One margin account,
many venues.
Twenty-four contracts on Arbitrum Sepolia, the core stack mirrored to Robinhood Chain. Stylus for the math, Solidity for the integrations. Click any piece to inspect it, then watch a position flow through the whole system.
Every piece, and what it does.
The router dispatches a signed transaction to the right place: collateral lives in Coffer, margin is priced by Plinth, each venue has its own adapter, and Vigil + Lantern keep the system honest. Hover or tap a node.
A hedged position, step by step.
Press play. Follow a deposit become collateral, two offsetting positions net their risk, and the margin requirement fall live. That is the entire reason Atrium exists, animated through the real contract path.
Press Play the flow to trace a position from wallet to venue and back, with the margin saving computed live by Plinth's SPAN engine.
Real addresses, verified on-chain.
Every contract below is deployed on-chain with real bytecode. Solidity source is verified on Arbiscan or Sourcify, Stylus via cargo stylus verify; the core stack was redeployed on 2026-06-07 (testnet cutover) and source re-verification is in progress. Which venues are live today versus scaffolded is set out on /docs/honesty. Click any address to copy it.
Solidity verified on Arbiscan or Sourcify (router 0xF593 pending re-verification) · Stylus via cargo stylus verify. Click any address to copy it.
Built to fail loudly, not silently.
Six defensive choices, each addressing a known DeFi blowup vector.
Timelock + multisig
In the mainnet design, every parameter setter is timelock-gated (48h) and emergency pause is multisig-only with no delay (it can pause but cannot upgrade). On testnet today, admin is a single deployer key; the 3-of-5 multisig + timelock is the mainnet target.
Dual-oracle reads
Every Plinth price takes the median of Chainlink and Pyth, with 50 bps tolerance and a 60-second freshness window. Stale or off → revert.
Reentrancy guards
Every state-changing Stylus function carries an is_updating flag, entered before any external call.
Per-block notional cap
Coffer caps how much a single adapter can pull per block. A compromised adapter drains at most ~1% of TVL per block.
AA emergency lever
The Postern Kill Switch routes through Sigil.revoke_all_on_behalf_of, so the revoke counts against the user, not the kill-switch.
No silent fallbacks
Coffer and Plinth revert loudly when USDC state is unreadable, rather than assuming a safe default.
See it running.
The whole stack is live on testnet right now. Faucet test funds, post collateral, and watch your buying-power number move.