Grants a role to an account. Caller must be owner or have the role's admin role.
account - The account to grant the role to.role - The role to grant.caller - The account that is granting the role. Must be owner or have the role's admin role.fn grant_role(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
role: soroban_sdk::Symbol,
caller: soroban_sdk::Address,
)Revokes a role from an account. Caller must be owner or have the role's admin role.
account - The account to revoke the role from.role - The role to revoke.caller - The account that is revoking the role. Must be owner or have the role's admin role.fn revoke_role(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
role: soroban_sdk::Symbol,
caller: soroban_sdk::Address,
)Allows an account to renounce a role assigned to itself. Users can only renounce roles for their own account.
role - The role to renounce.caller - The account that is renouncing the role. Must be the account itself.fn renounce_role(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
caller: soroban_sdk::Address,
)Sets admin_role as the admin role of role. Caller must be the authorizer.
role - The role to set the admin for.admin_role - The admin role to set for the role.The admin role can be any Symbol, including one with no members. If the admin
role has no members, only the authorizer can grant/revoke the role.
fn set_role_admin(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
admin_role: soroban_sdk::Symbol,
)Removes the admin role for a specified role. Caller must be the authorizer.
role - The role to remove the admin for.RbacError::AdminRoleNotFound - If no admin role is set for the role.fn remove_role_admin(env: soroban_sdk::Env, role: soroban_sdk::Symbol)Returns Some(index) if the account has the specified role, where index
is the index of the account in the role. Returns None if not.
account - The account to check the role for.role - The role to check the account for.fn has_role(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
role: soroban_sdk::Symbol,
) -> OptionReturns the admin role for a specific role, or None if not set.
role - The role to get the admin for.fn get_role_admin(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
) -> OptionReturns the number of accounts that have the specified role.
role - The role to get the member count for.fn get_role_member_count(env: soroban_sdk::Env, role: soroban_sdk::Symbol) -> u32Returns the account at the specified index for a given role.
role - The role to get the member for.index - The index of the member to get.RbacError::IndexOutOfBounds if the index is out of bounds.fn get_role_member(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
index: u32,
) -> soroban_sdk::AddressReturns all roles that currently have at least one member. Defaults to empty vector if no roles exist.
This function returns all roles that currently have at least one member.
The maximum number of roles is limited by [MAX_ROLES].
fn get_existing_roles(env: soroban_sdk::Env) -> soroban_sdk::Vecfn set_admin(
env: soroban_sdk::Env,
new_admin: soroban_sdk::Address,
operator: soroban_sdk::Address,
)Blacklists (authorize=false) or re-authorizes (authorize=true) an
address on the underlying SAC.
Refuses to blacklist the address currently configured as the
redistribution escrow — clear the escrow first via set_escrow(None)
to ensure the redistribution path stays live.
fn set_authorized(
env: soroban_sdk::Env,
id: soroban_sdk::Address,
authorize: bool,
operator: soroban_sdk::Address,
)fn clawback(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
amount: i128,
operator: soroban_sdk::Address,
)Mints amount to to.
If the redistribution feature is enabled (escrow set) and to is
blacklisted on the SAC, the mint is silently redirected to the escrow
and a RedistributeFunds event is emitted. Otherwise the mint is
forwarded as-is to the SAC.
fn mint(
env: soroban_sdk::Env,
to: soroban_sdk::Address,
amount: i128,
operator: soroban_sdk::Address,
)Constructs the SAC manager contract.
sac_token - The underlying Stellar Asset Contract addressowner - The initial owner address (for TTL management, role grants)fn __constructor(
env: soroban_sdk::Env,
sac_token: soroban_sdk::Address,
owner: soroban_sdk::Address,
)Returns the underlying SAC (Stellar Asset Contract) address.
fn underlying_sac(env: soroban_sdk::Env) -> soroban_sdk::AddressReturns the currently configured escrow address, if any.
None means the redistribution feature is disabled.
fn escrow(env: soroban_sdk::Env) -> OptionSets (or clears) the escrow address that receives redistributed funds.
Pass Some(address) to enable the redistribution feature, or None to
disable it. Callable only by the owner.
When setting a new escrow, the address must not be currently blacklisted
on the SAC, otherwise the call reverts with EscrowIsBlocked. Emits an
EscrowSet event with the previous and new values.
The escrow MUST NOT be the underlying classic asset issuer. Stellar asset issuers cannot hold trustlines to their own asset, so any redistribution mint to the issuer would revert at the SAC layer.
The SAC exposes no direct getter for the classic issuer, though it can be
derived sideways from the asset name (format {asset_code}:{issuer_address}).
This contract deliberately does not enforce the invariant on-chain — the
name-parsing check is brittle (asset code length, strkey format) — so
the owner calling this function is responsible for verifying off-chain that
the configured escrow is not the issue
fn set_escrow(env: soroban_sdk::Env, escrow: Option) Redistributes funds from a blacklisted account to the configured escrow.
Requires:
REDISTRIBUTOR_ROLE.set_escrow(Some(_))).from is currently blacklisted on the underlying SAC.fn redistribute_blacklisted_funds(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
amount: i128,
operator: soroban_sdk::Address,
)fn authorizer(env: soroban_sdk::Env) -> OptionReturns the current owner address, or None if no owner is set.
fn owner(env: soroban_sdk::Env) -> OptionReturns the pending owner address for 2-step transfer, or None if no transfer is pending.
fn pending_owner(env: soroban_sdk::Env) -> OptionTransfers ownership immediately to a new address.
Use with caution - if you transfer to a wrong address, ownership is lost forever.
Consider using begin_ownership_transfer instead.
OwnerNotSet if no owner is currently setTransferInProgress if a 2-step transfer is in progressfn transfer_ownership(env: soroban_sdk::Env, new_owner: soroban_sdk::Address)Begins an ownership transfer to a new address.
The new owner must call accept_ownership() within ttl ledgers
to complete the transfer. The pending transfer will automatically expire after.
new_owner - The proposed new ownerttl - Number of ledgers the new owner has to accept.
Use 0 to cancel a pending transfer (new_owner must match pending).OwnerNotSet if no owner is currently setNoPendingTransfer when cancelling and no pending transfer existsInvalidTtl if ttl exceeds max TTLInvalidPendingOwner when cancelling with wrong new_owner addressfn begin_ownership_transfer(
env: soroban_sdk::Env,
new_owner: soroban_sdk::Address,
ttl: u32,
)Accepts a pending 2-step ownership transfer.
Must be called by the pending owner before the TTL expires.
NoPendingTransfer if there is no pending transfer (or it expired)fn accept_ownership(env: soroban_sdk::Env)Permanently renounces ownership.
OwnerNotSet if no owner is currently setTransferInProgress if a 2-step transfer is in progress (cancel it first)fn renounce_ownership(env: soroban_sdk::Env)Extends the instance TTL.
threshold - The threshold to extend the TTL (if current TTL is below this, extend).extend_to - The TTL to extend to.fn extend_instance_ttl(env: soroban_sdk::Env, threshold: u32, extend_to: u32)Sets TTL configs for instance and persistent storage.
None values remove the corresponding config (disables auto-extension for that type)threshold <= extend_to <= MAX_TTLinstance - TTL config for instance storagepersistent - TTL config for persistent storageTtlConfigFrozen if configs are frozenInvalidTtlConfig if validation failsfn set_ttl_configs(
env: soroban_sdk::Env,
instance: Option,
persistent: Option,
) Returns the current TTL configs as (instance_config, persistent_config).
fn ttl_configs(env: soroban_sdk::Env) -> (Option, Option) Permanently freezes TTL configs, preventing any future modifications.
This is irreversible and provides immutability guarantees to users.
Emits TtlConfigsFrozen event.
TtlConfigAlreadyFrozen if already frozenfn freeze_ttl_configs(env: soroban_sdk::Env)Returns whether TTL configs are frozen.
fn is_ttl_configs_frozen(env: soroban_sdk::Env) -> bool