RWA Debugger

Robinhood Chain · Stock Tokens

Find the integration bugs before your users do.

Point it at a repository and it reports the mistakes that make a Stock Token price wrong: corporate-action multipliers applied twice or not at all, oracle reads without a staleness guard, the wrong network, token addresses nothing validates.

Reads .ts, .tsx, .js and .sol files. Add /tree/branch to scan a branch other than the default. Press / to jump here.

or

Sent to the API, scanned and discarded — never stored or cached. Not for code you cannot share.
No repo handy?

The bug that looks like two bugs

The same multiplication, required here and forbidden there.

Both of these are one line of arithmetic. Which one is correct depends entirely on where the number came from — which is why the engine traces that before it decides anything.

GET /rhj/prices/{symbol} returns the raw underlying equity price. The multiplier is missing.

RH001 Wrong

const { bid, ask } = quote;
const price = (bid + ask) / 2;
// the share's price, not the token's

Fixed Correct

const { bid, ask } = quote;
const mid = (bid + ask) / 2;
const price = mid * currentMultiplier;

Skip it and you show the price of the underlying share. After a split the number is simply wrong.

latestRoundData() already includes the multiplier. Applying it again doubles the corporate action.

RH002 Wrong

const [, answer] = await feed.latestRoundData();
const price = answer * uiMultiplier / 1e18;
// the corporate action, applied twice

Fixed Correct

const [, answer] = await feed.latestRoundData();
const price = answer;
// already adjusted by the feed

Apply it again and a 2:1 split reports a price twice too high — silently, with no error to catch.

A regex for * multiplier flags the correct code in one column and misses the bug in the other. Both verdicts come out of the same rule engine, and both are wrong without provenance.

Live from the registry

The multiplier is not an edge case.

Read straight from /rhj/assets. Every token below already prices differently from its underlying share — each one is a number your code gets wrong if it skips the multiplier.

Reading the registry…

How it works

Detection is deterministic. The model only explains.

Every finding exists before a model sees it, and the report stands on its own if the model is unavailable.

1

Parse, then match

Source is read into a syntax tree and the rules match against it. Nothing is guessed, and no model is asked to look for bugs.

2

Trace where the value came from

A rule fires only when it can tell a raw REST quote from a Chainlink answer. That distinction is the whole difficulty, and it decides the verdict.

3

Explain, then check the explanation

A model drafts the patch, and what it returns is checked against the documented API surface. A fix that invents an endpoint is rejected, not shown.