Stockline - Stockline

Stockline is the immutable lending core. It holds every account’s collateral and scaled debt per book, accrues interest through a per-book borrow index, and enforces the action table from each book’s oracle regime. Risk parameters live in RiskRegistry, USDG liquidity lives in USDGPool, and liquidation sizing lives in LiquidationModule. The contract has no owner, no upgrade path, and no admin setters. Stockline lets you:

Supply stock tokens as collateral to a book, for themselves or for another account
Borrow USDG against cross-collateral positions while the regime is LIVE
Repay debt and add collateral in every regime, even when paused
Withdraw collateral while the position stays above the line
Deleverage by selling collateral through a callback and repaying in the same transaction
Liquidate positions below the liquidation threshold in LIVE or DARK
Grant operator rights to routers with a call or an EIP-712 signature
Read health, max borrow, liquidation price, and per-book debt

Addresses per network. Every address is also on Addresses.

Network	Address
Robinhood Chain testnet	0xA070319C494edf49600A6257c8676691429c3a68

The source code is src/core/Stockline.sol on GitHub. The ABI is /abis/Stockline.json.

Write methods

pause

function pause() external

Turns on the pause. Only the guardian address can call it. Pause blocks borrow, withdrawCollateral, liquidate, and USDG withdrawal from the pool. It never blocks repay, supplyCollateral, or deleverage.

Guardian only. Reverts with NotGuardian otherwise.

unpause

function unpause() external

Turns off the pause. Only the guardian address can call it.

Guardian only. Reverts with NotGuardian otherwise.

setOperator

function setOperator(address operator, bool approved) external

Approves or revokes operator to act on the caller’s positions. An operator can borrow, withdraw collateral, and deleverage on the caller’s behalf. Reverts with ZeroAddress for the zero address.

An operator can borrow USDG to any receiver and withdraw collateral to any address. Approve only contracts you trust.

Input parameters

Name	Type	Description
operator	`address`	The address to approve or revoke, usually PositionRouter or Zap.
approved	`bool`	True to grant, false to revoke.

setOperatorWithSig

function setOperatorWithSig(
    address account,
    address operator,
    bool approved,
    uint256 deadline,
    uint8 v,
    bytes32 r,
    bytes32 s
) external

Sets an operator for account using an EIP-712 signature so an EOA can approve a router and act in one transaction. Reverts with Expired after deadline, InvalidSignature when the signer is not account, and ZeroAddress for zero addresses. Each successful call consumes the account’s current operatorNonce.

Domain: name “Stockline”, version “1”, the current chain id, and this contract’s address. Type: Operator(address account,address operator,bool approved,uint256 nonce,uint256 deadline).

Input parameters

Name	Type	Description
account	`address`	The account granting the approval. Must equal the signer.
operator	`address`	The address to approve or revoke.
approved	`bool`	True to grant, false to revoke.
deadline	`uint256`	Unix timestamp (seconds) after which the signature is invalid.
v	`uint8`	Signature recovery id.
r	`bytes32`	Signature r value.
s	`bytes32`	Signature s value.

supplyCollateral

function supplyCollateral(uint16 bookId, uint256 amount) external nonReentrant

Pulls amount of the book’s collateral token from the caller and credits it to onBehalfOf (or to the caller in the two-argument form). Always live: it works in every regime and while paused. Reverts with ZeroAmount on a zero amount, UnknownBook on an unknown book, and ZeroAddress when onBehalfOf is the zero address.

The caller must first approve Stockline to spend amount of the collateral token. Tokens are pulled from the caller, not from onBehalfOf.

If prices are available for every book the account holds, this call also refreshes liquidatableSince, which can end an open auction once the account is healthy again.

Input parameters

Name	Type	Description
bookId	`uint16`	The book that lists the collateral token.
amount	`uint256`	Collateral tokens to deposit, in the token’s native units.

supplyCollateral

function supplyCollateral(
    uint16 bookId,
    uint256 amount,
    address onBehalfOf
) external nonReentrant

The caller must first approve Stockline to spend amount of the collateral token. Tokens are pulled from the caller, not from onBehalfOf.

If prices are available for every book the account holds, this call also refreshes liquidatableSince, which can end an open auction once the account is healthy again.

Input parameters

Name	Type	Description
bookId	`uint16`	The book that lists the collateral token.
amount	`uint256`	Collateral tokens to deposit, in the token’s native units.
onBehalfOf	`address`	The account that receives the collateral credit. Defaults to the caller in the two-argument overload.

withdrawCollateral

function withdrawCollateral(uint16 bookId, uint256 amount) external nonReentrant

Moves amount of collateral out of a book and sends it to to (or to the caller in the two-argument form). Requires the book’s regime to be LIVE and the protocol to be unpaused. Reverts with Unhealthy when the remaining collateral, valued at the liquidation threshold, no longer covers total debt.

Blocked while paused (Paused) and in every regime other than LIVE (RegimeBlocked). The four-argument overload reverts with NotOperator unless the caller is onBehalfOf or an approved operator.

LIVE only. Blocked when paused. Health must hold after the pull.

Input parameters

Name	Type	Description
bookId	`uint16`	The book to withdraw from.
amount	`uint256`	Collateral tokens to withdraw, in the token’s native units. Reverts with InsufficientCollateral if larger than the balance.

withdrawCollateral

function withdrawCollateral(
    uint16 bookId,
    uint256 amount,
    address onBehalfOf,
    address to
) external nonReentrant

Blocked while paused (Paused) and in every regime other than LIVE (RegimeBlocked). The four-argument overload reverts with NotOperator unless the caller is onBehalfOf or an approved operator.

Input parameters

Name	Type	Description
bookId	`uint16`	The book to withdraw from.
amount	`uint256`	Collateral tokens to withdraw, in the token’s native units. Reverts with InsufficientCollateral if larger than the balance.
onBehalfOf	`address`	The account whose collateral is withdrawn. The caller must be this account or an approved operator of it.
to	`address`	The address that receives the collateral tokens.

borrow

function borrow(uint16 bookId, uint256 amount) external nonReentrant

Draws amount USDG from USDGPool against the account’s collateral and sends it to receiver (or to the caller in the two-argument form). Requires LIVE regime, unpaused state, and borrowingEnabled on the book. Reverts with CapExceeded when the book’s debt would pass borrowCap, IssuerCapExceeded when the issuer’s total would pass issuerCap, and Unhealthy when total debt would exceed borrow power (collateral valued at LTV).

Borrow power uses LTV, not the liquidation threshold. Borrowing up to the maximum leaves the position one small price move away from the line. The four-argument overload reverts with NotOperator unless the caller is onBehalfOf or an approved operator.

Debt is stored as scaled debt and rounded up against the borrower. The pool must hold enough idle cash or USDGPool reverts with InsufficientCash.

Input parameters

Name	Type	Description
bookId	`uint16`	The book that the new debt is booked against. Interest accrues at this book’s rate.
amount	`uint256`	USDG to borrow, in USDG native units.

borrow

function borrow(
    uint16 bookId,
    uint256 amount,
    address onBehalfOf,
    address receiver
) external nonReentrant

Debt is stored as scaled debt and rounded up against the borrower. The pool must hold enough idle cash or USDGPool reverts with InsufficientCash.

Input parameters

Name	Type	Description
bookId	`uint16`	The book that the new debt is booked against. Interest accrues at this book’s rate.
amount	`uint256`	USDG to borrow, in USDG native units.
onBehalfOf	`address`	The account that takes on the debt. The caller must be this account or an approved operator of it.
receiver	`address`	The address that receives the borrowed USDG.

repay

function repay(uint16 bookId, uint256 amount) external nonReentrant

Pulls USDG from the caller and reduces the debt of onBehalfOf (or the caller) in one book. Always live: it works in every regime and while paused. The amount is capped at the outstanding debt, so passing a larger number closes the book cleanly. Reverts with ZeroAmount when there is nothing to repay.

The caller must approve Stockline to spend the USDG. The payer is always the caller, never onBehalfOf.

Principal plus supplier interest goes to USDGPool. The reserve-factor slice, which was already counted at accrual, goes to FeeCollector as cash on repay.

Input parameters

Name	Type	Description
bookId	`uint16`	The book whose debt is repaid.
amount	`uint256`	Maximum USDG to repay. Any excess above the outstanding debt is not pulled.

repay

function repay(
    uint16 bookId,
    uint256 amount,
    address onBehalfOf
) external nonReentrant

The caller must approve Stockline to spend the USDG. The payer is always the caller, never onBehalfOf.

Principal plus supplier interest goes to USDGPool. The reserve-factor slice, which was already counted at accrual, goes to FeeCollector as cash on repay.

Input parameters

Name	Type	Description
bookId	`uint16`	The book whose debt is repaid.
amount	`uint256`	Maximum USDG to repay. Any excess above the outstanding debt is not pulled.
onBehalfOf	`address`	The account whose debt is reduced. Anyone may repay for anyone.

deleverage

function deleverage(
    address account,
    uint16 fromBook,
    uint256 amount,
    uint16 repayBook,
    address callee,
    bytes calldata data
) external nonReentrant

Releases amount of collateral from fromBook to callee, calls callee.onDeleverage, then repays repayBook from whatever USDG the callee sent back. Skips the LIVE and pause gates because the net effect only reduces risk. Reverts with NotOperator unless the caller is account or its operator, ZeroAmount if the callback returns no USDG or the repay book has no debt, and Unhealthy if the account ends below the liquidation threshold.

The callee receives the collateral before any USDG is checked. Only use a callee you trust, such as PositionRouter.

USDG the callee returns beyond the debt of repayBook is forwarded to account. The callback runs under the reentrancy lock, so the callee must not call back into Stockline.

Input parameters

Name	Type	Description
account	`address`	The account whose collateral is sold and whose debt is repaid.
fromBook	`uint16`	The book to pull collateral from.
amount	`uint256`	Collateral tokens to release to the callee, in native units. Reverts with InsufficientCollateral if too large.
repayBook	`uint16`	The book whose debt is repaid from the proceeds. It can be the same as `fromBook` or a different one.
callee	`address`	A contract that implements IDeleverageCallback. It receives the collateral and must send USDG back to Stockline before returning.
data	`bytes`	Opaque bytes forwarded to the callee.

liquidate

function liquidate(
    address account,
    uint16 bookId,
    uint256 repayAmount
) external nonReentrant

Liquidates part of an unhealthy account through LiquidationModule. Requires the book’s regime to be LIVE or DARK and the protocol to be unpaused. Reverts with NotLiquidatable when the account is at or above the liquidation threshold. Sets liquidatableSince on the first call, which starts the Dutch auction at a discount of exactly 0.

The liquidator must approve Stockline to spend USDG before calling. Stockline pulls the final repay amount from msg.sender inside applyLiquidation. In DARK the price carries the dark haircut, so the seize is priced against a reduced value.

Liquidations are permissionless. The liquidatorAllowlist flag in RiskRegistry is stored but not enforced. Call LiquidationModule.quote first to preview the repay and seize amounts.

Input parameters

Name	Type	Description
account	`address`	The account to liquidate.
bookId	`uint16`	The book whose collateral is seized and whose debt is repaid.
repayAmount	`uint256`	Maximum USDG the caller is willing to repay. LiquidationModule may lower it to the amount that restores target health.

applyLiquidation

function applyLiquidation(
    address account,
    uint16 bookId,
    uint256 repayAmount,
    uint256 seizeToLiquidator,
    uint256 seizeToProtocol,
    address liquidator
) external

Callback that LiquidationModule invokes after sizing a liquidation. Cuts the account’s debt, moves seized collateral to the liquidator and to FeeCollector, and pulls the repay USDG from the liquidator. Reverts with NotModule for any other caller and InsufficientCollateral when the seize exceeds the balance.

Module only. Do not call this directly; use liquidate.

Not nonReentrant: core.liquidate already holds the lock and this is a trusted module callback.

Input parameters

Name	Type	Description
account	`address`	The liquidated account.
bookId	`uint16`	The book being liquidated.
repayAmount	`uint256`	USDG the liquidator pays.
seizeToLiquidator	`uint256`	Collateral tokens sent to the liquidator.
seizeToProtocol	`uint256`	Collateral tokens sent to FeeCollector as the protocol’s share of the discount.
liquidator	`address`	The address that pays USDG and receives collateral.

realizeBadDebt

function realizeBadDebt(address account) external

Writes off every remaining debt of an account that holds no collateral in any book. Only LiquidationModule can call it, after a liquidation leaves the account bare. Reverts with StillCollateralized if any book still holds collateral. The written-off amount is socialized to USDGPool through realizeBadDebt, capped at the pool’s outstanding debt.

Module only. Suppliers absorb the loss through a lower sUSDG share price until FeeCollector covers it from the reserve.

SPEC: socialize via the pool now. Reserve then Backstop take priority once those ships.

Input parameters

Name	Type	Description
account	`address`	The account whose leftover debt is wiped.

accrueInterest

function accrueInterest(uint16 bookId) external

Advances the borrow index of one book to the current timestamp. Anyone can call it. Interest splits into the supplier slice (reported to USDGPool) and the reserve-factor slice (reported to FeeCollector). Reverts with UnknownBook for an unknown book.

All state-changing entry points accrue automatically. This call is useful for keepers and indexers that want a fresh index without a position change.

Input parameters

Name	Type	Description
bookId	`uint16`	The book to accrue.

Read methods

usdWithdrawPaused

function usdWithdrawPaused() external view returns (bool)

Returns true while the guardian pause is active. USDGPool reads this to zero out maxWithdraw and maxRedeem. Return values

Type	Description
`bool`	True when paused.

health

function health(address account) external view returns (uint256)

Returns the account’s health factor in WAD (1e18). The value is the sum of collateral valued at each book’s liquidation threshold, divided by total debt. Below 1e18 the account can be liquidated. Returns the maximum uint256 when the account has no debt.

This view reads every book’s oracle price, so it reverts with PriceUnavailable when any held book is HALTED, in CA_WINDOW, or SEQ_DOWN.

Input parameters

Name	Type	Description
account	`address`	The account to check.

Return values

Type	Description
`uint256`	Health factor in WAD. 1e18 is the line.

maxBorrow

function maxBorrow(address account) external view returns (uint256)

Returns how much more USDG the account can borrow right now. Borrow power is collateral valued at LTV; the result is that power minus total debt, or 0 when debt already exceeds it.

This does not check book caps, issuer caps, pool cash, or regime. A borrow for exactly this amount can still revert on those.

Input parameters

Name	Type	Description
account	`address`	The account to check.

Return values

Type	Description
`uint256`	Additional USDG the account can borrow, in USDG native units.

liquidationPrice

function liquidationPrice(address account, uint16 bookId) external view returns (uint256)

Returns the collateral price of one book at which the account reaches the liquidation threshold, with every other book held fixed. Returns 0 when the other books alone cover the debt or when the account holds none of this collateral.

Price of bookId (1e36) at which this account hits LT, other books held fixed.

Input parameters

Name	Type	Description
account	`address`	The account to check.
bookId	`uint16`	The book whose price is solved for.

Return values

Type	Description
`uint256`	Price in the oracle’s 1e36 convention (loan units per collateral unit, scaled by 1e36).

debtOf

function debtOf(address account, uint16 bookId) external view returns (uint256)

Returns the account’s current debt in one book, including interest accrued up to the current block that has not yet been written to storage. Input parameters

Name	Type	Description
account	`address`	The account to check.
bookId	`uint16`	The book to check.

Return values

Type	Description
`uint256`	Debt in USDG native units, rounded up.

booksOf

function booksOf(address account) external view returns (uint16[] memory)

Lists the books in which the account holds collateral or debt. A book is removed from the list once both are zero. Input parameters

Name	Type	Description
account	`address`	The account to check.

Return values

Type	Description
`uint16[]`	Array of book ids. Order is not stable across removals.

Events

SupplyCollateral

event SupplyCollateral(
    address indexed account,
    uint16 indexed bookId,
    uint256 amount
)

Fires when collateral is credited to an account in a book.

WithdrawCollateral

event WithdrawCollateral(
    address indexed account,
    uint16 indexed bookId,
    uint256 amount
)

Fires when collateral leaves an account’s book.

Borrow

event Borrow(
    address indexed account,
    uint16 indexed bookId,
    uint256 amount
)

Fires when USDG debt is added to an account in a book.

Repay

event Repay(
    address indexed account,
    uint16 indexed bookId,
    uint256 amount
)

Fires when debt is reduced by a repay, with the amount actually paid.

AccrueInterest

event AccrueInterest(
    uint16 indexed bookId,
    uint256 interest,
    uint256 reserve,
    uint256 index
)

Fires when a book’s index advances, with the interest, the reserve slice, and the new index.

Liquidate

event Liquidate(
    address indexed account,
    uint16 indexed bookId,
    address indexed liquidator,
    uint256 repayAmount
)

Fires after a liquidation through LiquidationModule, with the repay amount the liquidator requested.

BadDebt

event BadDebt(address indexed account, uint256 amount)

Fires when an account’s leftover debt is written off and socialized to the pool.

Pause

event Pause(address indexed guardian)

Fires when the guardian turns the pause on.

Unpause

event Unpause(address indexed guardian)

Fires when the guardian turns the pause off.

OperatorSet

event OperatorSet(
    address indexed account,
    address indexed operator,
    bool approved
)

Fires when an operator is granted or revoked, by call or by signature.

Deleverage

event Deleverage(
    address indexed account,
    uint16 indexed fromBook,
    uint16 repayBook,
    uint256 collateral,
    uint256 repaid
)

Fires after a deleverage, with the collateral released and the USDG repaid.

Errors

ZeroAddress

error ZeroAddress()

A required address argument was the zero address.

ZeroAmount

error ZeroAmount()

An amount was zero, or a repay or deleverage found nothing to repay.

UnknownBook

error UnknownBook(uint16 id)

The book id does not exist in RiskRegistry.

Paused

error Paused()

The guardian pause blocks borrow, withdrawCollateral, and liquidate.

RegimeBlocked

error RegimeBlocked(Regime regime)

The book’s oracle regime does not allow the action. Borrow and withdraw need LIVE; liquidate needs LIVE or DARK.

BorrowingDisabled

error BorrowingDisabled()

The book’s borrowingEnabled flag is off.

CapExceeded

error CapExceeded()

The borrow would push the book’s total debt above its borrow cap.

IssuerCapExceeded

error IssuerCapExceeded()

The borrow would push the issuer’s aggregate debt above its issuer cap.

Unhealthy

error Unhealthy()

The action would leave the account below the line (borrow uses LTV, withdraw and deleverage use the liquidation threshold).

InsufficientCollateral

error InsufficientCollateral()

The requested collateral amount exceeds the account’s balance in that book.

NotGuardian

error NotGuardian()

Only the guardian can pause or unpause.

NotModule

error NotModule()

Only LiquidationModule can call applyLiquidation and realizeBadDebt.

NotLiquidatable

error NotLiquidatable()

The account’s health is at or above 1e18.

StillCollateralized

error StillCollateralized()

realizeBadDebt was called while the account still holds collateral.

NotOperator

error NotOperator()

The caller is neither the account nor an approved operator.

Expired

error Expired()

The signature deadline has passed.

InvalidSignature

error InvalidSignature()

The recovered signer does not match the account.

​Write methods

​pause

​unpause

​setOperator

​setOperatorWithSig

​supplyCollateral

​supplyCollateral

​withdrawCollateral

​withdrawCollateral

​borrow

​borrow

​repay

​repay

​deleverage

​liquidate

​applyLiquidation

​realizeBadDebt

​accrueInterest

​Read methods

​usdWithdrawPaused

​health

​maxBorrow

​liquidationPrice

​debtOf

​booksOf

​Events

​SupplyCollateral

​WithdrawCollateral

​Borrow

​Repay

​AccrueInterest

​Liquidate

​BadDebt

​Pause

​Unpause

​OperatorSet

​Deleverage

​Errors

​ZeroAddress

​ZeroAmount

​UnknownBook

​Paused

​RegimeBlocked

​BorrowingDisabled

​CapExceeded

​IssuerCapExceeded

​Unhealthy

​InsufficientCollateral

​NotGuardian

​NotModule

​NotLiquidatable

​StillCollateralized

​NotOperator

​Expired

​InvalidSignature

Write methods

pause

unpause

setOperator

setOperatorWithSig

supplyCollateral

supplyCollateral

withdrawCollateral

withdrawCollateral

borrow

borrow

repay

repay

deleverage

liquidate

applyLiquidation

realizeBadDebt

accrueInterest

Read methods

usdWithdrawPaused

health

maxBorrow

liquidationPrice

debtOf

booksOf

Events

SupplyCollateral

WithdrawCollateral

Borrow

Repay

AccrueInterest

Liquidate

BadDebt

Pause

Unpause

OperatorSet

Deleverage

Errors

ZeroAddress

ZeroAmount

UnknownBook

Paused

RegimeBlocked

BorrowingDisabled

CapExceeded

IssuerCapExceeded

Unhealthy

InsufficientCollateral

NotGuardian

NotModule

NotLiquidatable

StillCollateralized

NotOperator

Expired

InvalidSignature