fn pause(env: soroban_sdk::Env)Rescue stuck SEP-41 balances (e.g. accidental token deposits). Rescuer-only.
This moves loose token balances only. It cannot reach a Blend position:
those are covered by per-user claims and withdraw_supply.
fn rescue(
env: soroban_sdk::Env,
token_addr: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
)fn unpause(env: soroban_sdk::Env)Replace this contract's Wasm, owner-only.
Users hold their Blend claims in this contract's storage, so without
an upgrade path a bug found after launch could only be fixed by
migrating every open position by hand. Upgrading preserves storage, so
claims survive. The guarded-launch caps exist precisely because this
key can rewrite the contract: see docs/security-notes.md.
fn upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)(per_intent_cap, global_tvl_cap, composed_tvl), all in local 7-decimal
USDC units.
fn get_caps(env: soroban_sdk::Env) -> (i128, i128, i128)Set the per-intent and global composition caps, in local 7-decimal USDC units. Lowering a cap below current composed TVL is allowed: it stops new composition without disturbing positions already open.
fn set_caps(env: soroban_sdk::Env, per_intent_cap: i128, global_tvl_cap: i128)fn get_admin(env: soroban_sdk::Env) -> soroban_sdk::AddressA user's withdrawable claim on pool, denominated in bTokens.
fn get_claim(
env: soroban_sdk::Env,
user: soroban_sdk::Address,
pool: soroban_sdk::Address,
) -> i128fn get_owner(env: soroban_sdk::Env) -> soroban_sdk::Addressfn is_paused(env: soroban_sdk::Env) -> boolfn get_pauser(env: soroban_sdk::Env) -> soroban_sdk::Addressfn get_rescuer(env: soroban_sdk::Env) -> soroban_sdk::AddressInitialize the contract with roles, external addresses, expected protocol versions, and the guarded-launch caps. Callable exactly once at deployment time.
fn __constructor(
env: soroban_sdk::Env,
owner: soroban_sdk::Address,
pauser: soroban_sdk::Address,
rescuer: soroban_sdk::Address,
admin: soroban_sdk::Address,
message_transmitter: soroban_sdk::Address,
token_messenger_minter: soroban_sdk::Address,
usdc_token: soroban_sdk::Address,
expected_msg_version: u32,
expected_burn_msg_version: u32,
expected_intent_version: u32,
per_intent_cap: i128,
global_tvl_cap: i128,
)fn get_usdc_token(env: soroban_sdk::Env) -> soroban_sdk::Addressfn transfer_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)fn is_pool_allowed(env: soroban_sdk::Env, pool: soroban_sdk::Address) -> boolCore entry point. Anyone can invoke — MessageTransmitter's nonce guard prevents replay. Delivery + condition eval + composed action or fallback all fire atomically inside this call.
fn mint_and_settle(
env: soroban_sdk::Env,
message: soroban_sdk::Bytes,
attestation: soroban_sdk::Bytes,
)Withdraw underlying USDC from a Blend position against user's claim.
Deliberately callable while paused: pausing exists to stop Niet taking on new risk, not to hold anyone's funds hostage.
fn withdraw_supply(
env: soroban_sdk::Env,
user: soroban_sdk::Address,
pool: soroban_sdk::Address,
amount: i128,
) -> i128Add or remove a destination pool from the composition allowlist.
fn set_pool_allowed(env: soroban_sdk::Env, pool: soroban_sdk::Address, allowed: bool)fn transfer_ownership(env: soroban_sdk::Env, new_owner: soroban_sdk::Address)Emit-a-getter for observability. Front-end status polling can read this to determine which msg/burn/intent versions the contract is currently pinned to.
fn get_expected_versions(env: soroban_sdk::Env) -> (u32, u32, u32)fn get_message_transmitter(env: soroban_sdk::Env) -> soroban_sdk::Addressfn get_token_messenger_minter(env: soroban_sdk::Env) -> soroban_sdk::Address