Overview

Sentinel is an issuer-action risk oracle for Robinhood Chain stock tokens: an on-chain status registry (SentinelRegistry) plus an off-chain watcher that converts Robinhood's issuer powers into a machine-readable signal. Lending markets, AMM hooks, and vaults integrating stock tokens check one word — and atomically freeze — when the issuer pauses a token, pauses its oracle for a corporate action, touches the blocklist, upgrades every token at once through the shared beacon, or when feeds go stale, the market session closes, or the sequencer lags.

Unaudited

Sentinel is day-one software built against a chain that is itself days old. Do not protect real value with it before an audit and a long dry-run soak.

The problem

Robinhood Chain has a risk profile that exists nowhere else in DeFi: the same party issues the assets, runs the only sequencer, and operates the price-feed pipeline.

Concretely, on mainnet today:

• Every stock token is a BeaconProxy pointing at one shared Stock implementation — and the beacon is the compliance registry (0xe10b6f6B275de231345c20D14Ab812db62151b00). A single upgradeTo() or registry-level pause() changes the behavior of every stock token simultaneously.
• The Stock contract exposes adminBurn (issuer seizure that bypasses the pause), and corporate-action multiplier updates can be scheduled ahead of time (newUIMultiplier() / effectiveAt()).
• Official docs state the per-token oraclePaused() flag is advisory — feeds are expected to stop publishing during corporate actions, but nothing enforces it on-chain.
• Stock-token Chainlink feeds update 24/5, following market hours — weekend staleness is by design, so a naive staleness check either bricks every weekend or is useless in session.

DeFi protocols price none of this by default. The July 2026 Edel Finance incident — a tokenized-stock market drained against stale/ghost pricing for ~$403k of bad debt — is the canonical failure mode.

What Sentinel does

Sentinel makes these conditions parameterizable. A protocol declares which conditions it tolerates (say, MARKET_CLOSED because its LLTV already prices weekend gaps) and fails closed on everything else — including on Sentinel's own death, because consumers bound the watcher heartbeat age on-chain.

Threat model

Which Robinhood admin action raises which flag:

Issuer / infrastructure action	On-chain signal	Sentinel flag
Pause one token's transfers	Paused() event, paused() view	TOKEN_PAUSED
Pause a token's price oracle (corporate action)	OraclePaused(), oraclePaused()	ORACLE_PAUSED
Schedule a corporate-action multiplier	newUIMultiplier() + future effectiveAt()	MULTIPLIER_PENDING
Seize balances via adminBurn	burn Transfer + adminBurn calldata	ADMIN_ACTION (latching)
Pause the whole registry (all tokens)	Paused() on AccessControlsRegistry	REGISTRY_PAUSED
Upgrade every token via the shared beacon	Upgraded event or implementation() drift	IMPLEMENTATION_UPGRADED (latching)
Add/remove blocklist entries	Blocked / Unblocked events	BLOCKLIST_EVENT (latching)
Rotate admin roles	RoleGranted / RoleRevoked	ROLE_CHANGED (latching)
Feed stops updating in session	latestRoundData().updatedAt age	FEED_STALE
Market session ends (weekend/holiday)	24/5 session calendar	MARKET_CLOSED
Sequencer stalls	block-production lag > 120s	SEQUENCER_DOWN

Flags marked latching stay raised until a human reviews the event and clears them — see Architecture for why.

Trust model

v1 is trusted-operator: one owner, allowlisted updater keys, no bonding. Consumers are protected from watcher death (heartbeat aging fails closed) but must trust watcher honesty. Planned hardening, in order:

1. Multi-updater quorum — N-of-M attestation before a flag word changes.
2. Bonded attestations — updaters stake; provably wrong updates get slashed.
3. Sequencer-uptime feed integration — consume Chainlink's L2 uptime feed on-chain once its address is published for this chain, instead of trusting the watcher's lag view.
4. First-party risk — if Robinhood ships an official status feed, Sentinel's remaining value is the independent, adversarial reading of the same signals; reassess then.

Where to next

• Architecture — how observations become on-chain flags
• Flag reference — every bit, its source signal, and who clears it
• Integrating — the two-file vendored interface and SentinelGuard
• Running the watcher — ops runbook
• Addresses — networks, watched contracts, deployments