Overview
Five Soroban contracts, what each one owns, and who is allowed to call it.
Five Soroban (Rust) contracts on Stellar testnet. All value moves in USDC — the Circle Stellar Asset Contract.
| Contract | What it does | Address |
|---|---|---|
| Registry | Stores certificates. publish → attest → verify. | CCJTY2VYHQZ7OQE6NX7QFL7JL766YMTNKGHZXGAPTPKV5IUS2AK5UREF |
| ReserveVault | Holds the locked USDC reserve that absorbs the worst case. | CD6VK2YUUZO5L5R76DNT3NQNWR2UCALPQ3T6STWAQSEY7Q6I5P4LAFC3 |
| AuditorStaking | The auditor's own stake — slashable if the vouch is false. | CBPUCSASKMQKRWJ7WUTQ6KUPX66QUBV2E6V4CQ46BI4ZLJSW6AFPR6RB |
| ChallengeManager | Three proofs decided from state alone, a 72-hour claim window, then settlement. | CAYEGPIHNDIEONWNKRF2UPTO32SXGFTLBQ2K4RPN2LCIGOOZYLYYYIHY |
| PaymentRouter | Meters an enrolled agent's spend per certificate — what BoundExceeded is proven from. | CA5OPBLVGNPAFNFHY3ATNZXJ72L3K4EG4RIQYOWOKESAN7C75DDMMCMJ |
| PremiumVault | Coverage priced on bound × duration, accruing to the auditor as yield. | CA5JT2IBPY7X4QZS65XY6YW2BXDUEFPZHXTNG2OCPCJTOM4DWEWEOHAF |
| FeeEscrow | Deployed but unused. Superseded by PremiumVault; kept rather than redeployed. | CAM3D5PTXQ4MEY45SGNUZZGNN2D6JXHSCFR3IM6S46KCPWERWJGDFXNI |
| USDC | The Circle Stellar Asset Contract. Every amount moves in this token. | CDIQ4564SFRCLBP2UL4Z5IBGEBDF2J5ISQVCTHN3F5SNVDXGSB5YEAMM |
How they fit together
┌──────────────────────────────────────────┐
│ Registry │
operator ─publish▶ publish() → attest() → verify() │
auditor ─attest─▶ on attest: locks the auditor's stake │
└──┬─────────────────┬──────────────────┬───┘
│ get_cert_* │ lock() │ invalidate()
▼ ▼ │
┌────────────────────────┐ ┌──────────────────────┐ │
│ ReserveVault │ │ AuditorStaking │ │
│ deposit / get_balance │ │ stake / lock / slash │ │
│ release_to_victim │ │ release (gated) │ │
└───────────┬────────────┘ └──────────┬───────────┘ │
│ release_to_victim │ slash │
└──────────┐ ┌────────┘ ┌──────────┘
▼ ▼ ▼
┌──────────────────────────────────────┐
│ ChallengeManager │
│ challenge() → resolve() │
│ proves InsufficientReserve, │
│ slashes and compensates in one tx │
└──────────────────────────────────────┘
FeeEscrow (audit fee, released on attestation) sits alongside.Two rules that shape everything
Amounts are fixed point. USDC has 7 decimals, so every amount is an i128 in
stroop-style fixed point: $1,500 is 1_500_0000000.
Authorization is by role, enforced in the contract. Several functions can only be
called by another contract — AuditorStaking.lock by the Registry, invalidate and
the slash/release paths by the ChallengeManager. The Auth column on each page says
who may call what; anything else reverts.
Verifying them yourself
Every address above links to stellar.expert. The vault's balance is a public read, so you never have to take a certificate's word for its reserve — see Deployments.