Overview
Five Soroban contracts, what each one owns, and who is allowed to call it.
Five Soroban (Rust) contracts on Stellar testnet. All value moves in USDC — the Circle Stellar Asset Contract.
| Contract | What it does | Address |
|---|---|---|
| Registry | Stores certificates. publish → attest → verify. | CBM2UAVZFUI2QGZIS35VB6P3W5FYC3HW3KV3E2AF6KFQDUMFIZPPAJWV |
| ReserveVault | Holds the locked USDC reserve that absorbs the worst case. | CDN6S5DKUCC4O33L3RGTTO4LYNJVPLPIYYZTUANPJJZYAHZCR32O4WFB |
| AuditorStaking | The auditor's own stake — slashable if the vouch is false. | CCSJTEXOJZ322XI5ZJF6YZ2IRLCRKNXTGHGK3ZLATKL6Y7CGQODS4VZB |
| ChallengeManager | Proves a short reserve on-chain, then slashes and compensates. | CANDUKOYQIMZDK4MUWHN6MKJI5ORY5R4BPBEQIOQQSINJYITMY47UNZH |
| FeeEscrow | The audit fee, released to the auditor on attestation. | CD4EZ5FCFC7D65OHBB5HHF6ASM4OCRGNAO6XQZQ5LKH4QB327SF5EYOF |
| USDC | The Circle Stellar Asset Contract. Every amount moves in this token. | CBIBCQ6EIQX3DU2SIJ3MFN7MQBNXBCETNLTFHNQOSTTLZDSGQLENPVWV |
How they fit together
┌──────────────────────────────────────────┐
│ Registry │
operator ─publish▶ publish() → attest() → verify() │
auditor ─attest─▶ on attest: locks the auditor's stake │
└──┬─────────────────┬──────────────────┬───┘
│ get_cert_* │ lock() │ invalidate()
▼ ▼ │
┌────────────────────────┐ ┌──────────────────────┐ │
│ ReserveVault │ │ AuditorStaking │ │
│ deposit / get_balance │ │ stake / lock / slash │ │
│ release_to_victim │ │ release (gated) │ │
└───────────┬────────────┘ └──────────┬───────────┘ │
│ release_to_victim │ slash │
└──────────┐ ┌────────┘ ┌──────────┘
▼ ▼ ▼
┌──────────────────────────────────────┐
│ ChallengeManager │
│ challenge() → resolve() │
│ proves InsufficientReserve, │
│ slashes and compensates in one tx │
└──────────────────────────────────────┘
FeeEscrow (audit fee, released on attestation) sits alongside.Two rules that shape everything
Amounts are fixed point. USDC has 7 decimals, so every amount is an i128 in
stroop-style fixed point: $1,500 is 1_500_0000000.
Authorization is by role, enforced in the contract. Several functions can only be
called by another contract — AuditorStaking.lock by the Registry, invalidate and
the slash/release paths by the ChallengeManager. The Auth column on each page says
who may call what; anything else reverts.
Verifying them yourself
Every address above links to stellar.expert. The vault's balance is a public read, so you never have to take a certificate's word for its reserve — see Deployments.