Security first.
Noncustodial architecture, onchain enforcement and public contracts. Here is what is enforced today and what changes as the protocol grows.
Noncustodial architecture
Your keys never leave your wallet. The protocol signs valuations, never your transactions.
Onchain enforcement
Tiers, price gates, exit brackets and liquidation rules execute in the contract. No admin can override them for a single loan.
Narrow operational roles
The attestor can only push prices inside the contract tolerance. The engine can only sell inside a bracket the borrower armed.
Two source pricing
No valuation is signed unless two independent price sources agree. The contract adds its own 30 minute average as a third check.
Screened collateral
Contract safety, holder concentration, a 30 day drawdown screen and a live sell test before any memecoin is enabled.
Encrypted operator keys
Hot keys are stored encrypted at rest and only decrypted inside the worker process.
Public contracts
Both contracts are public on Blockscout and every number on the stats page is derived from chain state.
Kill switches
Exit execution, liquidations and distributions can each be paused independently without touching the contract.
No secrets in the repository
No keys or credentials in code or git history.
Rate limited endpoints
Screening and attestation endpoints are throttled per wallet and per address.
Day to day signing comes from a hot wallet, with bounded scope.
Prices have to land every minute and exits have to fire within seconds. A multisig cannot meet that latency, so an operational key does it. What matters is how narrow its scope is.
Roles are narrow by design: the attestor cannot move funds, the engine can only sell inside the limits the borrower armed.
- Push prices, inside the contract tolerance
- Sign valuations that the contract checks against its own history
- Fire exits inside armed brackets, above the computed floor
- Liquidate overdue loans
- Pay holder distributions from the fee wallet
- Move a borrower's collateral outside repayment, exits or liquidation
- Withdraw lender deposits
- Sell below the attested floor
- Change a loan's debt or due date
Where ownership sits.
Contract ownership currently sits on the operator key while the protocol is small. The contract uses two step ownership transfer, and moving the owner to a hardware wallet behind a public timelock is the first change scheduled once real volume arrives. The fee wallet and the liquidation wallet move to separate addresses at the same time.
LendingPool 0xD8C1A8C779810216C466E3F1c581Cf49dfa90F10 · CreditOracle 0x20a41a89BB6798e5E976624345C348562851c898
Found something? Write to us on support before posting.