Transfer amount ZMOKE from user into this contract, held against
intent_id. User must have signed the transaction.
Uses token.transfer() (not transfer_from + allowance) so the user
only signs once. require_auth(user) here covers the outer call; the
user's tx-level auth tree covers the nested ZMOKE transfer since the
user is the token's from.
fn lock(
env: soroban_sdk::Env,
user: soroban_sdk::Address,
amount: i128,
intent_id: soroban_sdk::BytesN<32>,
)fn admin(env: soroban_sdk::Env) -> soroban_sdk::AddressUser cancels their own active lock; locked ZMOKE refunded to them.
Fails loudly if the caller isn't the original lock.user (auth check
is against the address stored in the LockRecord, not the tx source).
fn cancel(env: soroban_sdk::Env, intent_id: soroban_sdk::BytesN<32>)Admin burns the locked ZMOKE on Stripe success. Status → Settled.
Calls zmoke_minter.burn(self, amount). Self-burn is the standard
SEP-0041 path — no allowance dance needed, just contract-as-self auth
for the sub-invocation.
fn settle(env: soroban_sdk::Env, intent_id: soroban_sdk::BytesN<32>)Admin-gated in-place Wasm upgrade (CAP-0054). Preserves the contract ID and every Lock(intent_id) persistent entry, plus the stored admin and zmoke_minter addresses in instance storage.
Without this entrypoint, a Phase 4.5 re-deploy would mint a new escrow contract ID and orphan every live LockRecord — meaning every buyer mid-checkout loses their escrowed ZMOKE with no automated recovery path. Catastrophic on mainnet.
Workflow: stellar contract install uploads the new Wasm blob and
returns its sha256 hash; this function swaps the running contract's
code to that hash. Caller must be the current admin.
fn upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)fn get_lock(env: soroban_sdk::Env, intent_id: soroban_sdk::BytesN<32>) -> LockRecordfn set_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)Admin force-cancels a lock (post-expiry cleanup, dispute resolution).
Same refund mechanics as user cancel(); distinct entrypoint so the
contract event log cleanly separates the two.
fn admin_cancel(env: soroban_sdk::Env, intent_id: soroban_sdk::BytesN<32>)CAP-0058 atomic constructor. Runs exactly once inside the deploy transaction — closes the deploy-then-initialize front-run window that would otherwise let an MEV bot claim admin between the two calls. Addresses remain runtime parameters so the same WASM blob works on testnet and mainnet.
Do NOT re-add an "already initialized" guard; the protocol guarantees single-call semantics.
admin — treasury admin key (settles + force-cancels)zmoke_minter — address of the ZMOKE token contractfn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
zmoke_minter: soroban_sdk::Address,
)fn zmoke_minter_addr(env: soroban_sdk::Env) -> soroban_sdk::Address