account needed:
https://nlyra.xyz/api/risk?token=0x…
curl -s "https://nlyra.xyz/api/risk?token=0x2f853bfabc74db75c59c5ca76a6b2afa1ea0a5b8"
Real response from 2026-09-29 00:56 UTC, trimmed (a fresh token on a Uniswap V4 pool whose hook takes 99.5% of every sell):
{
"ok": true,
"token": "0x2f853bfabc74db75c59c5ca76a6b2afa1ea0a5b8",
"symbol": "ORDESK",
"v": "risk-v1",
"cantSell": true,
"tier": "CantSell",
"sell": {
"tested": true,
"canBuy": true,
"canSell": false,
"roundTripPct": 0.5,
"buyTaxPct": 0,
"sellTaxPct": 99.5,
"notes": ["dynamic-fee pool: hook fee is counted inside sell tax", "round trip below 50%", "high tax", "sell gas above 2M"],
"amount": "0.01",
"unit": "ETH",
"kind": "v4",
"quote": "0x0bd7d308f8e1639fab988df18a8011f41eacad73"
},
"live": { "critical": true, "reasons": ["our sell test got back 0.5%"] },
"updatedAt": "2026-09-29T00:56:49.342Z"
}
What is and is not on-chain. The gate and the brake are enforced off-chain by our hosted services (The Desk front end and API, and the bot keeper). The contracts guarantee custody, not risk: they do not know about the sell test, and a user who calls a contract directly is not gated. The Risk Level model's weights and rules are not published.
USDG (Paxos Global Dollar)
USDG (0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168) is a first-class quote asset across the platform:
Built during the Buildathon (Sep 13 – Oct 4)
| Date (UTC) | What | Deploy tx / evidence |
|---|
| Sep 13, 04:39 | Shadow copy trading 0xE26dd0A0…B3D2 | 0xc57ee3e1…b890a |
| Sep 19, 12:06 | OTC Desk 0x9656513a…52e8 | 0x4300673b…2e5ce |
| Sep 20, 12:24 | Sniper v2 0x6B30B094…C84c (after the security review of v1) | 0xfd533496…76f44 |
| Sep 20, 15:38 | SendTo v2 0x0eF655f1…Ddc0 | 0x14160bd0…7ec59 |
| Sep 26 – 27 | Risk layer: sell test, CAN'T SELL gate, bot buy-brake, Risk Level v1, /api/risk | hosted service (example) |
| Sep 27 – 28 | Real Yield Staking v2: contracts, 211 fork tests, two internal audit rounds | staking-v2/ (deployed Sep 29, closed beta) |
| Sep 28 | Staking v2 position transfers and the Position Market | staking-v2/src/PositionMarket.sol, |
Spot Grid v4 (Sep 11, 0x021aee16…3308d) and Infinity Grid v4 (Sep 12, 0xaa42408c…4c9cb) predate the Buildathon window.
Architecture
flowchart LR
U([User wallet]) -->|signs every trade| DESK[The Desk<br/>hosted UI]
U -->|direct calls| C
DESK -->|reads| IDX[(Own full node<br/>+ indexer)]
NERON[NERON scanner<br/>hosted] --> IDX
RISK[Risk layer<br/>hosted: sell test, Risk Level] -->|eth_call + state override| IDX
RISK -.->|CAN'T SELL gate| DESK
RISK -.->|buy-brake| K
K[Bot keepers<br/>hosted] -->|fill / stop-loss / take-profit only| BOTS
subgraph C[Smart contracts on Robinhood Chain · open source · verified]
FR[Fee Router<br/>1% per trade]
BOTS[Bot escrows<br/>grids · DCA · TWAP · shadow · sniper]
OTC[OTC escrow]
LO[Limit orders<br/>Permit2, no escrow]
LP[Launchpad<br/>LP locked forever]
SH[Lyra Shield<br/>Privacy Pools]
ST[NLYRA staking]
DEX[Uniswap V2 / V3<br/>verbatim]
end
BOTS --> FR
LO --> FR
FR --> DEX
LP --> DEX
OTC -->|fee| BURN[Buyback Burner<br/>buys and burns NLYRA]
LP -->|fees| BURN
- Custody never leaves the chain. A bot is a position inside the user's own escrow record, and only its owner can call
stop / withdraw. The keeper key can trigger only the execution paths the bot already authorised.
- Nothing is upgradeable except the Shield Entrypoint proxy, which uses the Privacy Pools design. Pausing blocks new entries, never a withdrawal.
- The full list of admin powers, contract by contract, is public at nlyra.xyz/docs#admin-powers.
Repository map
| Folder | What it is | Status |
|---|
CONTRACTS.md | Every deployed contract: address, purpose, whether it holds user funds, source, Blockscout link, status | — |
deployed/ | The exact verified source of every deployed address, with compiler settings and ABI | — |
bots/ | Bot contracts (Spot Grid v4, Infinity Grid v4, Shadow, Sniper, SendTo, Fee Router, Registry), mainnet-fork tests, reproducible verification | Live |
otc/ | OTC Desk: peer-to-peer block trades in a non-custodial escrow, with fork tests, scripts and the web page | Live |
launchpad/ | Architect Launch: tokens born with a pool, LP locked forever, buyback-and-burn treasury | Live |
dex/ | Uniswap V2 and V3 deployed verbatim, plus the single-file swap/liquidity frontend | Live |
shield/ | Lyra Shield: private NLYRA transfers on 0xbow Privacy Pools (zk proofs built in the browser) | Live |
staking-v2/ | Real Yield Staking v2 (Foundry): 50% of NLYRA creator fees streamed to stakers. 211 mainnet-fork tests, two internal audit reports, external audit by Coinsult. Deployed at |
Security
- Non-custodial by construction. Escrowed funds can only go back to the owner, or to the counterparty in the same transaction on OTC fills. No owner function reaches user balances.
rescue paths are capped at the surplus above escrow.
- Verified sources. Every contract that holds or moves user funds is verified on Blockscout, Sourcify or both.
deployed/ holds the verified source for each address, so a reviewer can diff it against the working copies in this repo.
- Tests on a mainnet fork. The bot, SendTo, Sniper and OTC suites run against an anvil fork of Robinhood Chain, using the real fee router and real pools (126 checks for the Sniper, 17 for SendTo). Staking v2 has 211 Foundry tests on a pinned fork, including stateful invariants and a differential model.
- Audits. Staking v2 went through two internal review rounds before any deployment; the findings and fixes are in
AUDIT.md, AUDIT-2.md and CHANGES.md. The deployed contracts were then audited externally by Coinsult (Sept 30, 2026): 0 critical, 0 medium, every finding resolved or acknowledged (reports). The Sniper was redeployed as v2 after a security review, and v1 was paused before it ever held a bot.
- Known trust assumptions, stated plainly. Contract ownership sits on single keys, not a multisig. The keeper is a hosted service, so if it stops, bots stop trading, but every withdrawal still works directly on-chain.
- Closed-source services. The Desk, the risk layer, the NERON scanner and the bot keepers are hosted services and are not in this repository. None of them can move user funds. The CAN'T SELL gate and the bot buy-brake are enforced by these services, off-chain.
Build and test
Staking v2 (Foundry):
cd staking-v2
FOUNDRY_PROFILE=dev forge build # fast build without viaIR
RH_RPC=https://rpc.mainnet.chain.robinhood.com FORK_BLOCK=$(cast block-number --rpc-url $RH_RPC) FOUNDRY_PROFILE=dev forge test
forge test # default profile (viaIR), the one used for final numbers
The fork tests read the RPC from RH_RPC (robin = "${RH_RPC}" in foundry.toml) and the block from FORK_BLOCK. Without FORK_BLOCK they fork the pinned block 74,478,703, which requires an archive RPC; the public RPC only serves recent state, hence FORK_BLOCK=$(cast block-number …). lib/ (forge-std and OpenZeppelin) is vendored, so no forge install is needed. Run one forge process at a time.
Bots and OTC (Node + anvil fork): the compile scripts, contracts and tests were run from one flat working directory, so put them side by side first. From bots/:
mkdir run && cp contracts/ArchitectSpotGridV4.sol contracts/ArchitectBotBase.sol scripts/compile-v4.js test/forktest-v4.js run/
cd run && npm i ethers [email protected]
node compile-v4.js # writes artifacts/ArchitectSpotGridV4.{abi.json,bin}
anvil --fork-url https://rpc.mainnet.chain.robinhood.com --port 8901 --chain-id 4663 &
DESK_ADDRESSES=../../deployments/desk-addresses.json node forktest-v4.js
Each suite names its anvil port at the top (8901-8906); the same recipe works for the other suites with their contract and compile script (bots/README.md, otc/README.md). Addresses are read from deployments/desk-addresses.json (override with DESK_ADDRESSES). Deploy scripts read the RPC from RH_RPC (default: the public RPC) and the deployer key from the environment, never from the repo.
Reproducing a verification: each bots/artifacts/<Contract>/<Contract>.input.json and otc/artifacts/ArchitectOTC.input.json is the exact standard-JSON input behind the deployed bytecode; submit it to Sourcify, or to Blockscout as "Solidity (Standard JSON input)". Every deployed/*/compiler.json records the compiler and settings Blockscout matched.
Quick facts
- $NLYRA token:
0xb9d3824149ad8ac984153ceec91d5a2405d1fb95
- RPC:
https://rpc.mainnet.chain.robinhood.com (chainId 4663)
- Explorer: robinhoodchain.blockscout.com
License
Our contracts, scripts and frontends are released under the MIT License; every NLYRA contract carries SPDX-License-Identifier: MIT. Third-party code (Uniswap V2/V3, 0xbow Privacy Pools, poseidon-solidity, OpenZeppelin, forge-std, the Synthetix-style StakingRewards) keeps its original license: see THIRD_PARTY_NOTICES.md.
