Yarrow Trade

The old market was designed around permission, geography and closing bells. The next one will be built around ownership, access and code. YARROW is our answer to what happens when equities, RWAs and perpetual markets finally move onto one open financial rail. No fragmented accounts. No market that sleeps. No pretending the future is already finished. Just real infrastructure, built one layer at a time. The world’s assets. Always open. yarrow.trade ca: 0x5d6fa71583e40d6a40ab09cd071f24f6603b0970

@vladtenev We embedded them. Here is exactly how, because the engineering is the interesting part. Yarrow runs live perpetual futures on Robinhood Chain using native ETH as collateral, with market prices sourced directly from the @chainlink stock feeds published onchain. The risk engine is an EVM adaptation of Percolator, the perpetual futures architecture open sourced by Anatoly Yakovenko. What makes Yarrow different from nearly every perp DEX operating today is not the interface. It is the settlement logic underneath it. Margin is senior. A trader’s deposited margin is never socialized to pay another trader’s winnings. Profit is junior. When a winning position closes, the trader receives their margin plus the lesser of their realized profit or the available backstop. If the backstop cannot fully cover the profit, the profit is capped. The losing trader’s deposit is never raided beyond the loss created by their own position. Most venues reverse that priority and call the result auto deleveraging. Solvency is enforced as an invariant, not displayed as a dashboard metric. After every open, close, liquidation, funding update, and withdrawal, the contract must satisfy: contract balance = total margin + backstop + pending withdrawals The equation must hold exactly to the wei. Our test harness checks it after every operation. If the invariant ever fails, the math is wrong. The market is not used as an excuse. Prices are composite oracle reads, never numbers published by us. Each ETH denominated mark is calculated directly onchain: priceETH = assetUSD × 1e18 ÷ ethUSD Both inputs come from Chainlink aggregators on Robinhood Chain, and each feed has its own independent freshness requirement. If either side exceeds its permitted staleness window, the market stops accepting new trades rather than trading against a false price. We do not publish the mark. We cannot fabricate it. Liquidations are permissionless. Anyone can operate a keeper, liquidate an underwater position, and earn the liquidation reward. There is no privileged liquidator, no operator discretion, and no hidden button reserved for the team. Settlement cannot be held hostage. Yarrow uses a push or park payout pattern. If a receiving contract deliberately reverts in an attempt to block settlement, the funds are recorded as a pending withdrawal and the engine continues operating. A hostile receiver can damage only itself. It cannot freeze the venue. Funding is capped and driven entirely by open interest imbalance. A cumulative funding index transfers value between longs and shorts. Traders pay one another based on positioning pressure. The house does not collect the funding. The entire venue was deployed on Robinhood Chain for roughly forty cents in gas. That number is why this architecture is finally practical. We are exactly the builders you tweeted for. yarrow.trade/perps

If you're a builder looking to embed stock tokens or RWA into your applications, we want to hear from you

Every exchange in history has a house. Ours doesn't. Read the settlement path of our vault and look for the operator: The price? Two @chainlink feeds divided on-chain. We cannot touch it. Your margin? Senior by code. We cannot reach it. The fees? 10bps in, 10bps out, 100bps on liquidation. Every wei flows to the backstop that pays winners or the keeper that keeps the book solvent. Our cut: zero. Liquidations? Permissionless. Anyone on earth can fire one and earn 50bps for it. We have no special button. Blocking a payout? Impossible. If a receiver rejects ETH, the contract parks it on-chain and settles anyway. One of a kind is not a slogan here. It is an absence. We built a derivatives venue and then wrote ourselves out of it. The market runs. We just watch it with you. 0x5C706FAD8f8fbbE35790AD3B4Dd06e211691b756 yarrow.trade/perps

The breakthrough is not that we built a perps venue. It is that the whole venue fits in four lines of math you can check: mark = TSLA/USD ÷ ETH/USD = $407.82 / $1,795.11 = 0.227186 ETH liquidation = 0.947368 × entry. Exactly −5.2632%, knowable before you click payout = margin + min(profit, backstop). Margin senior, always. Profit paid only from money that provably exists balance == margin + backstop + pending. Verified to the wei after every operation, 42/42 tests No risk desk, no discretion, no trust. An exchange reduced to arithmetic, live on Robinhood Chain, deployed for forty cents. Engine adapted from Percolator by @toly . Unaudited, caps tiny on purpose. Check every line: 0x5C706FAD8f8fbbE35790AD3B4Dd06e211691b756 yarrow.trade/perps

The payout waterfall. Every classic perp blowup has the same shape. Winners are owed more than the pool holds, and the hole gets socialized: ADL, clawbacks, a paused withdrawal page. The impolite version is that your margin was never really yours. It was the venue's working capital. $Yarrow settles every position through one line: payout = margin + min(profit, backstop) Read it as a priority stack. Margin is senior: never socialized, never clawed back. Profit is junior: paid only from value the contract can prove it holds, right now, in wei. That value is real flows, losses realized and fees collected, never another trader's posted margin. The proof is an invariant, not a promise: contractBalance == totalMargin + backstop + pendingWithdrawals checked after every operation in the test suite, exact to the wei. And since min(profit, backstop) ≤ backstop by definition, profit payouts can never pull the backstop below zero. Substitute into the invariant and you get the whole thesis as an inequality: contractBalance ≥ totalMargin + pendingWithdrawals "You cannot withdraw your margin" is not a tail risk here. It is not in the reachable state space. The reachable bad outcome is a bounded haircut on junior profit. The loss side mirrors it: payout = max(0, margin + pnl − funding − fee) The max(0, ...) means a loser can lose to zero and no further. No debt. No clawback. Now price the ugliest edge instead of hiding it. The worst-positioned live 10x position sits just above the trigger with 5% of notional as equity, and per-side OI is capped at 0.15 ETH per market. An instantaneous gap of G beating the roughly 60 second keeper can therefore mint at most (G − 0.05) · 0.15 ETH of unfunded claims. A brutal 20% gap: 0.0225 ETH, about $40 at the current ETH print. It lands on junior profit through the min clamp. Margin does not feel it. A haircut is bounded and visible. A hole in the books cannot exist by construction. Waterfall adapted from Percolator by Anatoly Yakovenko (@toly ), credited, rebuilt independently for the EVM. Unaudited, caps tiny on purpose. Check the arithmetic yourself: 0x5C706FAD8f8fbbE35790AD3B4Dd06e211691b756, Robinhood Chain. yarrow.trade/perps

The mark price is a ratio. Every mark on Yarrow is computed on-chain at trade time, from two Chainlink feeds that both live on Robinhood Chain: priceETH = assetUSD · 1e18 / ethUSD Real print from the vault: TSLA at $407.82 against ETH at $1,795.11 gives 0.227186 ETH per share. The feeds carry 8 decimals; printed dollars are rounded, the chain is not. Sit with that. Collateral is native ETH. PnL is ETH. So a long TSLA perp here does not mean "TSLA up." It means TSLA/ETH up. One position: long the equity, short the Ether, one margin balance. Try to build that trade anywhere else. A brokerage for the stock leg, a perp venue for the short ETH leg, two margin systems, two liquidation engines, no netting between them. Here it is one number moving against one entry. What that grants you: both legs can dump in dollars and the long still marks green if TSLA falls less than ETH. Down 8% on the stock, down 10% on Ether: the ratio rose, you made money. The dollar chart is not your risk. The ratio is. The corollary that will catch someone: a 10x TSLA long can be liquidated while TSLA never moves a cent. ETH rallying 5.556% does it alone, because the trigger lives at 0.947368 of your entry ratio. The stale rule, stated straight: if either feed is stale, your trade reverts. The asset leg gets 7,200 seconds of freshness to open or close, the ETH leg 26 hours. You are never filled against a price the chain cannot defend. The cost is that when feeds stall, you wait. We take that trade every time over filling you on fiction. Residual risk, no varnish: equity feeds sleep from Friday close to Monday open. Ether does not, so the ratio keeps moving while the stock leg stands still, and liquidation runs on a wider 76 hour asset bound through the weekend. Unaudited, caps tiny on purpose. The mark is not an opinion held by a matching engine. It is a division problem with a public answer. yarrow.trade/perps

One line that keeps a vault honest. Every perps venue owes you an answer to one question. If everyone closed right now, is the money actually there? Most venues ask you to trust a dashboard. $Yarrow makes the contract prove it. The invariant: contractBalance == totalMargin + backstop + pendingWithdrawals That is the entire balance sheet of YarrowPerpsETH at 0x5C706FAD8f8fbbE35790AD3B4Dd06e211691b756 on Robinhood Chain. Native ETH held by the contract on the left. Every claim on that ETH on the right. Every wei that enters has exactly one place to be, so the two sides cannot drift. The test suite checks this equality after every single operation: open, close, liquidate, settle funding, withdraw. 19 of 19 green on the ETH vault, 23 of 23 on its USDG twin. Exact to the wei. Zero remainder. One wei of disagreement and the contract convicts itself. What that buys you as a trader. Your margin is senior. Winners are paid as payout = margin + min(profit, backstop) so a winner can never be paid out of another trader's margin. There is no socialization path in the code. The backstop only grows from real flows: the 10bps open fee, the 10bps close fee, half of every 100bps liquidation fee, and 100% of liquidated losses. The venue takes zero from the settlement path. Every wei of fees stays inside the invariant, backing traders. Now the honest residual. The invariant proves the accounting is airtight, not that the backstop is infinite. A price gap larger than the maintenance cushion, faster than the roughly 60 second keeper, can dig a hole bigger than one position's margin. The design answer is a bounded haircut on winner profit through the min clamp. Never insolvency. Never your margin. And an invariant that holds across 42 green tests is not a proof of behavior under adversarial conditions: the code is unaudited, which is exactly why per-side open interest is capped at 0.15 ETH per market at launch. Tiny on purpose. You are not trusting us. You are checking an equality. yarrow.trade/perps

Funding you can compute before you trade. Most venues make funding a timestamp event. Hold through the snapshot, pay for the full 8 hours. Close one second early, pay nothing. That discontinuity is a skim, and bots farm it. A funding rate you cannot reproduce is a fee the venue can set. YARROW uses a cumulative index: imbalance = (longOI − shortOI) / (longOI + shortOI) deltaIndex = imbalance · maxRate · dt / 8h Capped at 100bps per 8h, accruing continuously. Hold 37 minutes, pay 37 minutes. The formula is signed: if shorts crowd the book while you are long, funding runs in your direction, same cap. Verify it. Test case: lone long, $1,000 notional, exactly 8 hours, flat price. imbalance = 1 funding = 1 · 1.00% · (8h/8h) · $1,000 = $10.00 Hand ledger on the $100 margin: open fee 0.50, close fee 0.50, funding 10.00. Ideal payout 89.00. In testing, the contract settled within 7.8 parts per million of that number. Sub-cent, from pure integer math, identical on every node. Per-second accrual makes the largest timing edge $10 / 28,800s ≈ $0.00035 per second. There is no snapshot to snipe. And the cap gives every position a computable fuse: at maximum imbalance, funding drains 1% of notional per 8h, so a lone 10x long on a flat price runs from 10% equity to the 5% floor in exactly 40 hours. Funding alone cannot flash-liquidate anyone, and you can compute your own fuse from block one. The venue takes zero from the settlement path. Unaudited, caps tiny on purpose. yarrow.trade/trade

small correction to nuimbers: Dirty math: your liquidation price is not a secret. On most perp venues the liquidation price is whatever the risk engine says it is. You find out after the fact. On YARROW it is closed-form algebra you can run on a napkin before you trade. Take a 10x long. Entry P0, one unit of size. margin = 0.10 · P0 equity = 0.10 · P0 + (P − P0) maintenance = 0.05 · P, charged on live notional Liquidation fires when equity ≤ maintenance: 0.10 · P0 + P − P0 ≤ 0.05 · P 0.95 · P ≤ 0.90 · P0 P_liq = (0.90 / 0.95) · P0 = 0.947368 · P0 Exactly −5.2632% from entry for the long. Run the identical algebra for a short and the trigger lands at (1.10 / 1.05) · P0: exactly +4.7619% above entry. Not symmetric, and that is not a bug. Maintenance rides live notional, which falls as a long bleeds and rises as a short bleeds. The same force that hands the long an extra 26bps of room takes room away from the short. Most venues never tell you this. Ours is one division, so you can see it. At the liquidation print your equity is still 5% of live notional. The 100bps liquidation fee splits half to the keeper who fired it, half to the backstop, and roughly 4% of notional, about 38% of your initial margin, routes back to you. The loser funds the liquidation. Margin is senior, never socialized. Honest residual: only a gap bigger than that cushion, faster than the roughly 60 second keeper, creates a shortfall, and it lands as a bounded haircut on profits, never on margin. Unaudited, per-side OI capped at 0.15 ETH per market, on purpose. A liquidation should be a theorem you can prove at entry, not a verdict you receive at exit. Vault: 0x5C706FAD8f8fbbE35790AD3B4Dd06e211691b756

The Liquidation Line Dirty math: your liquidation price is not a secret. On most perp venues the liquidation price is whatever the risk engine says it is. You find out after the fact. On YARROW it is closed-form algebra you can run on a napkin before you trade. Take a 10x long. Entry P0, one unit of size. Initial margin is 1000bps of entry notional: margin = 0.10 · P0 Equity as price moves: equity = 0.10 · P0 + (P − P0) Maintenance is 500bps, charged on live notional: mm = 0.05 · P Liquidation fires when equity ≤ mm: 0.10 · P0 + P − P0 ≤ 0.05 · P 0.95 · P ≤ 0.90 · P0 P_liq = (0.90 / 0.95) · P0 = 0.947368 · P0 Exactly −5.2632% from entry. Same number for every wallet, every size, every hour of the day. Integer fixed-point math: Solidity has no floats, so every node computes the identical price. Now the part the naive math misses. 10% margin minus 5% maintenance looks like 5% of room. Wrong. Maintenance is levied on live notional, and live notional shrinks as your long bleeds. The requirement falls with the price. That buys you an extra 26.3bps of distance: 0.90/0.95, not 0.95. Run the same algebra for a short and the trigger lands at (1.10/1.05) · P0, exactly +4.7619% above entry. The asymmetry is not a bug. It is the same live-notional effect working against the short. And one implication the closed form hands you for free. At the liquidation print your equity is 0.05 · P_liq: five percent of live notional, still positive. The liquidation fee is 100bps, half to the keeper who fired the transaction, half to the backstop. Roughly 4% of notional, about 38% of your initial margin, routes back to you before accrued funding. The loser funds the liquidation. The backstop nets positive. Margin is senior, never socialized. The honest residual: only an instantaneous move bigger than that equity cushion, faster than the roughly 60 second keeper, can create a shortfall, and it lands as a haircut on profits, never on margin. Check the arithmetic: YarrowPerpsETH at 0x5C706FAD8f8fbbE35790AD3B4Dd06e211691b756, Robinhood Chain, chain 4663. Unaudited, per-side open interest capped at 0.15 ETH per market at launch, on purpose. A liquidation should be a theorem you can prove at entry, not a verdict you receive at exit. yarrow.trade/perps

Read our fee schedule as a flow diagram, because that's what it is on-chain: ◆ Open a position: 10 bps → backstop ◆ Close a position: 10 bps → backstop ◆ Liquidation: 100 bps, split → 50 to the keeper, 50 to the backstop Now find the arrow that points to us. There isn't one. There is no protocol skim, no treasury cut, no "team wallet" siphon in the settlement path. Every fee the venue collects flows to exactly two places: the backstop that pays winners, or the keepers that keep it solvent. The consequence compounds. The backstop is a net receiver of every open, every close, every liquidation. So the more the venue is used, the deeper its solvency buffer grows, on its own, from activity alone. Volume does not enrich a house here. Volume hardens the vault. A perps venue where the incentives of the traders, the keepers, and the solvency of the book all point the same direction. That is not marketing. That is the fee routing, and you can read it in the contract. yarrow.trade

Stock oracles go quiet on weekends. A lazy venue either freezes or trades you on a dead price. We split the clock in two. To open risk, the asset's Chainlink feed must be fresh within 7,200 seconds. Two hours. You cannot start a new position against a stale mark. Period. To liquidate existing risk, the window is 273,600 seconds. Seventy-six hours. That is not arbitrary, it is sized to span a full market close: Friday's last print stays enforceable straight through to Monday. The asymmetry is the whole point, and it's a 38x ratio by design. Opening new exposure on an old price is how you get picked off, so we forbid it. Enforcing an existing liquidation against the last true print is how you stay solvent through a weekend, so we require it. Same feed, two thresholds, opposite risk postures, both written into the contract where no one can widen the open-window in the dark. A venue that knows the difference between "start a bet" and "settle a bet" is a venue that survives Monday. yarrow.trade

We do not pay a risk desk. We do not run privileged bots. We priced liquidation so that a total stranger always profits from doing it, and let arithmetic handle the rest. Liquidation fee: 100 bps of notional. The keeper who calls it earns half: 50 bps. Against the current 0.15 ETH per-side market cap, a full liquidation pays the keeper: 0.005 · 0.15 ETH = 0.00075 ETH ≈ $1.35 The cost to earn it, at Robinhood Chain gas around 0.05 gwei, is roughly $0.01. Reward to cost, better than 100 to 1. Expected value of liquidating an underwater position is decisively positive for anyone with a script and a wallet. Which means solvency is not a promise we make. It is a bounty anyone can collect, 24/7, and rational self-interest keeps the book clean while we sleep. The permissionless liquidation isn't a nice-to-have. It's the enforcement layer, and its incentive is a closed-form inequality: reward > gas, always. yarrow.trade yarrow.trade/?x

The reason most perp venues eventually socialize losses is a gap that's too small. Ours is deliberately wide. Initial margin: 10% of notional. Maintenance: 5%. That 500 bps gap is not decoration, it's the liquidation runway. Work it through: When a 10x long is liquidated, equity is still 5% of notional. The liquidation fee takes 1%. That leaves ~4% of notional still sitting in the position, which flows back to the trader, while their realized loss and the fee flow to the backstop. Translation: the loser funds their own liquidation and tops up the backstop on the way out. The insurance fund is a net receiver, not a piggy bank being drained. The only way it ever pays a socialized loss is a single instantaneous price gap larger than 5% of notional that beats the keeper. With the keeper checking every 60 seconds, that is the entire, narrow risk surface, and it is quantified, not hidden. Most venues hope the backstop is enough. Ours is designed so it rarely gets asked. yarrow.trade

Every rounding scandal in finance starts the same way: a float. A 0.1 + 0.2 that isn't 0.3. A penny that vanishes and reappears somewhere it shouldn't. Yarrow's vault contains zero floating-point math. It cannot, by construction. Solidity has no floats, and we lean all the way into it: prices carry 8 decimals, quantities and the ETH price carry 18, and every mark is one integer operation: priceX18 = assetUSD · 10¹⁸ / ethUSD Margin, PnL, funding, liquidation, payout: all integer arithmetic in wei, evaluated identically on every node on earth, forever. Same inputs, same output, no drift, no "approximately," no dust leaking into a rounding account someone forgot to audit. This is why our conservation invariant closes to the wei and not to the cent. You cannot have exact solvency on top of approximate math. We chose exact. yarrow.trade

On $Yarrow, one invariant governs the entire vault. At every moment, across every deposit, trade, liquidation, and payout: contractBalance == totalMargin + backstop + pending Money the traders posted, plus the backstop, plus payouts parked for later claim. That is the whole balance sheet, and it must reconcile to the wei or the code is wrong. So we checked it after every single operation in the test suite. Open a position: it holds. Close in profit: holds. Liquidate: holds. Drain the backstop, haircut a winner, jam a hostile receiver: holds. Every step, the three numbers on the right summed to the one on the left with zero remainder. A perps vault that can prove it is never short a single wei is not a feature. It is the entire job, and most never do it. yarrow.trade

Here is the one line of math that separates a solvent venue from a Ponzi. When you close in profit, the contract does not pay you what you "made." It pays: payout = margin + min(profit, backstop) Your principal comes back in full, senior, always. But profit is junior: paid only from value the vault provably holds. If the backstop cannot cover it, you receive exactly what is there and not one wei more. The payout is haircut, on-chain, transparently. Sounds harsh until you see the alternative: every venue that ever paid a winner with a loser's not-yet-realized loss, and then blew up. This inequality makes that failure mode unreachable. The contract literally cannot promise money that does not exist, so it never has to break a promise. We tested it in the ugliest case: backstop nearly empty, a +200 winner closing. Principal returned, profit clipped to the last available wei, invariant intact. Solvency held because the math would not let it not. Real margin. Real oracles. Provable solvency. yarrow.trade

People ask where they get liquidated. On most venues the answer is "somewhere, the engine decides." On $Yarrow it's a closed-form equation, and you can solve it before you click. A 10x long. Initial margin = 10% of notional. Maintenance = 5%. You liquidate when equity hits maintenance: 0.10·P₀ + (P − P₀) ≤ 0.05·P Solve for P: P ≤ (0.90 / 0.95)·P₀ = 0.94737·P₀ Exactly −5.263%. Not "around 5." Not "depends on conditions." 5.263, every time, every market, because maintenance is charged on live notional and the contract does the same division for you that you just did for yourself. That is what a real risk engine buys you: your liquidation price is a number you own, not a surprise the venue serves you. yarrow.trade

Funding is where lazy protocols hand-wave. Ours accrues through a cumulative index, exact: imbalance = (longOI − shortOI) / (longOI + shortOI) ∈ [−1, 1] Δindex = imbalance · maxRate · (dt / 8h) With the cap at 1% per 8h, a perfectly one-sided book pays exactly 1% per 8h to the thin side, pro-rated to the second. We tested it the honest way: lone long, $1,000 notional, held exactly 8 hours, flat price. Predicted payout: $88.999306. Contract paid: $88.999306. Error under one one-hundredth of a cent on the whole settlement. 7.8 parts per million. Funding you can predict to the sixth decimal is funding nobody can quietly skim. yarrow.trade