Credit protocol · BNB Chain
Credit that flows from what you earn.
Borrow against the payments you receive. Repay automatically, a slice at a time, as they arrive. No collateral.
The problem
Crypto lending is a pawn shop.
TODAY
$150
Lock $150 of Bitcoin, borrow $100. It works — but only for people who are already rich. 88% of crypto holders say they'd take a loan. 14% do.
RILL
Rill lends against income instead. A shop receiving $8,000 a month has never had access to credit anywhere. It should.
The insight
Don't underwrite the borrower. Underwrite the pipe.
Observable
Inflows are on-chain, timestamped, and impossible to fake in aggregate without real cost.
Prioritised
The split happens before funds reach the borrower's spendable balance. Repayment is not a decision.
Aligned
The credit limit is a function of observed flow, so diverting flow to evade repayment shrinks your own line.
How it works
One payment, from the customer's hand to your limit.
Scroll to move the payment down the pipe. Scroll back up to run it in reverse.
STATION 1
A customer pays
Someone settles an invoice in stablecoin, the way they already do. Nothing about their side changes.
$120.00 · invoice #4417
STATION 2
It arrives at your Router
The Router is a contract you own — it is simply your receiving address. With no loan outstanding, 100% passes straight through.
RillRouter · minimal proxy
STATION 3
The split
Ten percent peels off to the loan. Ninety percent carries on to you. One transaction, no instruction from either of you.
balance $1,412.00
STATION 4
You get paid
Your share lands in your wallet, spendable, in the same block as the payment.
STATION 5
Your limit grows
Every clean cycle raises the line and lowers the rate. The record is yours and portable.
Credit limit
$2,000 → $2,000
1 · A customer pays
A gold payment of $120.00 enters the pipe — invoice #4417.
2 · It arrives at your Router
The Router is a contract you own. With no loan outstanding, 100% passes straight through.
3 · The split
$12.00 to the loan, $108.00 to you. Loan balance falls from $1,412.00 to $1,400.00.
4 · You get paid
$108.00 lands in your wallet in 0.45s for $0.004.
5 · Your limit grows
The credit limit extends from $2,000 to $2,140.
Proven
This is not a new idea. It's a proven one, on a new rail.
Shopify Capital and Square Capital have run this exact mechanism for over a decade, at billions of dollars of scale. Repayment is 10–20% of daily sales, deducted automatically. Priced as a factor rate. Deductions pause when sales stop. No collateral, no credit check.
It has never existed on a payment rail that settles in stablecoins. That is the whole opportunity.
Every row matches but the last. The mechanism is not the risk — the rail is what is new.
What you'd get
Move the slider. Watch the underwriting think.
$8,000
$500$50,000
How many customers pay you?
Concentration is the risk. The same income from one payer is one cancelled contract away from zero, so the line is a fraction of the size.
Estimated credit limit
$2,400
Split share
10%
Time to clear
91 days
Total repaid · factor 1.15
$2,760
Effective annualised
60%
What this costs, next to the alternatives
Rill · factor 1.1560% annualised
Merchant cash advance40–80%
Informal lenders in these markets60–120%
This is not cheap money. It is faster, fairer and safer than what these merchants use today — no collateral, no personal guarantee, and no penalty when sales stop.
Illustrative. Not an offer of credit.
When it goes wrong
A missed payment is a stopped flow, not a refusal.
There is no collateral to seize and no one to sue, so the design assumes it. Step through what happens as a merchant's income falls away.
weekly inflow · 16 weeks
No collateral is seized. No debt collector calls. No penalty rate. If your business has a bad month, the loan slows down with you.
Why BNB Chain
Splitting every payment is only viable where the split is free.
Four figures about the chain, not about Rill. Each one is a precondition the mechanism needs to exist at all.
0.45s
Block time
The split lands inside the same payment, not as a later batch job.
$0.004
Fee per transaction
Zero-fee stablecoin transfers make routing every payment economically free.
$4.65B
USD1 supply
Around 15% of stablecoins on the chain. Loans are denominated in it.
See the machine
Nothing here is a mock-up you can't inspect.
This is the contract that does the splitting. It is not deployed yet — when it is, the address and the audit report go directly above it, and this paragraph says so instead.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
/// @notice Per-merchant receiving address. Splits every inbound
/// transfer between the credit line and the merchant,
/// inside the payer's own transaction.
contract RillRouter {
address public immutable registry;
address public merchant;
address public creditLine;
event Routed(
address token,
uint256 amount,
uint256 toLoan,
uint256 toMerchant
);
function route(address token, uint256 amount) external {
uint256 bps = creditLine == address(0)
? 0
: ICreditLine(creditLine).shareBps();
// No loan outstanding -> 100% passes through untouched.
uint256 toLoan = (amount * bps) / 10_000;
uint256 toMerchant = amount - toLoan;
if (toLoan > 0) {
IERC20(token).transfer(creditLine, toLoan);
ICreditLine(creditLine).repay(token, toLoan);
}
IERC20(token).transfer(merchant, toMerchant);
emit Routed(token, amount, toLoan, toMerchant);
}
/// @dev shareBps is bounded by the CreditLine: never below the
/// schedule floor, never above SPLIT_CEILING (5_000 = 50%).
function shareBps() external view returns (uint256) {
return creditLine == address(0)
? 0
: ICreditLine(creditLine).shareBps();
}
}
Run the split
Fire a $120 payment at the Router and watch it divide. Simulated locally — at launch this button sends a real testnet transaction and returns the hash.
payment in—
to loan · 10%—
to merchant—
settled in—
gas paid—
tx hashno contract deployed
Block time and fee are BNB Chain figures, not measurements of Rill.
The credit model
Most protocols hide the model. Here it is.
Limit = k · MedianMonthlyInflow · Stability · Diversity · Tenure
k · 0.25 → 0.60
Advance rate. 0.25 at origination, rising with clean history.
Stability · 0 → 1
Coefficient of variation across weeks. 1 is perfectly even.
Diversity · 0 → 1
Herfindahl index over payers. Near 0 is a single payer.
Tenure · 0 → 1
Ramps over 90 days of observed flow. Caps new accounts.
Full derivation and every bound: docs · score formula
$8,000/MO FROM 40 PAYERS
$2,400
Forty independent payers. Losing any one of them changes almost nothing.
$8,000/MO FROM 1 PAYER
≈ $500
Same income, one cancelled contract away from zero. The formula prices that directly.
The loss waterfall
Where the losses land, and the exact point senior starts hurting.
A $10,000,000 book, 20% of it junior capital. Drag the default rate and watch junior absorb until it can't.
0.0%
20.0% break 25%
Junior · $2,000,000
$2,000,000 intact · 100%
Senior · $8,000,000
$8,000,000 intact · 100%
Expected credit loss is modelled at 6–8%. Senior takes its first dollar of loss at a 20.0% default rate — roughly three times the modelled band.
Parameters and states
Every knob, its range, and who can turn it.
CreditLine states
Full reference: docs · parameters · docs · state machine
The plan
Four rungs, in order, each one earning the next.
Distribution on BNB Chain is a ladder, not a door. Each rung is worth less for its money than for the relationship it opens, and none of them can be skipped.
01
Within 30 days
BNB Chain Builder Grant
The money isn't the point. The grant puts Rill in the ecosystem CRM with an assigned human contact — and every later rung runs through that person.
Deployed
$500k monthly
Per project
up to $200k
Window
1st–7th, monthly
Selected
10 projects a month
How to write it Milestone-shaped, not a business plan: Router → indexer → dashboard → 50 advances.
Free lever Denominate advances in USD1. Growing USD1 is a live ecosystem priority, so it gives the contact a reason to champion Rill internally. Costs nothing.
02
Months 3–6
MVB
MVB selects for traction, so apply with a signed partner LOI rather than a deck. The warm introductions are what this rung is for — not the cheque.
Run by
YZi Labs + CMC Labs
Applications
rolling
Investment
YZi, at the end
Basis
performance
03
Months 6–12
Inside Binance Pay, sideways
The move most people miss: Binance Pay explicitly works through PSP partners. Partner with a PSP that is already a Binance Pay partner, and Rill operates inside the Binance Pay ecosystem without Binance ever having to say yes.
Route
via a PSP partner
Approval needed
none from Binance
04
Month 18+
Binance Pay, direct
A real BD team exists and runs a real process. They will not touch a pre-revenue counterparty; with 500 repaid advances behind us, they will.
BD process
prospect → pitch → structure → KYB
Bar
not pre-revenue
What clears it
500 repaid advances
Pitch their metric, not ours Working capital → more inventory → more sales → more GMV per merchant, and stickier merchants. Zero credit risk to them.
Never Never pitch “we want your data.”
Timings are targets from a standing start, not commitments. Nothing on this ladder has been secured yet, and this section will carry dates and outcomes as it does.
For payment platforms
Shopify Capital for stablecoin payment platforms.
We give your merchants working capital against the volume you already process — and the credit risk never touches your balance sheet.
You bring
- ·The payment flow you already process
- ·Your existing merchants
- ·One settlement hook
We bring
- ·The capital
- ·The credit model and underwriting
- ·The credit risk — entirely on our balance sheet, never yours
Your merchants get
- ·An advance, inside your dashboard
- ·No new signup, no new app
- ·Repayment that pauses when sales do
The integration surface
One settlement hook is the entire integration surface. You call the Router instead of the merchant wallet. The payer side is unchanged, and a merchant with no advance outstanding has 100% pass straight through.
Questions a payments COO asks first
What is the integration surface?
One settlement hook. When you settle a merchant, you call the Router instead of their wallet. Nothing else in your stack changes, and the payer side is untouched.
Whose balance sheet holds the credit risk?
Ours. Entirely, and at every stage. You are never the lender of record, you never hold the receivable, and a default never reaches your books.
What currency does it settle in?
USD1 by default. USDT where local liquidity requires it. One currency end to end — no conversion step inside the split.
What do we earn?
A revenue share on the finance margin of every advance drawn by your merchants. Paid monthly, on volume you already process.
What does it cost to build?
A settlement hook and a card in your merchant dashboard. Days of engineering, not a quarter of roadmap.
What happens when a merchant's sales stop?
Repayment stops with them. There is no penalty rate, no collections and no recourse to you.
Your merchants ask you for financing. Today you tell them no.
Pre-launch, and talking to a small number of platforms before the first pilot corridor. A real conversation, not a waitlist.
[ Talk to us ]hello@rill.xyz
Four pieces, and nothing else.
The Meter watches the flow. The Score turns the flow into a limit. The Split collects. The Vault absorbs the losses. Everything else in the protocol is plumbing between these four.
01
The Meter
Indexes every inbound transfer to a merchant's Router and extracts five signals. Nothing here is self-reported.
median_monthly_inflow
Median, not mean — one enormous month can't lift the line.
flow_stability
Coefficient of variation across weeks. Even flow scores higher.
counterparty_diversity
Herfindahl index over unique payers. Many payers, low concentration.
tenure
Days of continuous observed flow. Ramps over 90 days.
seasonality
A quiet month in a known seasonal pattern is not a warning sign.
02
The Score
One formula, four terms, no discretion. Drag any term and watch the limit move.
Limit = k · MedianMonthlyInflow · Stability · Diversity · Tenure
$1,700
Protocol-wide advance rate. 0.25 at origination, up to 0.60 with clean history.
1 is perfectly even weekly flow. Lumpy income scores lower.
1 is many independent payers. Near 0 is a single payer.
Ramps over 90 days of observation. Caps new accounts.
MedianMonthlyInflow held at $8,000. Limit is also hard-capped per account, per corridor and per cohort.
40 PAYERS · 6 MONTHS
$8,000/mo received
$2,000–2,900
1 PAYER · 6 MONTHS
$8,000/mo received
≈ $500
03
The Split
The Router is a minimal proxy the merchant uses as their receiving address. Raise the share to clear faster; it cannot go below the schedule floor, and 50% is the ceiling.
10%
10% floor50% ceiling
Draw$2,400.00
Per $120 payment$12.00
Cleared in13 weeks
Interest paid$79
outstanding balance · weeks
04
The Vault
An ERC-4626 vault with two tranches. Losses hit junior first and only reach senior when junior is exhausted. Pour losses in and watch the waterfall.
$0
Junior · target 20%+
$2,000,000 intact · 100%
First loss. Paid last on interest.
Senior · target ~9%
$8,000,000 intact · 100%
Protected by junior. Paid first on interest.
Junior absorbs the first $2,000,000 of losses. Expected credit loss is modelled at 6–8%.
For merchants and freelancers
You already have the thing we lend against.
It's the payments your customers already send you. Route them through an address you own, and after a couple of months there's a credit line waiting.
01
Connect
You get a Rill Router address — a contract you own. Put it on your invoices and your QR code and take payments as normal. Free, and no loan involved.
02
Observe
For 60 to 90 days, Rill watches what comes in. A live Rill Score builds in your dashboard. Still no loan, and nothing to sign.
03
Offer
A credit line appears. Typically 20–35% of your median monthly inflow to start with.
04
Draw
Pull any amount up to the limit, in USD1 or USDT. Instant. No approval, no application, no documents.
05
Repay
Every incoming payment is split the instant it lands: 10% to the loan, 90% to you, same transaction. There is no due date, no bill, nothing to remember and nothing to miss.
06
Grow
Clean repayment raises the limit each cycle and lowers the rate. The Score is yours and portable to other protocols.
"What if I have a bad month?"
Then the loan has a bad month with you. Because repayment is a share of what arrives, a slow month repays less — automatically, with no request and no fee.
If your inflow drops more than 60% for a month, the line moves to Slow Mode: the split share is reduced, the term is extended, and there is no penalty rate.
If it stops entirely and stays stopped, the loan is eventually written off against the lenders' junior tranche. No collateral is seized, no collector calls, and no court is involved. Your downside is capped and you can know it in advance. the risk model in the docs says the same thing without softening it.
For depositors
Short duration, collected at source.
Deposit USD1 into the Rill Vault. Loans are 30–90 day effective duration and repay from payment flow rather than from a borrower's decision to pay, so capital turns four to eight times a year. Yields below are targets, shown next to the risk that produces them.
Senior tranche
~9%
target APY
Capital-protected by the junior tranche and paid first on interest. Takes a loss only once junior is exhausted.
Junior tranche
20%+
target APY
First loss on every default, paid last on interest. This is equity risk on a book of unsecured small-business credit.
The waterfall
What the book would show
The protocol is pre-launch. There is no live book yet, so these are the fields the dashboard will publish rather than results we're claiming.
Active borrowers
—
Flow coverage ratio
—
Corridor mix
—
Realised losses
—
Modelled economics
Illustrative model, not a forecast. Withdrawals respect a queue tied to outstanding loan duration.
Technical reference
Six contracts, one formula, one state machine. Parameters listed with their ranges and defaults. Nothing here is deployed; addresses will be published at launch.
Architecture
Contract reference
RillRouter.sol
Per-merchant minimal proxy. Splits inbound transfers between the credit line and the merchant wallet in one transaction. Passes 100% through when no loan is outstanding.
RillRegistry.sol
Router ↔ merchant ↔ credit line mapping. Single source of truth for resolution and for router deployment.
CreditLine.sol
Draw, accrue, repay, and the state machine: Healthy → Slow → Dormant → Default. Holds the limit attestation and the schedule floor.
RillVault.sol
ERC-4626 vault with senior and junior tranches, interest waterfall, loss waterfall, and a withdrawal queue that respects outstanding duration.
ScoreAttestor
Off-chain Meter to on-chain limit attestations, multi-signer. The Meter computes; the attestor signs; the CreditLine enforces.
RillScore (SBT)
Portable, non-transferable credit record. Readable by other protocols so a clean history is worth more intact than the amount it could be used to steal.
Score formula
Limit = k · MedianMonthlyInflow · Stability · Diversity · Tenure
k = 0.25 at origination, rises to 0.60 with clean history
Stability = 0 … 1 (1 = perfectly even weekly flow)
Diversity = 0 … 1 (1 = many independent payers; ~0 = one payer)
Tenure = 0 … 1 (ramps over 90 days, caps new accounts)
Limit is also hard-capped per account, per corridor and per cohort.
Worked: a merchant taking a steady $8,000/month from 40 different customers over six months lands at a limit of roughly $2,000–2,900. The same $8,000/month from a single payer lands near $500. Concentration is the risk, and the formula prices it directly.
CreditLine state machine
Router integration
Nothing on the payer's side changes. A payment to the Router address is an ordinary ERC-20 transfer.
// Resolve the merchant's Router — this is their receiving address.
const router = await registry.routerOf(merchant);
// Pay it like any other address. $120 of USD1, 6 decimals.
await usd1.transfer(router, 120_000000n);
// Inside the same transaction the Router splits:
// shareBps / 10_000 -> CreditLine.repay()
// remainder -> merchant wallet
//
// With no loan outstanding, shareBps == 0 and everything passes through.
Parameters
Risk model
Five things would materially change whether this works, with the mitigation each one relies on. They are listed here as reference rather than reassurance — if one reads as unconvincing, that is useful, and we would like to hear it.
Router adoption
Merchants need a reason to route payments through Rill before any advance exists. Without that, there is no flow to underwrite.
MITIGATION Phase 0 is a free payments product in its own right — instant settlement, invoicing, bookkeeping export. It has to be worth using with no advance attached.
Concentrated or self-dealt flow
Volume can be cycled through a Router to manufacture an apparent trading history, and an advance drawn against it.
MITIGATION Counterparty diversity is a first-class term in the Score, tenure ramps across 90 days, new accounts are capped, and wash patterns are detectable because the flow is on-chain.
Correlated exposure
A single currency, corridor or large payer can weaken a whole cohort of merchants at once, rather than one at a time.
MITIGATION Per-corridor and per-payer concentration caps, with the junior tranche sized for a cohort failing rather than for an average month.
Platform competition
The platforms that already process this volume could finance it themselves, and would start with the data and the relationship.
MITIGATION Rill stays multi-rail across PSPs, x402 and direct wallets, and is positioned to be the credit layer a platform integrates rather than a competitor it has to displace.
Regulation
This is lending, in real jurisdictions, to real businesses.
MITIGATION Licensing per corridor is carried as a cost line in the model rather than treated as something to resolve later.
What a borrower's downside actually is
No collateral is seized, no collector is involved and no court is engaged at any stage. The protocol is not in production, and no figure on this site describes a live loan book.
Glossary
Security
Unaudited. Undeployed. Stated plainly.
This page will carry audit reports and deployed addresses. Today it carries the status as it actually is, and the policy that applies the moment code goes on a public network.
Audit status
unaudited · not deployed
No contract in this protocol has been reviewed by a third party or deployed to a public network. Two independent audits and a public testnet period are prerequisites for mainnet, not follow-ups to it.
Reporting a vulnerability
security@rill.xyz
Mail that address with a description and, if you have one, a reproduction. Acknowledgement within 48 hours. We work to a 90-day coordinated disclosure window and will agree a shorter one where users are exposed.
Do not test against third-party funds. There are none to test against yet, which is the only reason this paragraph is short.
Bug bounty
Opens with the first audited deployment, scaled to value at risk rather than to a fixed table. Scope, tiers and payout ceilings will be published here before any mainnet contract holds a deposit.
About
Credit is a discipline, not a feature.
Rill exists because the people who most need working capital are the ones collateral-based lending structurally cannot reach. Underwriting income instead of assets is a well-understood discipline in payments finance. What is new is that the income is now observable on a public ledger, in real time, without asking anyone to trust a statement.
Placeholder — awaiting real names
The brief requires named people with credentials in credit risk, payments or protocol engineering, and forbids inventing them. Below is the shape of the section with the bar each slot has to clear.
CREDIT RISK
[ name · role ]
Where they underwrote, what book size, what loss rates they carried through a downturn.
PROTOCOL ENGINEERING
[ name · role ]
Audited contracts shipped, value held, incidents handled. Repo links, not adjectives.
PAYMENTS
[ name · role ]
Merchant distribution and settlement experience in the corridors Rill starts in.
What we will not do
Publish a number we cannot point at on-chain.
Show a partner logo, testimonial or user count that does not exist.
Lend against flow we have not observed for long enough to price.
Describe a target yield without the risk that produces it on the same screen.
hello@rill.xyz · security@rill.xyz · the risk model
Changelog
Dated entries, or it isn't a changelog.
Template — no real entries yet
The entry format is below, with the change types it covers. Dates and contents come from you; nothing here claims work already done.