Contracts on Soroban
The contracts are written in Rust with Soroban SDK 28 and deployed as WebAssembly. Function-by-function references are in Contracts.
Numbers
| Quantity | Type | Scale | Example |
|---|---|---|---|
| USDC amounts | i128 | 7 decimals | 100 USDC = 1,000,000,000 |
| Exchange rates | u64 | 6 decimals | 11.20 = 11,200,000 |
| Rates and fees | u32 | millionths | 1.75% = 17,500 |
| Basis points | u32 | 10,000 = 100% | 2% = 200 |
All arithmetic is checked for overflow, and every division rounds down, so no one is ever charged a fraction more than the formula.
Storage
| Soroban storage | Holds | Lifetime |
|---|---|---|
| Instance | Settings: owner, fees, oracle, pricing key, counters | Renewed on every call |
| Persistent | Pools, underwriter balances, protection contracts, funders, withdrawals | 20,000 ledgers (about 28 hours), renewed on use and by maintain_storage |
| Temporary | Used quote nonces | 200 ledgers, just longer than a quote's 120-second life |
maintain_storage is permissionless: a keeper job renews pools, contracts and balances in batches so long contracts never expire from state.
Authorization
| Action | Who must authorize |
|---|---|
buy_protection | The buyer, plus a quote signed by the pricing key (ed25519, checked in the contract) |
deposit, request_withdrawal, execute_withdrawal | The underwriter |
create_pool and pool settings | The pool's creator |
claim_payout | The contract's buyer |
settle_position, maintain_storage | Anyone |
| Fees, pricing key, pause, upgrades | The contract owner |
A user's authorization covers the exact call and the token transfer inside it, so the sponsor that submits the transaction cannot change the amount or the recipient.
Business account contracts
Business accounts use OpenZeppelin's deployed account code and policies, plus one BlockFinaX policy. Testnet addresses:
| Contract | Testnet | Source |
|---|---|---|
| Account code (stellar-accounts 0.8.0) | Code hash c514d35ea67eaea9bfc1fb3327854c0c06111bc1ddebd4fe217c504c1004b9e1 | OpenZeppelin |
| WebAuthn verifier | CC7EKIHQP3TN4CARQDND6CEOY2UXLWWC2X5GHTD5NLAT7BG5GPZIOM3F | OpenZeppelin |
| Threshold policy | CAZ2WFUDXGX265LOEARFEOYYUL6F4BYWXZLGUAWZNJY3MRFPNLSZVS4S | OpenZeppelin |
| Spending-limit policy | CC3CEYQAP6NPNFIYSWL5MVZRCPJZGWX4XO7WDEJOUVGO2FZX5OONYPA5 | OpenZeppelin |
| Transfer allow-list policy | CA5BPWHNBVIPNQ5J66UBZDSW2J4VITR7OJLU6IVHOHR6ESE2JM2H4WKQ (code hash a0dae506129f12276e0922c04b9e7b0786f173e61d2b72aa7907e3fa1f66850c) | BlockFinaX |
The transfer allow-list policy guards the operators' USDC rule. It allows only transfer from the business account to a listed recipient (the pools), requires at least one of the rule's signers, and refuses approve and every other token function. It has no admin, no constructor and no upgrade function. Its state is keyed by account and rule, so one deployment serves every business. Errors are numbered 4100 to 4111.
Cross-contract calls
The currency pool calls the USDC contract to move money and the pool oracle to read the agreed rate. Before settling, it reads the oracle's configuration and refuses an oracle whose rules are looser than its own minimum: at least 2 agreeing operators, at most 1% apart, prices at most 15 minutes old, 5 minutes between an operator's submissions.
Events
Every change publishes an event, read with Stellar RPC getEvents.
| Group | Events |
|---|---|
| Pools | PoolCreated, TenorSet, DurationRuleSet, StructuresSet, PoolSettingsSet |
| Underwriters | LiquidityAdded, WithdrawalRequested, WithdrawalCancelled, WithdrawalExecuted, CreatorEarningsWithdrawn |
| Protection | ProtectionPurchased, PositionSettled, PayoutClaimed |
| Protocol | MaxTenorDaysSet |
Upgrades
The owner can replace a contract's code in place; its address and storage stay. Before mainnet, ownership moves to a multisig with a public delay before upgrades take effect.