Initializes admin (withdraw/pause/upgrade/set_receiver), submitter (seeds
the allowed-submitters list -- it is the sole allowed submitter until the
admin calls set_submitters), and the Blend-pool allow-list. The
receiver is wired separately post-deploy via set_receiver (circular dep).
fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
submitter: soroban_sdk::Address,
allowed_pools: soroban_sdk::Vec,
) fn get_config(env: soroban_sdk::Env) -> ExecutorConfigfn set_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)fn set_submitter(env: soroban_sdk::Env, new_submitter: soroban_sdk::Address)Admin-only: replace the whole allowed-submitters list (multi-submitter
upgrade, 2026-09-06). Whole-list replace, idempotent, mirroring
set_allowed_pools. Until this is called for the first time, the list
falls back to the legacy single submitter (see storage::get_submitters),
so calling it is safe at any point after the wasm upgrade. Setting an
empty list locks every submitter out of execute/execute_owned until
the admin sets a non-empty one (use pause as the intended kill switch).
fn set_submitters(
env: soroban_sdk::Env,
submitters: soroban_sdk::Vec,
) fn set_allowed_pools(
env: soroban_sdk::Env,
pools: soroban_sdk::Vec,
) Admin-only: wire the deployed receiver. Required before execute works.
fn set_receiver(env: soroban_sdk::Env, receiver: soroban_sdk::Address)fn pause(env: soroban_sdk::Env)fn unpause(env: soroban_sdk::Env)Admin-only profit sweep. The contract accumulates profit (spec: no auto-sweep).
fn withdraw(
env: soroban_sdk::Env,
token: soroban_sdk::Address,
amount: i128,
to: soroban_sdk::Address,
)fn upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)Runs one flash-loan-financed arb route atomically. Only an address on
the allowed-submitters list may call (multi-submitter upgrade,
2026-09-06): the caller names itself via submitter and must authorize
the invocation (implicitly satisfied when it is the tx source account).
Returns realized profit in loan_asset raw units.
Two-contract flow (avoids Soroban's re-entry prohibition): arm the receiver
(sub-call returns → receiver off-stack) → approve the pool → flash_loan
(pool calls the now-off-stack receiver's exec_op, a fresh invocation) →
disarm (proves the callback ran) → assert profit on the real balance delta.
fn execute(
env: soroban_sdk::Env,
submitter: soroban_sdk::Address,
blend_pool: soroban_sdk::Address,
loan_asset: soroban_sdk::Address,
loan_amount: i128,
legs: soroban_sdk::Vec,
min_profit: i128,
deadline_ledger: u32,
) -> i128 Runs one arb cycle financed from this contract's own asset balance
(operator deposits are plain transfers to this address; the admin's
withdraw doubles as the rescue path). Same gates as execute minus
the Blend allow-list — no pool is involved (including the same
allowed-submitters gate on the submitter arg). Returns realized profit.
fn execute_owned(
env: soroban_sdk::Env,
submitter: soroban_sdk::Address,
asset: soroban_sdk::Address,
amount: i128,
legs: soroban_sdk::Vec,
min_profit: i128,
deadline_ledger: u32,
) -> i128