Claim a one-to-one drop to the chosen payout. Submittable by ANYONE (a relayer paying
the fee): the funds go ONLY to payout, and only if the link key signed exactly this
(contract, network, link, payout). No require_auth — the Ed25519 signature IS the
authorization, which is what makes it walletless + gasless.
fn claim(
env: soroban_sdk::Env,
link: soroban_sdk::BytesN<32>,
payout: soroban_sdk::Address,
sig: soroban_sdk::BytesN<64>,
) -> Result<(), soroban_sdk::Error>Emergency brake: stops NEW escrow only (deposit/create_drop). Exits never pause.
fn pause(env: soroban_sdk::Env, caller: soroban_sdk::Address)fn paused(env: soroban_sdk::Env) -> boolSender locks amount USDC for whoever holds the link secret for link (its Ed25519
public key). expiry is a unix timestamp; after it, an unclaimed drop is reclaimable.
Pause gates ONLY the two escrow-creating entrypoints (deposit + create_drop) —
claim/claim_share/reclaim/reclaim_pool are NEVER pausable, so every escrowed
dollar can always exit to its rightful owner in any state (invariant 14).
fn deposit(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
link: soroban_sdk::BytesN<32>,
amount: i128,
expiry: u64,
) -> Result<(), soroban_sdk::Error>After expiry, the original sender reclaims an unclaimed drop (the 7-day safety net).
fn reclaim(
env: soroban_sdk::Env,
link: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>fn unpause(env: soroban_sdk::Env, caller: soroban_sdk::Address)Swap the contract's wasm (storage is preserved; DropEntry/PoolEntry versioned enums
guarantee old records stay readable). Owner-gated; on mainnet the owner is a
timelock+multisig, and this entrypoint is deleted entirely in the post-audit
immutability upgrade.
fn upgrade(
env: soroban_sdk::Env,
new_wasm_hash: soroban_sdk::BytesN<32>,
operator: soroban_sdk::Address,
)fn get_drop(env: soroban_sdk::Env, link: soroban_sdk::BytesN<32>) -> Optionfn get_pool(env: soroban_sdk::Env, link: soroban_sdk::BytesN<32>) -> Optionfn get_owner(env: soroban_sdk::Env) -> OptionClaim one share of a group pool to payout. Submittable by anyone (relayer). Each
distinct payout may claim at most once; funds go only to the link-signed payout.
fn claim_share(
env: soroban_sdk::Env,
link: soroban_sdk::BytesN<32>,
payout: soroban_sdk::Address,
sig: soroban_sdk::BytesN<64>,
) -> Result<(), soroban_sdk::Error>Fund a pool of slots equal shares behind link. amount USDC is pulled from from;
each of the first slots distinct payouts claims amount / slots. Pause-gated like
deposit (new escrow only — exits are never pausable, invariant 14).
fn create_drop(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
link: soroban_sdk::BytesN<32>,
amount: i128,
slots: u32,
expiry: u64,
) -> Result<(), soroban_sdk::Error>After expiry, the sender reclaims any unclaimed shares (and dust) of a pool.
fn reclaim_pool(
env: soroban_sdk::Env,
link: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>Deploy-time init: pin the ONE USDC SAC token this escrow escrows, and set the owner (the upgrade/pause authority — a timelock/multisig on mainnet; renounced to immutable after audit). The owner has NO path that moves escrowed funds (invariant 13).
fn __constructor(
env: soroban_sdk::Env,
token: soroban_sdk::Address,
owner: soroban_sdk::Address,
)The EXACT bytes the link key must sign for a claim. Exposed as a view so the client can build the identical message (or simulate this) — signature parity is critical. Layout: tag(1) ++ network_id(32) ++ contract_address_xdr ++ link_pubkey(32) ++ payout_xdr Binding contract + network blocks cross-contract / cross-network replay.
fn claim_message(
env: soroban_sdk::Env,
kind: u32,
link: soroban_sdk::BytesN<32>,
payout: soroban_sdk::Address,
) -> soroban_sdk::Bytesfn accept_ownership(env: soroban_sdk::Env)fn renounce_ownership(env: soroban_sdk::Env)fn transfer_ownership(
env: soroban_sdk::Env,
new_owner: soroban_sdk::Address,
live_until_ledger: u32,
)