Docs

Furl closes a whole tokenized-stock book on Robinhood Chain — loose holdings, pledged collateral and the dollars borrowed against it — in one transaction. It deploys no contract and it has not been audited.

What Furl is

Furl is a planner and a calldata builder. It reads your balances, your Morpho positions and the pools those stocks trade in, works out what closing the whole thing would fetch and what it would cost, and encodes that as a single call to Morpho's Bundler3. Your wallet signs that call. Nothing of Furl's runs on chain, holds anything, or can be upgraded.

There are 49 tokenized stocks with a Morpho market on this chain, across 584 Uniswap pools and 143 markets. Which of those exist is baked into js/assets.js by tools/scan.mjs; everything that can change — price, liquidity, rates, your balances — is read live.

The cycle, and the way out

Morpho Blue enforces three things, and together they make getting out impossible for a wallet with no cash:

  1. Collateral does not come out from under a debt. Every withdrawal ends with a health check.
  2. A debt is repaid in dollars. The dollars you would use are the ones you borrowed and spent, or they are locked inside the collateral you are trying to release.
  3. Pledged shares are not in your wallet. No router can sell them.

Morpho's own flash loan breaks it. flashLoan hands out Morpho Blue's balance of a token for the length of one call, with no fee, and takes it back before the call returns. Furl borrows the debt, repays every market, withdraws every piece of collateral, sells everything through Uniswap's Universal Router and repays the loan out of the proceeds — all inside one transaction, so at no point does anything sit half-done.

The ceiling on that is one number: Morpho Blue's own USDG balance, $48,753,565 at the block this page was built. A book that owes more than that cannot be closed this way at all, and Furl reads the number before it builds anything rather than letting the chain refuse.

The ordering

The order is not a preference. Each rule below is a revert, and the property suite breaks each one on purpose to prove the checker objects.

(signature)      grant Morpho's adapter permission to act for you
pull             every loose holding, into the adapter
flashLoan(USDG, F)
  ├ repay        each market, BY SHARES
  ├ withdraw     each market's collateral, to the adapter
  ├ transfer     each stock into the Universal Router
  └ execute      each stock sold; the dollars come back to the adapter
                 — Morpho takes F back as the call ends
(signature)      revoke the permission
transfer         every remaining dollar, to you
transfer         any share the pools would not take, to you

By shares, not by assets. A debt in assets grows every second; the same debt in shares does not. A repayment sized from a dollar figure read a moment ago is a repayment that is now short, and a position left with dust debt and no collateral is a position anyone may liquidate. Furl always repays borrowShares in full.

Loose holdings are pulled outside the callback. They need no borrowed money, and pulling them first means each stock is sold once, as one order, rather than twice at two prices.

The bill

Three numbers, kept apart on purpose:

  • Fee — the pools' own fee on everything sold. Money, gone.
  • Impact — what your own selling did to the price on the way through. Money, gone, and the part that grows with size.
  • The venue gap — the difference between what the pools pay at rest and what the lending oracle (Robinhood's own tape) says the shares are worth. This is a different market's opinion, not a cost you pay by leaving. It is reported and never added in, because adding it flatters or damns an exit for the wrong reason.

Measured on 49 stocks at block 63,886,442: the median stock costs 1.1% to leave at $50,000. The cheapest is GLD at -0.37%. The worst that can still be quoted is SNDK, at 14.1% for $250,000 against 0.87% for $10,000 — the same shares, 16.3 times the price.

What Furl refuses

Pools above 5% fee. This chain carries v4 pools at 50.95%, 80.02% and 90.01%. They hold liquidity and they quote perfectly happily. The first run of the cost probe reported that leaving one stock cost 98% of it — a true statement about those pools and a false one about the chain, because what it had measured was the fee, not the depth. Furl now refuses anything above 5% and names it, which means some stocks come back as cannot be sold. That is the honest answer.

A walk past the data it read. Furl reads enough tick data around each pool's price to cover a ±50% move. A sale that would go further is not guessed at: those shares are reported as stuck and returned to your wallet.

An insolvent exit. If everything fetches less than everything owed, the flash loan cannot be repaid, so the transaction would revert. Furl says so first.

Hooked v4 pools. A v4 pool with a hook in the swap path is ignored rather than priced with a hook in the way. That is liquidity left on the table, and it is named here rather than quietly skipped.

Permissions

Withdrawing collateral acts on your behalf, so Morpho wants an authorisation for the adapter. Furl asks you to sign a grant and a revocation over consecutive nonces and puts both inside the same transaction; isAuthorized is false again afterwards.

The Universal Router is paid, not approved: the bundle transfers the shares into it immediately before the swap, so an exit leaves no token allowance anywhere. Loose holdings need one allowance to the adapter, which is the only approval Furl ever asks for.

What is checked

Furl has not been audited. What exists is this:

  • Properties on the real chain. The exit's arithmetic and ordering are written in Solidity (contracts/FurlExit.sol) and executed by an eth_call with no to on Robinhood Chain itself — real creation code on the real evaluator. Every property about a refusal has a control that proves the same call succeeds when the guard is removed.
  • A sabotage sweep. The contracts are recompiled with one deliberate defect at a time and each must be caught by a named property. The first sweep caught 14 of 20; the six survivors were holes in the suite, not safe bugs, and became six more properties.
  • A fuzz. Random books — loose, pledged, indebted, in any combination — planned against real pool state, with every invariant re-checked after every draw. Properties build one state and assert one thing; bugs live in sequences.
  • Fork tests. Real books really closed on a fork of this chain, with the wallet's balances checked afterwards.

Every one of those is a command in the repository, and every sweep carries a control that must fail.

Risks

  • Tokenized stock is not stock. It is a token on a chain, and what it is worth depends on whoever is willing to redeem or trade it.
  • Furl is not audited and is experimental software. It deploys no contract, which limits the blast radius to the transaction you sign, but that transaction can still lose you money.
  • Prices move between the quote and the block. Each sale carries a floor the router enforces; if the pools move past it the whole transaction reverts and you pay gas.
  • Nothing watches your position. Furl runs when you press the button and not otherwise. A position liquidated overnight is liquidated.
  • This is not investment advice.