Overview

No Soroban contract here can be upgraded in place — there is no admin, no upgrade(), and peer addresses are frozen at initialize. So v2 was never a patch. It went out as a deploy to new addresses, with a new storage layout on the certificate itself, behind a new SDK major with regenerated bindings. v1 is not reachable from this site any more: the addresses rendered here are v2's, and v1's are simply gone from the deployment record.

Why there is a v2 at all

v1 makes one trustless claim — that a certificate's reserve is short — and an adversarial review plus the integration harness found that the claim did not hold as built, and that the settlement around it paid the wrong people. The whole revision comes out of two findings.

The reserve was pooled. The challenge manager asked the vault for its balance with no certificate argument, and the vault kept one balance for everything. Any deposit backed every certificate. That defeats the only trustless proof the protocol has, and it is the reason v2 re-keys reserve accounting by certificate rather than patching the comparison.

Manufacturing a true proof paid. v1 slashed the auditor's entire stake and sent 80% of it to an address the challenger named. A colluding operator named itself and walked off with the auditor's bond. The arithmetic was never the weak part; the payout was.

Everything else follows from fixing those two, plus one principle stated below.

The principle everything rests on

A separate, deliberately undeployable contract — spend-probe — exists to pin one sentence down before the rest was written:

A proof establishes that the covenant was broken. It does not establish that anyone was harmed. Compensation is driven by proven harm, capped by collateral. The counter is evidence, never a payout trigger.

If you read one page in this section, read The payment router and the spend counter, which is where that sentence is earned.

What v2 adds

A PaymentRouter: a SEP-41 token wrapping USDC, holding an agent's operating float in custody and metering every routed payment against the certificate. It makes BoundExceeded and ExpiredCertificate provable from on-chain state instead of from an arbiter's judgement — and, because of the principle above, it makes both of them settle without slashing anyone.

A claim window. A first challenge no longer settles; it opens 72 hours during which any party may file against the same certificate, and settlement runs once at the close over everything admitted. Ordering inside the window is worth nothing.

A cure path. The predicate is evaluated at filing, so an operator cannot flip it and pocket the bond — but an operator who genuinely fixes the problem before the window closes gets a Cured outcome and returns the challenger's bond in full.

Per-certificate stake allocation, so an auditor prices each certificate separately and one bad certificate cannot destroy their book, settled by one uniform waterfall that draws only on the operator's own reserve to compensate anyone and sends slashed stake only to a treasury.

A PremiumVault: coverage priced on the bound and the certificate's duration, accruing straight-line to the auditor as yield on their allocation.

Custody controls — a per-certificate float cap, an operator kill switch, and a clawback — with a written threat model behind them.

It has been reviewed adversarially, and that changed it

The set was written by several agents each reviewing only its own contract, so it was given a pass over the seams where the pieces meet. Four attacks were demonstrated in the cross-contract harness and all four are closed — none of them by a patch, and each one changed a mechanism these pages describe. A trustless proof now compensates no victim at all; nothing may be filed once a certificate's settlement deadline has passed; an arbiter-gated claim freezes nothing; and the arbiter may add to a predicate but never contradict it. What each fix cost is stated where it belongs, and again in what v2 still does not do.

What v2 does not fix

The five disclosed defects do not all go away, and the ones that survive are worth naming here rather than at the bottom of a page nobody scrolls to.

Reading the v2 sources rather than the design notes: the shared reserve balance is fixed — the vault keys balance, lock and unlock by certificate id. The certificate hijack is fixed — publish now requires the agent's signature as well as the operator's, so bonding consent is mutual, and the cost is that publishing takes two signatures collected into one transaction. Storage lifetime is now managed — every v2 contract carries a TTL threshold and extension and bumps the entries it writes, which the v1 contracts never did.

The fee escrow is unchanged and still pays out once ever. It is simply not on the settlement path, and the premium economy was built as a separate contract rather than an extension of it, precisely because a singleton whose released flag never resets cannot serve many certificates. initialize is still unauthenticated on every contract, guarded against a second call and nothing more. The v2 deploy relies on winning that race the same way v1's did.

Anyone reading this section as "v2 fixes everything" should stop at that paragraph. What v2 still does not do is the rest of the list, and it is not optional reading.