How Prism is built

Prism does not run a matching engine and does not custody funds. It is a client and a thin server tier that route user intent to two venues that already exist on Robinhood Chain. Which venue handles an order depends entirely on the product surface the user is on.

The two paths share almost nothing except the wallet session and the chain. Perps state lives inside Lighter and is read through our own API proxy. Spot state lives in contract storage and is read through RPC and a block explorer. That split explains most of the architecture below.

Browser
  React 19 client  ·  wagmi + viem  ·  Privy session
      │
      ├── WebSocket ─────────────────► Lighter stream    (order books, mark price)
      ├── WebSocket ─────────────────► Hyperliquid ws    (fallback mids, L2 book)
      ├── JSON-RPC ──────────────────► Robinhood Chain   (quotes, balances, swaps)
      │
      ▼
Next.js server  (App Router route handlers on Vercel)
  /api/lighter/*   proxy and auth boundary
  /api/markets     ticker aggregation, 15s revalidate
  /api/candles     OHLCV aggregation, 15s revalidate
  /api/trades      Blockscout indexing
  /api/contact     feedback intake, Upstash Redis
      │
      ▼
Python signer service  (FastAPI, private network)
  encrypted key store  ·  lighter-sdk SignerClient
      │
      ▼
Lighter API  (api.rh.lighter.xyz)
      │
      ▼
Robinhood Chain  (Arbitrum Orbit L2, chain id 4663)

Reads that are public and latency-sensitive skip the server entirely and stream straight into the browser. Anything needing a secret, a signature, or an API key is forced through the server tiers. The Python service is the only component that ever holds a Lighter private key.

Routing is deliberately flat. There is no landing page: / redirects to /trade from next.config.ts, so a cold visit lands straight on the leverage terminal.

The design system lives in one file. src/app/globals.css declares the neutral canvas, the pastel spectrum, and the functional market colours as CSS custom properties, which Tailwind v4 then exposes as utilities. Product surfaces stay neutral and the spectrum is reserved for the logo and brand moments, so colour never competes with price data.

The chain is defined once and imported everywhere, so the wagmi transport, the Privy supported-chain list, and the explorer link helpers cannot drift apart. The RPC endpoint is overridable per deployment through NEXT_PUBLIC_RH_RPC_URL without touching code.

RootLayout
  └─ Providers
       └─ PrivyProvider            login: wallet · chains: [Robinhood Chain]
            └─ QueryClientProvider
                 └─ WagmiProvider  transport: http, batched
                      └─ app

Privy handles connection and, for users arriving without a wallet, provisions an embedded one on both Ethereum and Solana. The external wallets offered are MetaMask, Phantom, and Temple. Robinhood Chain is the only supported chain, so a user on the wrong network gets an explicit switch prompt instead of a silent failure.

The whole wallet layer is conditional. src/components/Providers.tsx checks for a real NEXT_PUBLIC_PRIVY_APP_ID and, when it is missing or still the placeholder value, skips mounting Privy and wagmi entirely. A usePrivyEnabled() context lets each surface degrade into a read-only state rather than crash, which is what keeps the app buildable and previewable without credentials.

Perpetuals run on Lighter, reached at https://api.rh.lighter.xyz. Orders must be signed with a Lighter API private key. That key cannot live in the browser, and using it from a Vercel function would mean running the Python lighter-sdk inside a Node runtime, so it lives in a dedicated FastAPI service instead.

src/lib/lighter.ts       browser client, calls our own API only
        ▼
src/app/api/lighter/*    Next.js route handlers, force-dynamic
        ▼                x-signer-secret header
lighter-service/         FastAPI, holds encrypted keys, signs
        ▼                lighter-sdk SignerClient
api.rh.lighter.xyz       order book, matching, settlement

The browser never learns a Lighter hostname for anything requiring authentication. Every function in src/lib/lighter.ts targets a local route, and the server forwards it on with a shared secret header.

Everything except /api/lighter/orderbooks is marked force-dynamic, because caching a position or a balance across users would be a correctness bug rather than an optimisation. The order books route is public and identical for everyone, so it is the one endpoint allowed to sit behind a 300 second revalidate.

This is the least obvious part of the system and the part that most shapes how trading feels. Lighter separates the wallet that owns an account from the API key that signs its orders, which is what lets Prism offer click-to-trade without a signature prompt on every order.

1. Deposit creates the account

   The user approves and deposits USDG into the Lighter zk contract on Robinhood Chain. That first deposit is what mints their account_index. Until it lands there is nothing to trade against.

2. The server generates an API keypair

   The signer calls create_api_key() and immediately encrypts the private half. Only the public key and the key index are returned to the browser.

3. The wallet authorises the key

   The signer builds a ChangePubKey message and the user signs it with a gasless personal_sign. That signature is attached as an L1 signature and submitted, binding the new key to the account.

4. Confirmation polls for propagation

   Registration is not instant. The app retries confirmation up to five times at two second intervals before reporting failure.

5. Trading runs server-side

   From here every order, cancel, close, and TP/SL is signed by the service using the stored key. The wallet is only needed again for deposits, withdrawals, and transfers.

The hosted Uniswap Trading API does not route this chain, so the entire spot path is on-chain. Quotes come from Quoter contracts over RPC and fills go through the Universal Router. This is slower to quote than a hosted router, but it puts no third party in the trade path.

Quoting is debounced at 400ms and probes several fee tiers, keeping whichever pool returns the best output. Because a quote is a contract read rather than a cached price, it is re-fetched immediately before execution so the slippage bound is computed against fresh state.

The platform fee is off by default. Setting NEXT_PUBLIC_SWAP_FEE_BPS above zero alongside a valid NEXT_PUBLIC_FEE_RECIPIENT turns it on, capped at 500 basis points, and the fee is skimmed from the output currency on-chain rather than collected separately.

Prism lists markets that not every venue carries, so the data layer is built around fallbacks rather than a single source. Resolution order differs by asset class: crypto prefers Lighter and then Hyperliquid, while real-world assets fall through to Yahoo Finance.

WebSocket connections are singletons. One socket per upstream is shared across every component that subscribes, so switching markets changes a subscription rather than opening a new connection.

Order placement gets special handling. Lighter needs a moment to index a new fill, so after a successful write the client fires an immediate refresh plus retries at 1.5 and 4 seconds. Without that, a filled order appears to vanish for a polling cycle.

Perps history comes from Lighter directly. Spot history has no such service, so /api/trades reconstructs it from Blockscout, issuing three parallel queries per address: normal transactions, token transfers, and internal transactions.

1. Filter down to real swaps

   Keep only transactions sent to the Universal Router whose calldata begins with the execute selector 0x3593564c, and drop anything that reverted.

2. Rebuild both legs

   Combine native value sent, ERC-20 transfers in and out, and internal transactions carrying unwrapped ETH back to the user.

3. Classify direction

   Whether an equity token was the input or the output determines buy versus sell. ETH and USDG pairs are classified on their own axis.

4. Price and aggregate

   USDG is treated as one dollar and ETH is priced from the live feed, which yields average entry, average exit, and notional volume.

The client polls this every 30 seconds and additionally retries at 3, 8, and 15 seconds after a swap completes, because the explorer needs time to index a transaction the user just watched confirm.

Addresses and ABIs are centralised in src/lib/rhContracts.ts, so no component hardcodes an address inline.

The tradeable token set is native ETH, WETH, and USDG alongside 139 tokenized equities and index ETFs, all standard ERC-20s with 18 decimals except USDG. Native ETH is represented by the canonical Uniswap sentinel address rather than by a contract.

Issuers mint many look-alike contracts with identical symbols and names, so a listing is only added once its address has been quoted against the live v4 pools and the implied price checked against the underlying market. Address correctness is a safety property here, not a detail.

• Server-side signing is a deliberate trade-off. It buys click-to-trade with no wallet popup per order, at the cost of the service holding a key that can place orders. That key cannot move funds off the account: withdrawals require a fresh wallet signature.
• Slippage is enforced twice. The client computes a bound and the signer independently re-prices against the live mark before signing, so a tampered client cannot submit an unbounded market order.
• Account reads are never cached. Every account-scoped route is force-dynamic, which removes any possibility of one user being served another user balance from an edge cache.
• Feedback intake is rate limited. The contact endpoint sits behind Upstash rate limiting, and the admin dashboard is protected by both a secret path and credentials.