How it works, and where it stops
Freeboard deploys no contract. Every transaction it builds is a call to contracts that were live on Robinhood Chain before this site existed. What this site adds is arithmetic — and the arithmetic is the part worth checking.
The arithmetic
Four lines. Everything on the site comes out of them, and js/risk.js is where they live.
Health, liquidation price, freeboard
Morpho Blue calls a position healthy while
so the price at which it stops being healthy is exact:
and freeboard is how far today's price can fall before it gets there — 1 − ltv ÷ lltv. On Robinhood Chain every stock market uses an lltv of 62.5%, so you lose the loan while the collateral is still worth substantially more than the debt.
- The price is the market's own oracle, in its 1e36 scale, in BigInt — never a float
- The debt is toAssetsUp of your borrow shares, which is how Morpho rounds it: against you
- Interest is accrued to the instant the page is asking about, not to the market's lastUpdate
What a liquidation takes
Morpho pays a liquidator an incentive out of your collateral:
At lltv 62.5% that is 1.1268 — 12.68% of whatever is repaid, paid by you. The floor on lltv here is 38.5%, where the formula saturates at Morpho's cap of 15%.
And there is no close factor. Aave caps a liquidator at half a position. Morpho Blue does not cap them at all, so the number at stake is 12.68% of the whole debt.
What a trim costs
The gap between what the collateral is worth at the market's own oracle and what a Uniswap pool will actually pay for it. Fee and price impact together, in one number.
- Pool state is read properly: the tick bitmap words and every initialised tick inside the price window, then walked by js/sim.js — Uniswap's own swap arithmetic, in BigInt
- A sale that would walk past the depth that was read comes back beyond and is refused, not quoted as if the pool ended
- The size that reaches a chosen freeboard is found by bisection, because proceeds are not linear in size — a closed form is used only to bracket the search
It is deliberately not measured against the difference between the oracle and the pool. A sibling site did that and produced trading costs that came out negative: the two venues disagree by a different amount for every stock, and calling that a saving is how you talk yourself into a bad trade.
When a trim is refused
Selling collateral to repay debt lowers your LTV only while
Past that line, each dollar raised gives up more equity than it retires, and the sale moves you towards liquidation. At an LTV of 61% in a market with a 62.5% lltv, a 4% trading cost is already on the wrong side of it.
So planTrim probes the cost at a small size first and returns { refused: 'harmful' } when the position is in that region, with the two routes that sell nothing offered instead.
And it does not fire on this chain. The fork suite first claimed it would, and the control that forced the trim through anyway disproved the claim: the LTV went from 60.1% to 50.1%. It helped. The guard needs a cost above 1 − ltv — 71.9% on that position — and selling everything pledged into the real pools costs 0.01%. The suite proves the inequality with an injected cost, measures the real one, and reports that the region was not reached. An assertion that cannot fail is worth less than a measurement that says "this did not happen here".
The transaction
One call to Morpho's own Bundler3, sent by your wallet. GeneralAdapter1 acts for the transaction's initiator and never for an address handed to it, which is why none of this needs to trust Freeboard with anything.
Trim
- setAuthorizationWithSig — your signed grant
- morphoFlashLoan(USDG, F), and inside it:
- morphoRepay(assets = F)
- morphoWithdrawCollateral(sell) — only what is sold
- erc20Transfer → Universal Router
- execute — sold, with SWEEP's floor set to F
- morphoRepay(whole balance) — the slippage that did not happen, put back on the loan
- setAuthorizationWithSig — your signed revocation
Ballast, and Repay
- erc20TransferFrom → the adapter
- morphoSupplyCollateral (or morphoRepay)
Two calls. No flash loan, no swap, and no authorisation at all — supplying collateral for someone and repaying someone's debt are both permissionless on Morpho Blue, so these bundles never ask for a permission and therefore cannot leave one behind.
What is not left behind
- No allowance to the router — it is paid by transfer, not by approval
- No authorisation: granted and revoked over consecutive nonces inside the same transaction
- No balance in the adapter, in Bundler3 or in the router
- No token approval to Freeboard — there is no Freeboard contract to approve
Every one of those is asserted after every trim the fork suite makes, and a check that could pass because nothing happened is refused unless the trim actually landed.
What is checked
Each of these is a tool you can run, and each one has a control that must FAIL — a validator that quietly stopped validating looks exactly like a clean build.
| Tool | What it proves | Its control | Result |
|---|---|---|---|
| test-trim.mjs | The whole product on a fresh fork of this chain | A forced trim must make a high-LTV position worse — it did not, and that killed the claim | 27/27 |
| properties.mjs | Each property executed on chain, one per eth_call | A property with the guard removed must fail | 22/22 |
| fuzz.mjs | Random operation sequences, invariants after every call | Each broken build must be caught by the invariant named for it | 8/8 broken caught |
| sabotage.mjs | One part of the planner broken at a time | A survivor must be declared, with a reason | 16/16 |
| check-addresses.mjs | Every address answers, with the exact selectors this site calls | A selector that cannot exist must not be found | 14/14 |
| e2e.mjs | The real page, in a browser, against a fork | The page must be proved to read the fork it writes to, first | not run |
| palette.mjs | 47 colour pairs, alpha composited in gamma space | An unreadable ink planted in the palette must fail the proof | 47 pairs |
| paint.mjs | This page and usevynex.org, on painted pixels, in one browser run | A blank page must read 100% flat with zero spread and zero texture | 0.029–0.045 chroma |
| scan.mjs | Every market re-derived and its oracle checked against a Uniswap pool | The rate model must agree with the deployed IRM exactly | 38 markets |
Limits
In plain words, the things this does not do — because a limit you have to discover is worse than one you were told.
Not audited, and no contract of ours
Freeboard deploys nothing. What you are trusting is Morpho Blue, Morpho's Bundler3 and GeneralAdapter1, and Uniswap's Universal Router — none of which we wrote and none of which we audited — plus this site's arithmetic, which is measured on a fork of the real chain and has not been audited by anyone.
There is a real contract in contracts/ that does a trim in one call. It is proved and it is deliberately unused: audited infrastructure that is already live beats our own bytecode.
And three frames of this page read as flat
Measured beside usevynex.org in the same browser run: this page's chroma is 0.029–0.045 against the reference's 0.027–0.040, and its texture 1.9–5.7 against 1.6–7.2. But flat% runs 1.1–54.5 where the reference's worst is 16.2.
Those three frames are the dark bands, and flat% on a dark frame mostly reports that the frame is dark: it is the share of pixels within 0.02 luminance of the median. The flattest of them has the highest chroma on the page and spans 0.03 to 0.80 in luminance — a frame that is genuinely a fill cannot do that. So the tool asserts the thing that separates the two: every frame above 20% flat must also have a wide spread. Not "the number is fine"; the number measures something else.
And nobody here is close to the line
11 of the 30 loans on this chain sit within a 25% fall, and they hold $474 between them. The 10 loans holding 99.8% of the debt have 27.2% to 71.7% of room. So this is not a product about an emergency. It is a product about a price nobody is shown, and 27.2% is an ordinary quarter.
Nothing is watching
There is no keeper, no alert and no automation. Morpho Blue has none either — that is why this problem exists. You come back and look, or you do not. A position that runs out of freeboard while nobody is looking is closed by whoever is looking.
The largest borrower here cannot be trimmed
wsNET carries $715,647 — around 42% of all stock-backed debt on this chain — and has no Uniswap pool. There is nowhere to sell its collateral, so the flash-loaned route is impossible on it, and the app says so instead of quoting a number. 4 markets with debt are in that position. Repay and ballast still work.
Self-liquidation is not built
Once a position is already liquidatable, the cheapest move is to be your own liquidator: you pay the 12.68% penalty and you also receive it, so it cancels, and the same flash loan supplies the cash. It is real and it is not here. If your freeboard has already reached zero, this site can measure the damage and cannot undo it.
Oracle staleness is not modelled
Several of these oracles stop answering after about a day. A market whose oracle has gone stale cannot be borrowed from, liquidated, or trimmed — which over a long weekend changes what is possible in both directions. Freeboard reports the price it gets and does not model when it will stop coming.
And a short would have been the better product
The first idea was to let you bet against a tokenized stock. Morpho markets that lend NVDA, TSLA, SPY, AAPL and GOOGL all exist here, and every one holds zero supply: nobody lends a share, so nobody can borrow one. Measuring that took ten minutes and killed the idea, which is the cheapest thing that happened in this build.