Security model
Every trade passes inspection.
On a young chain where counterfeits are endemic and five listed tokens trade in dust pools priced 6–11× their real value, trust has to be checked, not assumed. This is what runs between your click and your signature.
Quote
Your order is priced through 1inch across the chain’s real liquidity. Indicative quotes refresh every 15 seconds while you type.
Verify
The implied fill price is compared against the token’s live Chainlink oracle. The signed deviation is always displayed — pass or fail.
Guard
Buys more than 3% above oracle, or sells more than 3% below, are refused before your wallet ever sees a transaction. The check runs twice: on the preview and again on the firm calldata.
Sign
Only a guarded, firm quote reaches your wallet. You sign; confirmation is read back from the chain itself, never from an explorer.
deviation = (effective fill price − Chainlink price) ÷ Chainlink price. Buys block above +3%; sells block below −3%. USDG is assumed $1.00 — the chain has no USDG/USD feed, and this is stated on every order slip. The guard reduces execution risk; it cannot eliminate it.
Canonical or nothing
Robinhood Chain carries counterfeit tokens with real tickers and fake routers — some source-verified on the explorer, which proves nothing. StockFlow resolves tickers exclusively against Robinhood’s published contract registry and Chainlink’s feed directory, every address pinned byte-exact in code. URLs, search, and trading all refuse anything non-canonical.
Honest about market hours
Chainlink feeds follow the underlying market (24/5) and freeze over weekends and holidays while on-chain pools keep trading — which is precisely when prices drift. StockFlow labels closed-market prices as “last close”, pauses trading entirely if a feed goes stale beyond four days, and keeps the guard enforced through the weekend.
Verified-only execution
Swaps execute through the audited 1inch router only (0x as fallback for ETH↔USDG — it legally gates all Robinhood RWAs). Arcus is real but runs an off-chain RFQ book, so StockFlow links out rather than pretending to route it. Venues that can’t be verified on-chain aren’t integrated — they’re named as such.
Nothing to custody, nothing to rug
StockFlow ships zero smart contracts of its own. No deposits, no accounts, no KYC, no token. It is an interface that assembles transactions you sign in your own wallet; balances are scanned in your browser so addresses never reach a server. Close the tab and nothing of yours is anywhere.
Stock Tokens provide economic exposure only — not legal or beneficial ownership — and are subject to jurisdictional restrictions, including unavailability in the United States. Quotes come from third-party venues and can fail or move. Feeds pause when the underlying market is closed. Verify the canonical registry yourself at docs.robinhood.com. Nothing here is investment advice.