Deposit an order's inputs and return its domain-separated order ID.
order.user authorizes (order_id,) and the exact token-transfer subcalls.
Persist canonical order XDR before submission: only status is stored on-chain.
Requires now < fill_deadline <= expires, 1–4 inputs/outputs, positive i128 input
amounts, unique output identities, local contract token/oracle addresses, and the
configured origin chain. Stores Deposited, renews data TTL, and emits Opened.
All transfers and writes roll back if any input fails to credit its exact amount.
Admission/domain errors, InvalidDeadlines, DuplicateOutput, InvalidInput,
InvalidStatus for a retained order ID, and ShortCredit; token/auth failures
also abort. A nonce alone does not prevent opening a different complete order.
fn open(
env: soroban_sdk::Env,
order: Order,
) -> Result, soroban_sdk::Error> Return all inputs to the recorded user after now > order.expires.
Permissionless: only transaction fees need a payer; the payout address cannot be
changed. Resupply the exact order body. Transitions Deposited to Refunded and
emits Refunded; a token failure rolls back the entire call. Does not renew data TTL.
UnknownOrder, InvalidStatus, or DeadlineNotPassed, plus token failures.
Deadline comparison uses the full u64 ledger time, including beyond the u32 wire range.
fn refund(env: soroban_sdk::Env, order: Order) -> Result<(), soroban_sdk::Error>Release all inputs to destination after every committed output is proven filled.
solves supplies one solver/timestamp per output in order; solvers may differ.
The first solver must equal the native claimant address commitment.
The claimant authorizes (order_id, solves, claimant, destination); the actual
invocation still supplies the full original order. Each timestamp must be at or
before fill_deadline; the selected input oracle authenticates every proof.
Transitions Deposited to Claimed before transfers and emits Finalised.
A failure rolls back the transition and all payouts. Data TTL is not renewed.
Claims remain available after expiry and can race a permissionless refund.
UnknownOrder, InvalidStatus, InvalidProofCount, ClaimantMismatch,
DeadlinePassed, invalid addresses, or a downstream oracle/token/auth failure.
fn finalise(
env: soroban_sdk::Env,
order: Order,
solves: soroban_sdk::Vec,
claimant: soroban_sdk::Address,
destination: soroban_sdk::Address,
) -> Result<(), soroban_sdk::Error> Renew an existing order entry, including terminal status, and instance/code TTL.
Permissionless; returns true if the entry exists and false for an unknown ID.
Uses the common capped renewal policy. Restore archived entries before invoking;
maintenance does not restore them. Configuration errors abort the call.
fn maintain(
env: soroban_sdk::Env,
order_id: soroban_sdk::BytesN<32>,
) -> ResultRead retained status, or None for an unknown order commitment.
Permissionless; maintains instance/code TTL but not the order entry. Numeric
states are Deposited = 0, Claimed = 1, Refunded = 2. Terminal states remain
as replay evidence. Archived state must be restored; it is not an unknown order.
Configuration errors or host archival failures abort the call.
fn order_status(
env: soroban_sdk::Env,
order_id: soroban_sdk::BytesN<32>,
) -> Result, soroban_sdk::Error> Bind this deployment to its immutable OIF chain_id and Stellar network_id.
Returns WrongNetwork unless network_id equals the host ledger network ID.
Stores configuration in instance storage and maintains instance/code TTL.
No administrator or subsequent configuration entrypoint exists.
fn __constructor(
env: soroban_sdk::Env,
chain_id: soroban_sdk::U256,
network_id: soroban_sdk::BytesN<32>,
) -> Result<(), soroban_sdk::Error>Return the order commitment for this network and escrow without depositing funds.
The preimage is "OIF.Stellar.Order.v1" || network[32] || escrow[32] || Order.to_xdr().
Checks bounded nonempty collections and output byte lengths; it does not perform
all open admission checks. No user authorization is required. Maintains instance/code TTL.
EmptyCollection, ResourceLimit, or configuration errors.
fn order_identifier(
env: soroban_sdk::Env,
order: Order,
) -> Result, soroban_sdk::Error> Open order, pay its inputs to destination, run the solver hook, then require fills.
Mirrors EVM openForAndFinalise: the solver may fund outputs from the inputs it
just received. When call is nonempty, destination must be a contract
implementing InputCallback::order_finalised(inputs, call); inputs are passed
unmodified. Every output is then checked against the input oracle with
Solve { solver: commitment(claimant), timestamp: now }. There is no same-chain
restriction; the oracle check is the only gate. Soroban forbids re-entry, so
destination must not be this escrow or the invoking contract, and nested atomic
opens on the same escrow are impossible.
order.user authorizes (order_id,) and the token subcalls, as for open;
claimant authorizes (order_id, claimant, destination, call).
Emits Opened then Finalised; ends Claimed. Any failure, including an
unproven output, rolls back the whole invocation.
open admission errors, AddressType, `Unpr
fn open_and_finalise(
env: soroban_sdk::Env,
order: Order,
claimant: soroban_sdk::Address,
destination: soroban_sdk::Address,
call: soroban_sdk::Bytes,
) -> Result, soroban_sdk::Error> Return inputs to the recorded user when one committed output is proven unfilled.
output_index is zero-based. Requires now > order.fill_deadline and a proof
reconstructed with the original deadline and output domain, not a caller-chosen
replacement. No user authorization is required; resupply the exact order body.
Transitions Deposited to Refunded and emits Refunded; token failures roll back
state and payouts. Does not renew data TTL.
UnknownOrder, InvalidStatus, DeadlineNotPassed, InvalidIndex, or Unproven,
plus downstream oracle/token failures.
fn refund_on_non_fill(
env: soroban_sdk::Env,
order: Order,
output_index: u32,
) -> Result<(), soroban_sdk::Error>