On this page
Build conviction from the contracts up.
A concise technical reference for Woodlark’s fixed-term lending model, isolated position vaults, risk controls and operational launch gates.
Overview
Woodlark is a non-custodial, overcollateralized lending protocol designed for Robinhood Chain. Borrowers lock registry-approved ERC-20 collateral and receive a fixed principal in WETH for a fixed duration. Liquidity providers receive vault shares representing a proportional claim on pool assets.
The borrower can see maturity, fee and gross repayment before signing. There is no utilization-driven rate change during an active loan.
Core guarantees
- Onchain contracts remain the source of truth for collateral, debt and settlement.
- Every position’s collateral and automated-exit proceeds are isolated in its own minimal vault.
- Repayment and collateral top-up remain available when risk-increasing actions are paused.
- The interface never embeds production token or contract addresses; deployment manifests provide them.
Architecture
The system separates accounting, collateral custody, price validation and execution. This narrows contract responsibilities and makes critical invariants easier to verify.
Offchain services
The indexer, read API and permissionless keeper workers improve usability but cannot change protocol state without satisfying the same contract checks as any wallet. If every service stops, users can still repay, add collateral and withdraw available liquidity directly through verified contracts.
Borrowing lifecycle
Protocol configuration defines explicit terms per collateral category. The initial specification uses three tiers for RWA and volatile assets.
Supported position operations
Deposit collateral, choose a tier and receive net WETH proceeds.
Return all outstanding gross principal and recover remaining collateral.
Reduce debt without closing; the position health factor improves immediately.
Add collateral at any time, including during a protective pause.
Pay the configured extension fee and move maturity by the selected tier term.
previewOpenLoan(borrower, collateral, collateralAmount, principal, tierId)
openLoan(collateral, collateralAmount, principal, tierId, expectedTermsHash, minCollateralPrice, minPayout, deadline)
repay(loanId, amount, useVaultProceeds)
repayFull(loanId, useVaultProceeds)
addCollateral(loanId, amount)
extend(loanId, maxCapitalizedFee, minDuration, deadline)
liquidate(loanId)After maturity plus the configured grace period, a position can be liquidated even if its price-based health factor remains above one.
Automated exits
A borrower may attach price-conditioned instructions to collateral held by the loan vault. Execution is permissionless, but valid only when fresh conservative pricing, route and minimum-output constraints all pass.
Take profit
Sell when the validated price reaches or exceeds a target.
Stop-limit
Attempt a sale at or below the trigger without ever accepting less than the borrower-signed minimum output.
Bracket · OCO
Pair one profit and one loss threshold; the first valid execution cancels the other.
Ladder
Split up to eight slices across distinct targets; total allocation cannot exceed 100%.
Trailing stop
Track a verified high-water mark and execute after the configured drawdown.
Cancel or update
The borrower can cancel an active instruction or update its minimum output onchain.
Every downside order is a stop-limit: a downward gap or insufficient WETH route below the signed minimum output leaves the order active and collateral unsold until it can execute or the borrower cancels it.
Execution proceeds can remain inside the loan vault or be applied to debt according to the borrower-signed instruction. Keepers have no custody and no privileged withdrawal path.
WETH liquidity vault
The lending pool uses ERC-4626-style conversion and preview accounting. Its state-changing ABI deliberately requires a deadline and an explicit minimum or maximum execution bound. Deposits mint wlWETH; withdrawals burn it subject to idle liquidity. totalAssets includes idle WETH, live loan principal and realized losses so share value reflects the full pool.
wlWETH uses 24 decimals onchain. Interfaces convert raw balances by 10²⁴ and may round the rendered label, but transaction builders and accounting always use the original integer amount.
- Deposit and exit calls include deadline plus slippage bounds.
- Native ETH helpers wrap or unwrap only at the transaction boundary.
maxWithdrawcannot exceed idle pool liquidity.- Virtual shares/assets mitigate first-depositor and donation attacks.
- No administrative method may withdraw lender principal.
Risk model
Price-sensitive actions use the lower of validated primary and optional secondary price adapters. Production can configure these as independent sources such as a reference feed and manipulation-resistant DEX TWAP; adapter identities are explicit deployment configuration. Deviations, staleness and sequencer health are hard gates.
Failure posture
Collateral admission
No discovered token is hardcoded or auto-enabled. Its canonical Robinhood Chain address, decimals, transfer behaviour, independent price sources and executable WETH depth must pass registry review and fork tests before timelocked activation.
Credit model
Scores start at 500 and remain between 300 and 850. Only qualifying principal can affect the score, and positive events are rate-limited.
Benefits remain bounded by the market’s absolute LTV and fee constraints. Reputation cannot bypass collateral or liquidity caps.
Contract system
LARK tokenImplemented fixed 1B LARK supply and Permit; voting is not implemented.
Address pending deploymentWETHLendingVaultPool share accounting, idle liquidity and fee accrual.
Address pending deploymentLoanManagerPosition lifecycle, principal, settlement and price/expiry liquidation.
Address pending deploymentLoanVaultMinimal isolated custody per position.
Address pending deploymentCollateralRegistryAssets, categories, tiers, caps and oracle configuration.
Address pending deploymentOracleRouterFreshness, deviation and conservative-price validation.
Address pending deploymentExitOrderManagerConditional exit storage and permissionless execution.
Address pending deploymentCreditRegistryBounded score events and borrower tier.
Address pending deploymentProtocol timelockImplemented immutable-delay executor; target launch delay is configured at deployment.
Address pending deploymentTokenVestingWalletImplemented immutable cliff plus linear release for contributor allocations.
Address pending deploymentToken voting and standalone fee routing remain proposed work. They are deliberately excluded from this deployed-contract inventory until implementation and tests exist.
Production addresses will be published as a signed deployment manifest and linked to verified explorer source. Any interface showing an address before that manifest is provisional.
REST API
The web application uses a read API and transaction-builder endpoints. Builders return unsigned calldata and simulation metadata; they never custody keys or cosign user actions.
GET /v1/health
GET /v1/protocol
GET /v1/markets
GET /v1/tokens
GET /v1/tiers
GET /v1/quotes/borrow
GET /v1/positions/:wallet
GET /v1/credit/:wallet
GET /v1/stats
GET /v1/activity
GET /v1/status
POST /v1/transactions/borrow
POST /v1/transactions/repay
POST /v1/transactions/partial-repay
POST /v1/transactions/top-up
POST /v1/transactions/extend
POST /v1/transactions/deposit
POST /v1/transactions/withdraw
POST /v1/transactions/exit-order
POST /v1/transactions/cancel-exit-order
POST /v1/transactions/update-exit-order
POST /v1/transactions/liquidateEvery builder response includes the expected chain ID, destination, calldata, value, quote expiry and a simulation result. The wallet must reject any mismatch.
LARK token
LARK implements a fixed genesis supply of one billion tokens plus Permit. It has no post-genesis mint, holder freeze or transfer tax. Voting and a 48-hour governance timelock remain proposed future capabilities, not deployed features.
Standalone fee routing and token rewards are also future proposals. They require implementation, tests, legal review and audit before the interface may present them as active. Token price, public launch mechanics and initial liquidity remain intentionally unset.
View the token designDeployment gates
Passing tests is necessary, not sufficient, for a system that holds value. The mainnet broadcaster remains blocked until independent and operational evidence exists.
- 1Testnet proving
Deploy, verify source, execute complete lifecycle tests and reconcile indexed state.
- 2Independent audit
Resolve every critical/high finding and re-audit fixes.
- 3Live integrations
Verify the selected official collateral contract, two oracle paths, WETH route and executable liquidation depth.
- 4Operational rehearsal
Exercise multisig, timelock, pause, RPC failure and recovery runbooks.
- 5Capped launch
Begin with conservative pool and market caps, then observe before expanding.
Brand assets
Woodlark’s original mark combines a wing-like W with a leaf form. The visual system uses deep forest, moss, bark and chalk. Do not combine it with third-party marks or imply affiliation.
Woodlark Finance is not affiliated with or endorsed by Robinhood Markets, Inc. “Robinhood” is used only to identify the underlying public blockchain network.