fn name(env: soroban_sdk::Env) -> soroban_sdk::StringHalts deposits. Callable by the guardian OR the admin — deliberately the cheap half of an asymmetric pair, because stopping a live exploit must not wait on a multisig.
This never blocks an exit. redeem, every SEP-41 transfer, and the
tokenizer paths that read exchange_rate all keep working while paused.
A pause that traps user funds is worse than no pause at all.
fn pause(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>Moves a non-protocol token out of this contract. The underlying can never be swept — it is either backing SY or, in wind-down, the entire redemption pool.
fn sweep(
env: soroban_sdk::Env,
token_id: soroban_sdk::Address,
to: soroban_sdk::Address,
) -> Resultfn config(env: soroban_sdk::Env) -> Resultfn redeem(env: soroban_sdk::Env, from: soroban_sdk::Address, sy_amount: i128) -> i128fn symbol(env: soroban_sdk::Env) -> soroban_sdk::Stringfn approve(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
spender: soroban_sdk::Address,
amount: i128,
expiration_ledger: u32,
)fn balance(env: soroban_sdk::Env, id: soroban_sdk::Address) -> i128fn deposit(env: soroban_sdk::Env, from: soroban_sdk::Address, amount: i128) -> i128Resumes deposits. Admin only — the expensive half. Cheap to stop, deliberate to restart.
fn unpause(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>fn decimals(env: soroban_sdk::Env) -> u32The guardian, defaulting to the admin when none has been set.
fn guardian(env: soroban_sdk::Env) -> Resultfn transfer(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
)fn allowance(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
spender: soroban_sdk::Address,
) -> i128fn is_paused(env: soroban_sdk::Env) -> boolfn underlying(env: soroban_sdk::Env) -> soroban_sdk::AddressCompletes a transfer started by propose_admin.
fn accept_admin(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>fn is_emergency(env: soroban_sdk::Env) -> boolfn is_renounced(env: soroban_sdk::Env) -> boolSets the guardian, which may pause but never unpause.
fn set_guardian(
env: soroban_sdk::Env,
guardian: soroban_sdk::Address,
) -> Result<(), soroban_sdk::Error>fn total_shares(env: soroban_sdk::Env) -> Resultfn total_supply(env: soroban_sdk::Env) -> i128fn accrued_yield(env: soroban_sdk::Env, holder: soroban_sdk::Address) -> i128fn exchange_rate(env: soroban_sdk::Env) -> i128fn pending_admin(env: soroban_sdk::Env) -> OptionNominates a new admin. Takes effect only when the nominee calls
accept_admin, so a mistyped address cannot orphan governance.
fn propose_admin(
env: soroban_sdk::Env,
new_admin: soroban_sdk::Address,
) -> Result<(), soroban_sdk::Error>fn share_balance(
env: soroban_sdk::Env,
holder: soroban_sdk::Address,
) -> Resultfn transfer_from(
env: soroban_sdk::Env,
spender: soroban_sdk::Address,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
)fn cancel_upgrade(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>Permanently renounces governance: no more pause, upgrade, sweep, or reserve migration, ever. The escape hatch from upgradeability once the market has proven itself and an audit is in hand.
fn renounce_admin(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>Applies a proposed upgrade once its timelock has elapsed.
fn execute_upgrade(env: soroban_sdk::Env) -> Result<(), soroban_sdk::Error>fn pending_upgrade(env: soroban_sdk::Env) -> Option<(soroban_sdk::BytesN<32>, u64)>Schedules an upgrade. Cannot execute for UPGRADE_TIMELOCK_SECONDS, and
emits an event on proposal, so holders who dislike the new code have a
bounded, advertised window to exit first.
fn propose_upgrade(
env: soroban_sdk::Env,
wasm_hash: soroban_sdk::BytesN<32>,
) -> ResultInitializes a production wrapper whose custody and exchange rate are backed by a Blend v2 plain-supply position.
fn initialize_blend(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
underlying: soroban_sdk::Address,
pool: soroban_sdk::Address,
) -> Result<(), soroban_sdk::Error>Recovers from a Blend reserve reindex.
config.reserve_index is fixed at init and the rate path traps with
InvalidBlendReserve whenever Blend has since moved the underlying to a
different reserve slot. That fail-closed trap is correct (pricing the
wrong reserve would be worse), but on its own it is unrecoverable: every
rate read, and therefore every deposit/redeem/split/recombine, stays
bricked for the life of the market. This admin entrypoint re-syncs the
stored index to wherever the pool now keeps this wrapper's underlying.
It does NOT trust a caller-supplied index. It re-derives the index the
same way initialize_blend does: it finds the underlying's position in
the pool's reserve list and cross-checks that against the pool's own
get_reserve(underlying).config.index, and requires the reserve decimals
to still match. The new index is accepted only if the asset actually
sitting there is config.underlying. So the strongest thing an admin can
do here is re-point the wrapper at the same underlying und
fn migrate_reserve_index(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
) -> ResultWithdraws the entire Blend position into idle custody and closes the market permanently.
This exists because config.pool is fixed at init with no rotation. If
Blend pauses the reserve, deprecates it, or the wrapper's position
becomes unreadable, then exchange_rate traps — and with it deposit,
redeem, split, recombine, redeem_at_maturity and every AMM swap, since
they all read it. Without this, that state is unrecoverable and user
funds are stranded.
Afterwards the rate is derived from idle custody exactly the way it was
derived from the Blend position (assets * WAD / supply), so it needs no
frozen snapshot and no new failure mode, and redeem pays out pro-rata
from the recovered balance. Deposits are closed forever.
Irreversible on purpose: allowing a return to Blend would make this a rate-manipulation lever rather than a safety valve.
fn emergency_withdraw_all(env: soroban_sdk::Env) -> Result