Sentinel

🎯

One status word per token

statusOf(token) returns the union of per-token and chain-wide flags — TOKEN_PAUSED, ORACLE_PAUSED, FEED_STALE, IMPLEMENTATION_UPGRADED and more. Zero means fully operational.

💀

Fail closed, by construction

Consumers bound the watcher heartbeat age on-chain. A dead or silenced watcher makes integrations revert — no heartbeat, no trust.

🔭

Watches the issuer's admin surface

On Robinhood Chain one contract is both the upgrade beacon and the compliance registry (0xe10b…1b00). One upgradeTo() changes every stock token at once — Sentinel watches it, the blocklist, roles, pauses, and adminBurn.

📅

Knows when markets sleep

Stock-token feeds update 24/5 by design. Sentinel's session calendar raises MARKET_CLOSED on weekends and US market holidays so staleness thresholds stretch instead of bricking your market.

🧑‍⚖️

Level and latching flags

Live conditions (pauses, staleness, session) clear themselves. Discrete events that need review — upgrades, blocklist activity, adminBurn — latch until a human clears them via the operator CLI.

🧩

One-line Solidity integration

Vendor two byte-stable files and call SentinelGuard.check(token, tolerated, maxAge) at the top of any price-sensitive entrypoint. Declare what you tolerate; revert on the rest.

Why now

The failure mode is no longer hypothetical. In July 2026 — days after Robinhood Chain's mainnet launch — Edel Finance's tokenized-stock market was drained against stale pricing (tokenized GOOG mispriced by roughly 7,700%), leaving ~$403k of bad debt. No safeguard was in place. Robinhood's own docs state the per-token oracle-pause flag is advisory: feeds "are expected to stop publishing" during corporate actions, and integrators must keep their own staleness checks.

Sentinel already runs against mainnet. The watcher's first live cycle surfaced a real calibration issue — low-volatility feeds like SPY and SGOV legitimately go many hours without updating (Chainlink push feeds update on deviation or a 24h heartbeat) — so the session staleness threshold shipped at 26h with per-feed overrides. That finding came from observing the live chain, not a simulation.

Built for a risk profile that exists nowhere else. The same party issues the assets, runs the only sequencer, and operates the price-feed pipeline. Protocols integrating stock tokens can't price that with a TVL cap or an LLTV alone — they need a live signal.

⚠️ Unaudited, day-one software. v1 is a trusted-operator design: one owner, allowlisted updater keys, no bonding. Read the trust model before protecting real value with it.

SentinelThe risk oracle for Robinhood Chain stock tokens