<aside> 🏛️

Atrium: cross-venue portfolio margin for the EVM.

One deposit backs positions across many venues, because risk nets instead of being re-posted. The margin engine is SPAN-style and it runs on-chain, in Stylus (Rust compiled to WASM) on Arbitrum. A hedged book never needs more margin than its isolated legs, and the contract is what enforces that, not a spreadsheet.

Live on Arbitrum Sepolia (421614, primary) and Robinhood Chain testnet (46630) with the full stack deployed on both. Every number on this page is backed by a transaction hash, a live RPC read, or a file in the repo. The proof deck below re-verifies its own transactions in your browser.

</aside>

Key links

Proof links

For judges: each criterion, mapped to its evidence

Criterion Where to verify it
Smart contract quality Open span.rs and the Kani-proven netting invariant; 792 passing tests across Rust, Solidity, and TypeScript; contracts verified on Sourcify; threat model and disclosure policy at /security; known limits disclosed in source, not hidden
Product-market fit The wedge in section 5; the 90-second faucet-to-position onboarding any judge can run at useatrium.me; capital freed is computed by the engine, not claimed (51.0% in the live worked example)
Innovation and creativity Section 1: the first SPAN scenario engine running on-chain, made feasible by Stylus; section 2: agent delegation enforced by the contract rather than by middleware
Real problem solving What Atrium is, directly below: isolated margin locks roughly 3x the capital a netted book needs, and the live product demonstrates the difference with real transactions

What Atrium is

Today a trader posts collateral separately at each venue: Hyperliquid, Aave, Pendle, Curve. To run $100K of exposure at three venues you lock roughly $300K, because each venue margins in isolation. The portfolio effect, the thing prime brokerage sells in TradFi, does not exist on-chain.

Atrium is that prime-brokerage layer. Deposit once into an ERC-4626 vault (Coffer). A SPAN-style scenario engine (Plinth) revalues the whole book per block and produces one buying-power number. Opposing risk nets: a long ETH perp on one venue and a short on another margin as a hedge, not as two positions. The worked example in the live app: two $100K opposing legs need $20,400 margined alone and $10,000 netted as one portfolio. Netting frees 51.0%.

Around the engine sits the rest of a real brokerage: agent delegation with on-chain enforced limits (Sigil), proof-of-reserves anyone can verify in a browser (Lantern), a pay-per-call read API (Codex), cross-chain collateral via Chainlink CCIP (Aqueduct), and a liquidation keeper (Vigil).

At a glance

Metric Value How to check it
Margin engine SPAN scenario grid, on-chain, in Stylus (Rust to WASM) Read span.rs in the repo; the engine is split Plinth / Plinth-Math / Plinth-Oracle to fit the 24KB cap
Money round-trip 4 real txs, all status 1: approve, deposit, open, withdraw /proof-deck.html re-checks the receipts in your browser via eth_getTransactionReceipt
Agent enforcement 4 recorded on-chain txs: in-scope ALLOWED, over-cap BLOCKED, kill switch, post-revoke BLOCKED /app/agents shows the run; reverts are NotionalExceeded and MandateRevoked
Venue adapters 9 deployed and verified, 7 in margin scope, 1 openable today (Aave Horizon) Sourcify exact-match for 8 + Arbiscan for Aave; per-venue status badges in the live UI are honest
Chains 2 testnets, full stack on both /architecture lists addresses for 421614 and 46630
Tests 792 passing (unit + contract) Repo CI; vitest + cargo + forge
Formal methods Core netting invariant Kani-proven; 9 proof harnesses authored contracts/plinth/src/span.rs; 2 of 9 harnesses are placeholders, disclosed in-source
Proof of reserves Signed Merkle attestation + browser inclusion proof /app/reserves; redeemable is a live Coffer.convertToAssets read
Public read API x402-payable Codex worker, live /docs/api try-it answers in the browser

Robinhood Chain

<aside> 🟢

The full 15-contract stack is live on Robinhood Chain testnet (chain 46630), not just Arbitrum Sepolia. Atrium deployed the complete protocol there, including the Stylus margin engine, using a documented workaround for chains that lack the StylusDeployer (the deployer contract is reproduced on-chain first, then used for constructor-bearing Stylus deploys). Addresses for both chains are listed side by side on /architecture, and the deploy record lives in deployments/robinhood_chain.json in the repo. Robinhood Chain is also a first-class venue in the product roadmap: the RH-Chain native-spot adapter is part of the venue scope shown in the app.

</aside>

How Atrium works

  1. Deposit. USDC goes into Coffer, an ERC-4626 vault. Shares mint at the live exchange rate. Per-user and per-block caps apply, and a TVL-drop circuit breaker can pause deposits.
  2. Margin. Plinth runs the SPAN scenario grid over the whole book per block and produces one buying-power number. The same span.rs logic is ported to TypeScript so the UI Margin Lens computes the identical number client-side.
  3. Open. AtriumRouter routes the open through Plinth (margin check) and Coffer (collateral pull) to the venue adapter in one signed transaction. On-chain, getUserPositions gains the new id and the account stays healthy.
  4. Verify. Withdraw back out, or prove your balance to anyone: Lantern publishes a signed Merkle attestation of every balance on-chain and the browser builds your inclusion proof. No trust required.

Unified margin: one buying-power number, Margin Lens netting panel, live on Arbitrum Sepolia

Unified margin: one buying-power number, Margin Lens netting panel, live on Arbitrum Sepolia