Construct the gateway with the fixed deposit destination (the ramp's usdc-distributor account) and the USDC Stellar Asset Contract address. Runs atomically at deploy, so there is no "deployed but uninitialized" window and nobody can front-run initialization. Both values are operator-set and immutable: there is no setter and the contract is not upgradeable, so funds can never be redirected.
fn __constructor(
env: soroban_sdk::Env,
destination: soroban_sdk::Address,
usdc_sac: soroban_sdk::Address,
)Move amount USDC from from to the fixed destination and emit a
deposit event tagged with order_ref, atomically.
from may be a classic account or a contract (smart-wallet) address.
from.require_auth() binds the authorization to the exact invocation —
(from, amount, order_ref) plus a nonce — so a signed deposit cannot be
replayed or repointed to a different order or amount. The destination is
not a parameter, so funds can never be redirected by the caller.
fn deposit(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
amount: i128,
order_ref: soroban_sdk::String,
)Move amount USDC from the fixed destination (usdc-distributor) to to
and emit a payout event tagged with order_ref, atomically — the
on-ramp leg. to may be a contract (smart-wallet) address that a Classic
Payment cannot credit.
destination.require_auth() means only the usdc-distributor's
authorization can move its funds, so a payout can only be driven by the
ramp itself — a caller-supplied to cannot drain the account. The SAC
transfer's from (= destination) auth is covered by the same invocation
tree (and, on-chain, by the source-account credentials when the
usdc-distributor is the transaction source).
fn payout(
env: soroban_sdk::Env,
to: soroban_sdk::Address,
amount: i128,
order_ref: soroban_sdk::String,
)The fixed deposit destination (usdc-distributor account).
fn destination(env: soroban_sdk::Env) -> soroban_sdk::AddressThe configured USDC Stellar Asset Contract address.
fn usdc_sac(env: soroban_sdk::Env) -> soroban_sdk::Address