> For the complete documentation index, see [llms.txt](https://sadboy-1.gitbook.io/sadboy/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sadboy-1.gitbook.io/sadboy/robinhoods-sadboy-hidden-mascot.md).
# Robinhood’s “SadBoy” — hidden mascot
A complete verification of the public asset trail behind Robinhood’s SadBoy character.
Robinhood’s login page ships a component called **SadBoy**. This page traces it through a public JavaScript bundle, a Webpack module, and the site’s CDN configuration.
The public SVG asset identified by this walkthrough.
### A complete, line-by-line verification
Robinhood’s login page ships a component called SadBoy. Its source can be traced through a minified JavaScript bundle, a numbered Webpack module, the runtime public path, and a page-level CDN setting to one specific SVG file.
The final asset URL is:
View SadBoy
{% hint style="info" %}
This investigation uses public frontend files only. It requires no account, credentials, or two-factor authentication code.
{% endhint %}
This is not a vulnerability or customer-data leak. It is a normal static interface asset.
### Source files
The verification uses four public resources:
* [Robinhood login page](https://robinhood.com/login)
* [Application bundle](https://cdn.robinhood.com/assets/generated_assets/webapp/App-ce7994c39af65b1592d2.js)
* [Webpack runtime](https://cdn.robinhood.com/assets/generated_assets/webapp/runtime-d7f19601c6b049dac8d8.js)
* [Final SVG asset](https://cdn.robinhood.com/assets/generated_assets/webapp/c1ff2304b65b2ef77c01.svg)
{% hint style="warning" %}
The JavaScript filenames contain deployment hashes. They may change after a Robinhood release.
{% endhint %}
The filenames above were verified on July 15, 2026.
### Step 1: Confirm the page loads the bundles
The HTML returned by the [login page](https://robinhood.com/login) references both the runtime and application bundles:
```html
```
This connects the inspected files to Robinhood’s actual login page.
### Step 2: Find the SadBoy component
Search the application bundle for `SadBoy`:
```javascript
SadBoy:()=>(0,c.tZ)("img",{alt:"Sad boy",src:te})
```
Even in minified code, the important parts remain clear:
* `SadBoy` names the component function.
* `(0,c.tZ)(...)` is a minified JSX-runtime call.
* `"img"` creates an HTML image element.
* `alt:"Sad boy"` supplies alternative text.
* `src:te` stores the image source in `te`.
The trail begins:
```
SadBoy → src: te
```
### Step 3: Resolve `te`
The same bundle defines `te`:
```javascript
te=new URL(l(102953),l.b).toString()
```
* `l` is Webpack’s local name for `__webpack_require__`.
* `l(102953)` retrieves module `102953`.
* `l.b` is Webpack’s base URI.
* `new URL(...).toString()` normalizes the result into a URL string.
The runtime defines the base URI:
```javascript
__webpack_require__.b=document.baseURI||self.location.href
```
The trail now reads:
```
SadBoy → src: te → l(102953)
```
### Step 4: Inspect module `102953`
The application bundle contains this module:
```javascript
102953:(o,a,l)=>{
"use strict";
o.exports=l.p+"c1ff2304b65b2ef77c01.svg"
}
```
In standard Webpack terms:
* `o` is the current module object.
* `o.exports` is the exported value.
* `l` is `__webpack_require__`.
* `l.p` is Webpack’s public path.
The module exports:
```
l(102953) → l.p + "c1ff2304b65b2ef77c01.svg"
```
This identifies the file. The remaining step is resolving the complete CDN directory.
### Step 5: Find the initial public path
The runtime bundle defines:
```javascript
__webpack_require__.p="/assets/generated_assets/webapp/"
```
Because `l` is the same `__webpack_require__` function inside the minified modules:
```
l.p = /assets/generated_assets/webapp/
```
This proves the path, but not the `cdn.robinhood.com` domain. Robinhood adds that host during initialization.
### Step 6: Find the CDN setting
The login page defines this global value:
```javascript
window.cdnURL = "https:\u002F\u002Fcdn.robinhood.com";
```
`\u002F` represents `/`, so the decoded value is:
```javascript
window.cdnURL = "https://cdn.robinhood.com";
```
The application bundle exposes it through environment configuration:
```javascript
get CDN_URL(){
return assertEnvConst("cdnURL")
}
```
Therefore:
```
CDN_URL = https://cdn.robinhood.com
```
### Step 7: Prepend the CDN domain
The application bundle includes module `434962`:
```javascript
434962:(o,a,l)=>{
"use strict";
var c=l(265059),s=l(948412);
(0,c.oW)()&&(l.p="".concat(s.j.CDN_URL).concat(l.p))
}
```
The key operation is:
```javascript
l.p = s.j.CDN_URL + l.p
```
The application invokes the module during startup:
```javascript
...,l(540858),l(434962),l(364100),...
```
Substituting the known values:
```
s.j.CDN_URL = https://cdn.robinhood.com
l.p = /assets/generated_assets/webapp/
l.p = https://cdn.robinhood.com/assets/generated_assets/webapp/
```
The runtime provides the path. The initialization module prepends the CDN domain.
### Step 8: Construct the final URL
Module `102953` exports:
```
l.p + "c1ff2304b65b2ef77c01.svg"
```
Substitute the complete public path:
```
https://cdn.robinhood.com/assets/generated_assets/webapp/
+ c1ff2304b65b2ef77c01.svg
= https://cdn.robinhood.com/assets/generated_assets/webapp/c1ff2304b65b2ef77c01.svg
```
That URL returns the final SVG asset.
### The Robinhood SadBoy SVG asset
The public SVG depicts a sad green robot.
At the time of verification, the server responded with:
```
HTTP/2 200
Content-Type: image/svg+xml
```
### The complete evidence chain
```
SadBoy
→ src: te
→ new URL(l(102953), l.b).toString()
→ module 102953
→ l.p + "c1ff2304b65b2ef77c01.svg"
→ CDN_URL + "/assets/generated_assets/webapp/"
→ https://cdn.robinhood.com/assets/generated_assets/webapp/c1ff2304b65b2ef77c01.svg
```
For this implementation, the public code directly confirms:
```
SadBoy → c1ff2304b65b2ef77c01.svg
```
### What this proves
* Robinhood’s public frontend bundle contains a component named `SadBoy`.
* This implementation obtains its source through `te` and module `102953`.
* Module `102953` exports `c1ff2304b65b2ef77c01.svg`.
* Robinhood configures Webpack’s public path to use its CDN.
* The resulting SVG is public and depicts a sad green robot.
This does not prove:
* A security vulnerability
* A leak of customer information
* An ability to access another person’s account
* A hidden financial or trading mechanism
### Technical caveat
The application bundle contains another `SadBoy` property with a different imported asset. The precise conclusion remains narrow:
> The `SadBoy` implementation using `src:te` resolves through `te` and module `102953` to `c1ff2304b65b2ef77c01.svg`.
This character appears to be a named error-state mascot within Robinhood’s app.
Verified against Robinhood’s public resources on July 15, 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://sadboy-1.gitbook.io/sadboy/robinhoods-sadboy-hidden-mascot.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
