Rivora

Every Market. One Margin.
Multi-asset margin trading on Robinhood Chain. Guarded testnet.
Independent project · not affiliated with Robinhood Markets.

[Rivora @Rivoraxyz]

$RIVORA is live.

CA: 0x62A819bA1C873e5044a82210058250499327df05

https://t.co/p3NmcWuSKS

[Rivora @Rivoraxyz]

Nothing shipped today. So here is the half of the ledger that gets published less often what is still not built, and what each item actually needs.

The roadmap runs seven phases and forty three line items. Eight are delivered.

Phase 0, research and specification. Four of seven done. Still open: the legal and product structure, which today is a register of unanswered questions with no entity formed and no counsel engaged; the protocol spec, three drafts nobody outside the team has reviewed, with cross margin, the liquidation auction and corporate actions unwritten; and market maker onboarding, where the pack is written and no desk has been contacted.

Phase 1, private testnet. Four of six done. Wallet and smart accounts has not been started, so trading still needs an EOA signature per order and a separate deposit transaction. Adversarial oracle testing is partial in the way that matters: the suite exists and passes, but the people who wrote the oracle wrote it. That is a test suite, not an adversary.

Phase 2, public testnet. Nothing delivered. The API serves a simulated order book rather than the engine now deployed on testnet, and connecting those two is the next piece of work. One keeper runs settlement ours, undocumented. Test collateral for a competition exists; no competition has been run. Bug bounty, latency and uptime monitoring, and audit remediation are not started, the last one because no audit has been commissioned.

There is also an open defect, not just absent work. The risk simulator found six markets configured above what their insurance reserve absorbs at the 99th percentile. Those caps have to come down before those markets open. They have not come down yet.

Phases 3 through 6 guarded mainnet, unified liquidity, onchain global markets, the open market layer are twenty four further items and not one has been started. Cross-margin is in phase 4. Tokenized equities are in phase 5. Both sit on the front of our site as the reason Rivora exists, and neither is code today.

One more thing worth saying plainly: all eight delivered rows carry a stated gap of their own. The guarded upgrade system is written, tested and not deployed, and no multisig exists to hold governance. The asset registry works correctly and currently lists nothing, because no price feed is contracted.

Forty-three items. Eight delivered. Each claim names the file that proves it.

https://t.co/gR9zCpkOW2

[Rivora @Rivoraxyz]

Each market carries its own insurance accounting so one market's bad day isn't quietly paid for out of another's.

Shared insurance pools have a habit of turning a single bad listing into everyone's problem. Isolated accounting means a tier-E market that fails costs tier-E.

What's public: insurance ratio per market, oracle telemetry, and the guarded phase caveats. On one page, not scattered between a docs site and a pinned message.

On fees, since transparency is the whole claim the ranges in the spec are product assumptions, not commitments. Core crypto maker is modelled as a rebate up to roughly 2bps, taker 4–7bps, RWA linked taker 6–12bps, liquidation penalty 0.5–1.5%, vault performance fee 10–20% of positive performance. Final numbers depend on liquidity, market maker agreements, infrastructure cost and regional requirements. When they're fixed, they'll be published as fixed.

Where protocol revenue can go: insurance reserves, audits and bug bounties, liquidity programmes, oracle and infrastructure cost, development, ecosystem grants.

Where it doesn't go: a promise to token holders of fixed revenue or guaranteed returns. That line is in the protocol document deliberately, and it stays out of the marketing for the same reason.

One piece of vocabulary hygiene while we're here. Funding is exchanged between longs and shorts. It is not protocol yield, and it won't be described as yield on this account.

[Rivora @Rivoraxyz]

Spot lives in the same account as everything else.

Uniswap V2 swaps and ETH/USDG liquidity, straight from your wallet, on the same surface as the terminal. No second app. No second balance. No bridging your own money to yourself.

It isn't a wrapper. The swap page executes against the official Uniswap V2 bytecode Factory, Router02, WETH9 so the pool you're trading is a pool, not an internal ledger entry dressed up as one. Add and remove liquidity from the same page.

Why this matters beyond convenience: spot is what keeps the rest honest. A perpetual is anchored to a reference index, and funding exists to drag the perp back toward it. If the spot venue is somewhere else entirely, the basis between them is somebody else's problem to arbitrage. With both on one surface, the trade that keeps a perp near its index is a couple of clicks instead of a cross-platform operation.

It's also the least dramatic part of the product, which is the point. Most of what a trading account does is move between two assets with no story attached.

[Rivora @Rivoraxyz]

Tokenized equities come with something crypto never had: a closing bell.

Perps run 24/7. The stock underneath one does not. That gap is where RWA markets actually break, and it isn't solved by pretending the market is open.

When the underlying session is closed, Rivora can apply lower maximum leverage, higher initial and maintenance margin, smaller maximum order size, wider price protection bands, tighter open interest caps or close only mode, if reference pricing isn't reliable enough to support new risk at all.

Funding parameters can differ between open and closed sessions too, because the thing funding is anchored to behaves differently when nobody is trading it.

Then there's everything a stock does that a token doesn't expect. Splits. Dividends. Mergers. Halts. Delistings. Each needs defined handling written before it happens, not a governance vote at 3am after a ticker has already gapped.

And the unglamorous gate in front of all of it: a tokenized equity market only exists on Rivora where the underlying token, the issuer's terms, the oracle data and regional access all permit it. Stock tokens without issuer and legal review are explicitly out of the first release.

The market sleeps. The risk engine doesn't.

[Rivora @Rivoraxyz]

vault should explain how it loses money before it takes yours.

Most don't. You get an APY, a logo, and a Discord message.

Rivora Vaults are rules-based strategies you can allocate to, with the disclosure on the vault page itself: what the strategy does, what it risks, what its capacity is, and who runs it.

The categories:

Market-making quotes both sides of approved markets.
Basis attempts to capture spot-perpetual basis.
Delta-neutral offsets directional exposure while pursuing fees or funding.
Index tracks a defined crypto or RWA basket.
Liquidation provides capital for discounted liquidations, under strict limits.

Read "attempts" and "pursuing" literally. None of those are yield. They're strategies with a thesis, and a thesis can be wrong.

The lifecycle is where the real protection lives. A creator proposes a vault. Code, permissions and risk get reviewed. It deploys guarded, with a deposit cap. There's a public monitoring period. If performance and risk look acceptable, limits increase gradually; if they don't, new deposits freeze and the vault unwinds. Then the loop repeats the review never stops being something that can fail.

Deposit caps are a feature, not a growth problem. A vault that can absorb unlimited capital on day one is a vault nobody has measured yet.

Community-created vaults are explicitly excluded from the first release.

[Rivora @Rivoraxyz]

Today Rivora shipped a specification, a risk simulator, a margin engine on testnet, and a page listing everything it still cannot do. The last one took the longest to agree to.

The work, in order.

Specifications. Three versioned documents — margin and liquidation, oracle and asset permissions, guarded upgrades — written in normative language, each naming the file that implements it. All three are drafts. None has been reviewed by anyone outside the team, and they say so at the top rather than in a footnote.

A risk simulator. Seeded Monte Carlo over the same margin formulas the contracts use, run across every market at its configured cap, re-runnable from one command — the same seed gives the same numbers. It immediately found six markets configured above what their insurance reserve absorbs at the 99th percentile. Those caps have to come down before those markets open. We published the finding rather than waiting to publish the fix.

Contracts. The isolated-margin engine, the oracle adapter, a 48-hour timelock and valueless test collateral are deployed and source-verified on Robinhood Chain testnet, with three markets quoting. A rehearsal, not a launch. The word testnet is doing real work in that sentence and we are not going to quietly drop it later.

A threat model. Every risk we currently know about, scored, including the ones with no mitigation at all. The highest-scoring entry is our own token's compromised deployer key. It sits at the top of the page rather than the bottom.

And the build log itself. Nineteen line items across three phases, each marked delivered, partial or not started, each naming the file that proves the claim. Eleven of the nineteen are not delivered. Those rows are the reason the page exists — a roadmap graphic can show progress, but only a ledger can show its absence.

https://t.co/gR9zCpkOW2

[Rivora @Rivoraxyz]

The margin engine is on testnet. Not a launch — a rehearsal, and worth describing as one.

Rivora's phase-1 contracts are deployed and source-verified on Robinhood Chain testnet: the isolated-margin engine, the oracle adapter, a 48-hour timelock, and valueless test collateral behind a faucet. Three markets are live and quoting — BTC, ETH and SOL.

What the contracts actually enforce, as opposed to what a document says they will:

Signed orders. Every order is an EIP-712 signature. The matcher picks which orders meet and nothing else — the fill price has to satisfy both signed limits and sit inside a band around the oracle index. Eight of the tests exist only to check what a matcher cannot do.

Median pricing. The index is the median of at least three feeds from at least two independent operators. With three sources, one manipulated feed cannot move a median at all, and the deviation check flags it. Three feeds from one operator is one point of failure, so the contract counts operators, not feeds.

A guardian that can stop but not start. It can pause the protocol and cancel anything queued, alone and immediately. It can never execute, never unpause, never grant itself a role. A stolen guardian key halts trading — loud, reversible, survivable. It cannot drain anything.

Funding that stops when the oracle does. If the protocol has no price it trusts, funding stops accruing and liquidations stop running. Charging users during our own outage is not a fee, it is a bug.

One thing worth reporting because it was wrong. Partial liquidation did not work. Releasing collateral in proportion to the size closed scales both sides of the health ratio by the same factor, so the position came out exactly as unhealthy as it went in. The surviving collateral now stays with the position, and there is a test that fails if that ever regresses.

What is not built: no wallet abstraction, no cross-margin, no audit, no bug bounty, no external keeper, and the API still serves a simulated book rather than these contracts.

All of it is listed item by item with the file that proves each claim — including the empty rows.

https://t.co/gR9zCpkOW2

[Rivora @Rivoraxyz]

Having trouble buying $RIVORA? Try swapping directly on the Rivora website.

Here’s a successful swap transaction for reference 👇

🌐 Website: https://t.co/QOjyBuXWO9
🔗 TX: https://t.co/qULaAOW32m

[Rivora @Rivoraxyz]

A market is never safer than the price feeding it.

You can write a flawless margin engine and still lose everyone's money if the number going into it is wrong.

Price integrity decides what your collateral is worth and when you get liquidated, which makes it the first thing worth being paranoid about.

The controls Rivora is specified around: maximum price age, so a stale feed can't quietly become the truth. Maximum deviation between sources, so one venue printing a wick doesn't move your mark. Confidence-interval checks. Circuit breakers. Last-good-price handling, with a fallback policy defined per market rather than one global rule.

Mark price is built to resist manipulation instead of tracking the last trade because the last trade is precisely what an attacker can buy.

And the part that matters most: when data is stale or sources contradict each other, the market moves into a protective state. Reduce leverage, block new risk, or pause settlement. Liquidations are delayed rather than executed against a price nobody can vouch for.

A protocol should never keep liquidating normally on bad data. It's among the cheapest failures to prevent and one of the most expensive to explain afterwards.

There's a public oracle-status dashboard for the same reason. If the feed is degraded, that shouldn't be something only the team can see.

[Rivora @Rivoraxyz]

Liquidation shouldn't be a cliff.

On plenty of venues it's a single step: you cross the line, the whole position goes, and you find out from a notification.

Rivora's flow is a staircase.

The risk engine recalculates account health continuously. Above the warning threshold, nothing happens. Below it, you get a warning and risk-increasing orders are restricted you can still reduce, you just can't dig deeper.

Below maintenance margin, open risk-increasing orders are cancelled first. Then partial liquidation: reduce enough to bring the account back, not everything. If that restores health, the process stops there and you keep the rest of the position.

If it doesn't, the position goes to auction or a backstop. If residual loss remains after that, it's covered by that market's own isolated insurance reserve not a shared pot quietly funded by unrelated markets.

Automatic deleveraging sits at the very bottom of the flowchart, documented as a last resort, with its rules written down in advance rather than improvised during the event.

The protections around all of it: mark price rather than a single last trade, a minimum oracle confidence before anything fires, capped liquidator incentives so nobody is paid to make it worse, open-interest and concentration limits, and an emergency pause bounded by predefined governance rules.

Partial liquidation is in the first release. It isn't a phase three nicety.

The measure of a liquidation engine isn't how fast it closes you. It's how often it doesn't have to.

[Rivora @Rivoraxyz]

Rivora is now verified on DexScreener.

https://t.co/ZA1VbK35YR

Enhanced token info is live on the pair page website, socials and description published straight from us, so nobody has to guess which of the accounts using our name is the real one.

That last part is the whole reason it's worth paying for. Impersonation accounts and copy-pasted contract addresses are the standard failure mode of any launch, and a verified pair page is one of the few places a stranger can check us against a source we control.

If a link doesn't appear on the DexScreener page or on https://t.co/FuYEEQcjse, treat it as not ours.

CA: 0x62A819bA1C873e5044a82210058250499327df0

[Rivora @Rivoraxyz]

Liquidity locked. 1year.

https://t.co/Lj9Zrlij5a

[Rivora @Rivoraxyz]

The order ticket tells you what a fill does to your account before you sign it.

New initial margin. New maintenance margin. New health. New liquidation price.

It's the same check the relayer runs so nothing changes between the ticket and the fill.

[Rivora @Rivoraxyz]

Markets are graded, not lumped together.

A . core crypto, deepest books
B . growth crypto
C . tokenized equities, the tier with market hours
D . indices, commodities, FX
E . permissionless, isolated, bonded

Risk gets priced per tier instead of averaged away.

[Rivora @Rivoraxyz]

Your ETH collateral can't back a gold position. Your equity margin can't see your perp hedge.

Every asset class sits in its own silo with its own book, its own margin system and its own 2am liquidation.

Rivora nets them into one account.

[Rivora @Rivoraxyz]

very market. One margin.

Crypto, tokenized equities, indices, commodities, FX one account, one equity number, one health score.

Not five platforms with five balances and five different ways to get liquidated.

https://t.co/9gSctpx9eg