● Base Sepolia · chain 84532 Deployed at block 46315822 Contracts source-verified 14 of 14 Transactions executed 73 Base mainnet 0
Boundline Start a pilot
Embedded credit for Coinbase tokenized stocks on Base

Credit against tokenized stocks,
with the boundary built in.

Boundline is the credit-operations layer wallets and fintechs plug in to offer USDC credit against Coinbase tokenized stocks on Base. Deterministic risk, one obligation registry, protection and recovery, and an execution boundary nothing crosses without authority.

Start a pilot See the evidence

Console below: generated local fixtures, no transactions. Lane 2 is live on Base Sepolia — 73 transactions, 14 verified contracts, Base mainnet 0.

Boundline console — partner and risk● sandbox · generated partner · 0 executed
Risk operationsApplications, accounts, obligations, liens, routes, incidents, and evidence from one partner-scoped index.
RefreshNew application
APPLICATIONS21 in review
ACCOUNTS2partner scoped
EXPOSURE, USDC182.00generated sandbox
ACTIVE LIENS2one registry
OPEN INCIDENTS1risk reduction available
Applications2Accounts2Obligations2Liens2Routes3Incidents1Governance1Evidence1
RECORDSTATEAMOUNTPROVENANCESEQ
BF-GEN-10680xbb0028695…479f7edManual review85.00GENERATED · local index2
BF-GEN-10420xd1a360472…53f6109Approved, sandbox100.00GENERATED · local index1
OBLIGATIONSTATEDEBTHEALTH · ROUTELIEN
O-1042account BF-GEN-1042Active, local100.001.62× · R1 · GENERATEDL1
O-1068account BF-GEN-1068Protection pending82.001.18× · R1 · new borrow blockedL2
WHO IT IS FOR

Three seats at the table, one state underneath.

Every surface reads the same partner-scoped index. A borrower, a risk desk, and a capital provider never see numbers that disagree, and none of them can see a number whose origin it cannot state.

WALLETS AND FINTECHS

Embed credit without building a credit desk.

A typed API, an SDK, and a drop-in widget that runs preflight and quote for your users. Your brand and distribution; our risk, registry, and recovery.

  • Eligibility and quote in one call, with reason codes
  • Widget states for every outcome, including the blocked ones
  • Webhooks and labelled statements for your back office
RISK AND OPERATIONS

A console that shows the whole lifecycle.

Applications, accounts, obligations, liens, routes, incidents, governance, and evidence, with search, comparison, and drawers over one read model.

  • Concentration, caps, and control health at a glance
  • Incidents block new risk and keep risk reduction open
  • Every action carries its execution classification
CAPITAL PROVIDERS

Exposure, reserves, and recovery you can reconcile.

Supplied, deployed, reserved, and available capital with utilization, indicative rates, losses, bad debt, and recovery, exported as a labelled statement.

  • Five-way recovery accounting that must sum exactly
  • Reserve and fee bounds enforced in the coordinator
  • Withdrawal state that says when it is not available
INTEGRATION

One call to quote. One iframe to ship.

Partners integrate through a versioned HTTP API with a typed client, or embed the credit widget directly. Every response carries a correlation id, an idempotency binding, a quote hash, and its execution classification.

// typed partner client, local sandbox const quote = await client.quotePortfolio({ accountId: "0xf1dae3d0…5f2515f4", requestedBorrowUsdMicros: "100000000", sessionMode: "REGULAR", requestNonce: nonce }); // → decision: "APPROVE", reasonCodes: ["CONCENTRATION_CHARGE_APPLIED"], // quoteHash: "0x877a…0edf", parameterHash, dataHash, expiresAt, // signingAuthority: "NONE", broadcastEnabled: false <iframe src="https://sandbox.boundline.xyz/widget" title="Boundline credit preflight" loading="lazy" sandbox="allow-scripts allow-same-origin" referrerpolicy="no-referrer"></iframe>
BOUNDLINE · PREFLIGHTSANDBOX
Requested credit 100 USDC
Market session Regular
Reproduce quote
APPROVE 310.00 USDC limitconcentration charge applied · quote 0x877a…0edf · prepared, unsigned
THE SYSTEM

The parts you would otherwise build yourself.

Boundline sits between a partner's users and the lending venues on Base. It owns the parts that are neither a wallet nor a lending pool: decisioning, obligation state, protection, and recovery.

OBLIGATION REGISTRY

One collateral lot, at most one active obligation.

Every lien is written to a single cross-venue registry before any draw is quoted. A second lien against a lot that is already pledged is rejected before state changes, not caught after.

Lot A2 · NVDAc200.00 units · generated valuation 310.00
Lien L1 → Route R1RESERVED
Lien L2 → Route R2BLOCKED · DOUBLE PLEDGE
Assurance scenario: two individually valid liens target one lot. Expected block, actual block.
DETERMINISTIC RISK

Same inputs, same limit, with a hash to prove it.

Sessions, oracle staleness, issuer powers, liquidity, and concentration set the limit as integers. Capacity rounds down, charges round up, and every quote binds its parameter and data hashes.

METAc
31.4%
NVDAc
31.4%
GOOGLc
19.5%
AAPLc
17.6%
Soft limit 40% per name. Past the line a draw pays CONCENTRATION_CHARGE_APPLIED; past the hard limit it is CONCENTRATION_HARD_LIMIT_EXCEEDED.
THE 24/5 FEED PROBLEM

The token trades all weekend. The feed does not.

Equity feeds freeze when Nasdaq closes while the tokens keep trading. New borrowing waits for a fresh feed and a regular session. Repayment and deleverage never wait.

token
feed
MonTueWedThuFriSatSun
Stale feed:new borrow BLOCKrepay ALLOWdeleverage ALLOW
Assurance scenarios: stale-oracle borrow and repay, closed-market block and buffer. All four pass, expected equals actual.
PROTECTION AND RECOVERY

Incidents block new risk. They never block risk reduction.

Price gaps, stale oracles, venue failures, and issuer pauses raise an orthogonal incident state. Recovery is bounded and reconciles five ways to the unit: debt, fees, reserve, borrower remainder, and loss.

Net proceeds
100.0
Debt retired
82.0
Fees, bounded
6.0
Reserve
4.0
Borrower remainder
8.0
Loss
0.0
100.0 = 82.0 + 6.0 + 4.0 + 8.0 + 0.0 · illustrative units · the coordinator rejects any split that does not sum exactly
ARCHITECTURE

One path. Authority stops at the line.

The same versioned packages run in production code and in the assurance lab. A request moves left to right. The red line is where signing, broadcast, and funds would begin, and nothing here crosses it.

01 · REQUESTPartner request
Exact schema, scope, correlation ididempotency · nonce · freshness
Eligibility and policyjurisdiction · issuer · session
02 · DECIDEPreflight and portfolio quote
B20 registry, 13 instrumentspause · policy · multiplier · announcements
Deterministic risk enginesessions · staleness · concentration · liquidity
Quote authorization hashparameter hash · data hash · expiry
03 · RECORDRegistry, lien, accounting
One obligation registryno double pledge, by construction
Credit hub and position controllerexact shares · caps · zero-interest local facility
04 · PROTECTProtection and recovery
Incident state machinegap · stale · venue · pause
Bounded recoverypartial deleverage · auction fallback · five-way accounting
Evidence recordcontent addressed · replayable
05 · EXECUTEBase
Morpho and committed facilitylive Morpho Blue market 0x3a0c23…474149 on Base Sepolia · adapter 0x508348…1DD158 · Aave V4 when it ships on Base
Signing and broadcastdisabled in the partner path · Base mainnet executed = 0
Live capital and custodyopen gates
PARTNER-SCOPED READ MODEL · 25 EVENTS · REPLAY ROOT 0xc263…5216same packages in production and assuranceBASE · CHAIN 8453 · LANE 1

Shared logic, not a mock

The risk engine, obligation model, and recovery coordinator that answer in the sandbox are the same versioned packages the production path imports. Disagreement between surfaces is a defect, not a display choice.

Fail closed on unknowns

Unknown fields, stale provenance, unlisted routes, cross-partner reads, and replayed nonces are rejected before any state is touched. Twenty-three source mutants that weaken those checks are killed by independent probes.

Evidence with a label

Every number carries FACT, SNAPSHOT, HYPOTHESIS, GENERATED, or OPEN. Generated evidence can never be relabelled as fact, and the validators refuse a package that tries.

PROOF

We don't claim. We label.

Six reviewed local checkpoints and six recovery drills with exact five-way accounting, each with a validator and content-addressed evidence a reviewer reproduces from the repository. Generated evidence can never be relabelled as fact, and a lane-2 observation is never relabelled as a mainnet one.

18/18assurance scenarios, expected equals actualinternal deterministic corpus
23/23source mutants killed by independent probesauthorization · replay · provenance · sdk
14/14contracts live and source-verified on Base Sepolialane 2 · blockscout · sourcify ↗
0transactions, signatures, or transfers on Base mainnetlane 4 not permitted · authority none · 12 gates open
Open the evidence
WHY NOW

The asset shipped. The venues are listed. The loan books are empty.

Tokenized stocks arrived on Base with issuer controls built into the chain. The credit side has venues but no operator, and no partner-facing layer that carries the obligation state, the policy, and the recovery.

Coinbase tokenized stocks went live on Base on 24 August 2026 as B20 tokens, available in eligible jurisdictions outside the US.

base.org/stocks · fact

Aave, Morpho, and Euler are listed as lend-and-borrow venues, and the B20 loan books on Base still sit near zero.

on-chain read · 3 September 2026 · snapshot

Feeds are 24/5 and total-return. Base's own guidance: never settle or liquidate against a frozen feed. That rule is the product.

docs.base.org · fact

Base's request for builders asks for lending models that take future yield into account, including self-repaying structures and other borrow products around assets that keep generating value.

blog.base.org · 1 September 2026
DESIGN PARTNERS

Run the pilot on your distribution.

We are taking design partners for the Base Sepolia pilot. Bring a wallet or fintech audience in an eligible jurisdiction. We bring the credit operations, the evidence, and the line.

Talk to usSee the evidence

WHAT IS REAL TODAY

  • ✓Six reviewed local checkpoints, validators, and content-addressed evidence, reproducible from the repository.
  • ✓Base Sepolia deployment with self-issued B20 test stocks: 14 addresses with verified source on Sourcify, Blockscout and Basescan, 73 executed transactions, an executed and closed Morpho route.
  • ✓Public credit lifecycle on Base Sepolia, run sepolia-004: 54 steps, 34 transactions, an issuer pause mid-loan on a public explorer, new risk refused, repayment allowed. Independently reconciled: PASS, 54/54 steps, 8/8 invariants.
  • ✓Public sandbox and partner console at sandbox.boundline.xyz, bound to the same manifest, read-only against the chain.
  • ✓Read-only Base mainnet fork canary against live Coinbase token state, and a forced-price liquidation of a real position rehearsed on a mainnet fork.
  • ·Open: forced collateral sale on a live venue, external partner trace, live capital, legal eligibility, key custody, independent security review.

NEXT, IN ORDER · PLANNED

  • 1A first design partner running their own users through the sandbox.
  • 2Recovery execution on a live venue under a forced price, on Base Sepolia first.
  • 3Independent security review of the lane-2 contracts.
  • 4A bounded mainnet pilot in an eligible jurisdiction, gated on legal eligibility and committed capital.