Design rules
- Only Stellar settles. Every payable order is backed by exact, reserved, native Stellar USDC in the escrow. Bridge receipts, pending deposits and yield positions are never counted.
- No privileged path. USDC leaves the escrow only to the order’s taker (on release), back to the depositor (on unlock), or to the depositor who withdraws unlocked funds. The admin cannot move escrowed USDC.
- Fail before the fiat. Anything that could block a release (rate, limits, rail terms, allowed takers) is checked when the order opens, before anyone pays.
- One payment, one order. The claim’s nullifier is derived from the provider’s transaction ID and is spent once.
- 7-decimal amounts. All amounts are Circle USDC in Stellar’s 7-decimal units. 20 USDC is
200_000_000.
Roles
The transfer prover is always the party who made the fiat payment. In a buy that is the user; in a sell it is the LP.