Contract 8055c4aed0e8e449277f4ad2101a8a25a99be05ef72505b31afd4b1dbf57bab9

← Back to Index 📥 Download WASM

Meta

cliver 23.2.0#8c559e832fd969aa469784b66e70891fadf94f0a
rssdkver 23.1.0#7456be9d91fe1f4cb070fc2732bac78244ce6c3f
rsver 1.94.0

Instances

  • CD3YTYUONQYJW2S6EJ7K6HJGYOYBEUALJW6DPLXSQMQHFNNWEUN437BV

Interface

fn pause(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn deposit(
    env: soroban_sdk::Env,
    token: soroban_sdk::Address,
    amount: u64,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn unpause(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn upgrade(
    env: soroban_sdk::Env,
    new_wasm_hash: soroban_sdk::BytesN<32>,
    operator: soroban_sdk::Address,
)
fn has_role(
    env: soroban_sdk::Env,
    account: soroban_sdk::Address,
    role: soroban_sdk::Symbol,
) -> Option

Manager-controlled withdrawal.

SECURITY: the manager role is assumed to be a hardened multisig. This function can move any token, any amount, and is gated only by admin force_pause (not the normal pause). To bound the blast radius of a partially-compromised or mistaken manager key, the recipient MUST be on the withdraw-destination allowlist, which is itself configured through a two-step, cooldown-gated flow (propose -> accept). Destinations can be removed immediately. Any-token is intentional so stray/airdropped assets can be rescued.

fn withdraw(
    env: soroban_sdk::Env,
    token: soroban_sdk::Address,
    amount: u64,
    to: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_admin(env: soroban_sdk::Env) -> Option
fn get_proxy(env: soroban_sdk::Env) -> soroban_sdk::Address
fn is_paused(env: soroban_sdk::Env) -> bool
fn grant_role(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
    account: soroban_sdk::Address,
    role: soroban_sdk::Symbol,
)
fn initialize(
    env: soroban_sdk::Env,
    config: EscrowInitConfig,
    limits: EscrowInitLimits,
) -> Result<(), AssetManagerEscrowError>
fn force_pause(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
) -> Option
fn revoke_role(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
    account: soroban_sdk::Address,
    role: soroban_sdk::Symbol,
)
fn execute_swap(
    env: soroban_sdk::Env,
    token_in: soroban_sdk::Address,
    amount_in: u64,
    token_out: soroban_sdk::Address,
    amount_out_min: u64,
    distribution: soroban_sdk::Vec,
    swap_auth: soroban_sdk::Vec,
    caller: soroban_sdk::Address,
) -> Result
fn accept_limits(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn cancel_limits(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn force_unpause(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn renounce_role(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
    role: soroban_sdk::Symbol,
)

Burn USDC on Stellar and initiate cross-chain transfer via CCTPv2.

Calls TokenMessengerMinterV2::deposit_for_burn which:

  1. Transfers USDC from escrow to the messenger via transfer_from (requires prior approve)
  2. Burns the USDC locally
  3. Sends a CCTP message to the destination domain

Note: Stellar USDC uses 7 decimals. The TokenMessengerMinter handles the decimal conversion internally (strips the 7th decimal as "dust").

fn send_via_cctp(
    env: soroban_sdk::Env,
    amount: u64,
    destination_domain: u32,
    mint_recipient: soroban_sdk::BytesN<32>,
    destination_caller: soroban_sdk::BytesN<32>,
    max_fee: i128,
    min_finality_threshold: u32,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn accept_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn accept_manager(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn cancel_manager(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn enable_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_aggregator(env: soroban_sdk::Env) -> Option
fn get_role_admin(
    env: soroban_sdk::Env,
    role: soroban_sdk::Symbol,
) -> Option
fn propose_limits(
    env: soroban_sdk::Env,
    new_processor_daily_limit: Option,
    new_processor_max_per_tx: Option,
    new_processor_cooldown: Option,
    new_emergency_cooldown: Option,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn remove_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn renounce_admin(env: soroban_sdk::Env)
fn set_role_admin(
    env: soroban_sdk::Env,
    role: soroban_sdk::Symbol,
    admin_role: soroban_sdk::Symbol,
)
fn disable_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn emergency_sweep(
    env: soroban_sdk::Env,
    amount: u64,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn execute_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    action: u32,
    params: soroban_sdk::Val,
    caller: soroban_sdk::Address,
) -> Result
fn get_role_member(
    env: soroban_sdk::Env,
    role: soroban_sdk::Symbol,
    index: u32,
) -> soroban_sdk::Address
fn is_force_paused(env: soroban_sdk::Env) -> bool
fn propose_adapter(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    native_asset_mint: soroban_sdk::Address,
    supports_pending_withdrawals: bool,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn propose_manager(
    env: soroban_sdk::Env,
    new_manager: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>

Return underlying to the proxy (which forwards it to the vault and updates its accounting atomically).

This is the INTENTIONALLY unbounded safe-return rail (L-4): it skips the processor budget and works while paused, so an incident can be unwound at full balance immediately, without the manager multisig or a daily cap in the way. That is safe because the destination is hard-wired up the trust chain — a compromised processor can at worst repeatedly unwind idle liquidity (strategy denial, no extraction), and the manager can revoke the role immediately.

fn return_to_proxy(
    env: soroban_sdk::Env,
    amount: u64,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn accept_processor(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn cancel_processor(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn is_token_allowed(env: soroban_sdk::Env, token: soroban_sdk::Address) -> bool
fn push_and_execute(
    env: soroban_sdk::Env,
    adapter: soroban_sdk::Address,
    token: soroban_sdk::Address,
    amount: u64,
    action: u32,
    params: soroban_sdk::Val,
    caller: soroban_sdk::Address,
) -> Result
fn accept_aggregator(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_adapter_count(env: soroban_sdk::Env) -> u32
fn propose_processor(
    env: soroban_sdk::Env,
    new_processor: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn set_allowed_token(
    env: soroban_sdk::Env,
    token: soroban_sdk::Address,
    allowed: bool,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_cctp_messenger(env: soroban_sdk::Env) -> Option
fn propose_aggregator(
    env: soroban_sdk::Env,
    new_address: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_swap_rate_floor(
    env: soroban_sdk::Env,
    token_in: soroban_sdk::Address,
    token_out: soroban_sdk::Address,
) -> Option

Set the minimum acceptable output rate for swapping token_in into token_out: execute_swap requires amount_out_min >= amount_in * num / denom. Both sides are in raw base units, so num / denom must absorb any decimals difference between the two tokens. num = 0 clears the floor, which disables the pair (execute_swap fails closed on a pair with no floor).

fn set_swap_rate_floor(
    env: soroban_sdk::Env,
    token_in: soroban_sdk::Address,
    token_out: soroban_sdk::Address,
    num: u64,
    denom: u64,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn transfer_admin_role(
    env: soroban_sdk::Env,
    new_admin: soroban_sdk::Address,
    live_until_ledger: u32,
)
fn get_cctp_destination(env: soroban_sdk::Env, domain: u32) -> Option
fn get_cctp_max_fee_bps(env: soroban_sdk::Env) -> u32
fn get_processor_limits(env: soroban_sdk::Env) -> (u64, u64, u64)
fn get_token_daily_used(env: soroban_sdk::Env, token: soroban_sdk::Address) -> u64
fn get_underlying_asset(env: soroban_sdk::Env) -> soroban_sdk::Address
fn set_cctp_destination(
    env: soroban_sdk::Env,
    domain: u32,
    recipient: soroban_sdk::BytesN<32>,
    allowed: bool,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>

Set the cap on the processor-supplied CCTP max_fee, in basis points of the burn amount. 0 restricts sends to fee-less (standard) transfers; the cap can never exceed 100%.

fn set_cctp_max_fee_bps(
    env: soroban_sdk::Env,
    bps: u32,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn accept_admin_transfer(env: soroban_sdk::Env)
fn accept_cctp_messenger(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_role_member_count(env: soroban_sdk::Env, role: soroban_sdk::Symbol) -> u32
fn get_token_daily_limit(env: soroban_sdk::Env, token: soroban_sdk::Address) -> u64

Daily execute_swap input budget for a non-underlying token, in that token's base units. 0 (the default) rejects swaps spending the token. The underlying is governed by the global processor budget instead.

fn set_token_daily_limit(
    env: soroban_sdk::Env,
    token: soroban_sdk::Address,
    limit: u64,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn propose_cctp_messenger(
    env: soroban_sdk::Env,
    new_address: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>

Finalize a pending withdraw-destination addition once its cooldown elapses.

fn accept_withdraw_destination(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>

Cancel a pending withdraw-destination proposal.

fn cancel_withdraw_destination(
    env: soroban_sdk::Env,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_cctp_destination_caller(env: soroban_sdk::Env) -> soroban_sdk::BytesN<32>

Remove destination from the withdraw allowlist immediately (no cooldown), so a compromised or mistaken destination can be revoked quickly.

fn remove_withdraw_destination(
    env: soroban_sdk::Env,
    destination: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>

Propose adding destination to the withdraw allowlist. Takes effect only after config_change_cooldown via accept_withdraw_destination. Only one proposal may be pending at a time.

fn propose_withdraw_destination(
    env: soroban_sdk::Env,
    destination: soroban_sdk::Address,
    caller: soroban_sdk::Address,
) -> Result<(), AssetManagerEscrowError>
fn get_cctp_max_finality_threshold(env: soroban_sdk::Env) -> u32
fn is_withdraw_destination_allowed(
    env: soroban_sdk::Env,
    destination: soroban_sdk::Address,
) -> bool

Imports

WebAssembly Text (WAT) ▶