Initialise the Factory. Each *_wasm arg is the 32-byte WASM
hash of the corresponding contract template, uploaded via
env.deployer().upload_contract_wasm(...) in a deploy script.
These hashes are immutable for this Factory instance; updating
the templates requires deploying a new Factory.
fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
oracle_wasm: soroban_sdk::BytesN<32>,
pt_wasm: soroban_sdk::BytesN<32>,
yt_wasm: soroban_sdk::BytesN<32>,
amm_wasm: soroban_sdk::BytesN<32>,
ys_wasm: soroban_sdk::BytesN<32>,
)
Deploy a fresh five-contract market for (underlying, maturity).
Returns the YS address as the canonical "market handle".
V1: admin-gated. deployer is the operational caller recorded
in MarketMeta.deployer; admin auth is required separately.
When v2 flips to permissionless, remove the admin-auth line at
the PERMISSIONLESS_V2 marker.
Oracle params (max_delta_per_sync_wad, max_staleness_ledgers,
observation_window) are passed through to the Oracle's
__constructor. PT/YT cosmetic metadata is also caller-supplied
so a deploy script can produce vanity names like
"PT-bUSDC-DEC2026".
fn deploy_market(
env: soroban_sdk::Env,
deployer: soroban_sdk::Address,
underlying: soroban_sdk::Address,
blend_pool: soroban_sdk::Address,
maturity: u64,
scalar_root: i128,
fee_bps: u32,
tvl_cap: i128,
oracle_params: OracleParams,
token_meta: TokenMetadata,
) -> soroban_sdk::Address
Lookup the canonical YS address for (underlying, maturity).
fn market_address(
env: soroban_sdk::Env,
underlying: soroban_sdk::Address,
maturity: u64,
) -> Option
Lookup the full MarketMeta for (underlying, maturity).
fn get_market(
env: soroban_sdk::Env,
underlying: soroban_sdk::Address,
maturity: u64,
) -> Option
Lookup the YS address by registry index (0..market_count()).
fn get_market_by_index(
env: soroban_sdk::Env,
index: u32,
) -> Option
Lookup the full MarketMeta by YS address.
fn get_market_meta(
env: soroban_sdk::Env,
ys: soroban_sdk::Address,
) -> Option
Number of markets ever deployed.
fn market_count(env: soroban_sdk::Env) -> u32
Pending self-upgrade proposal, if any.
fn pending_upgrade(env: soroban_sdk::Env) -> Option
fn admin(env: soroban_sdk::Env) -> soroban_sdk::Address
fn is_paused(env: soroban_sdk::Env) -> bool
Pause the Factory. Halts deploy_market. Existing markets keep
running — they have their own pause surface.
fn pause(env: soroban_sdk::Env)
Unpause the Factory. Admin-only. The Factory pause only blocks new-market deployment, so there is no user-facing griefing surface that warrants a 48h timelock (unlike the per-market contracts, which use asymmetric unpause per ADR-002).
fn unpause(env: soroban_sdk::Env)
Propose a Factory self-upgrade. Records (new_wasm_hash, eta = now + 48h). Only one proposal can be open at a time; calling
this again overwrites the pending proposal and resets the eta.
fn propose_upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)
Execute a previously-proposed upgrade. Permissionless after eta
— anyone can prod, but the admin must have proposed. The
new_wasm_hash argument must match the pending proposal
exactly (defensive double-check against host-state confusion).
fn execute_upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)
Cancel an open upgrade proposal. Admin-only.
fn cancel_upgrade(env: soroban_sdk::Env)