> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pesapay.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Protocol overview

> Three Soroban contracts settle every Pesa trade on Stellar.

Pesa's settlement layer is three Soroban contracts on Stellar. Together they hold USDC for open orders and release it only on a verified payment claim, a depositor's own release, or expiry.

```mermaid theme={null}
flowchart LR
    T[Taker] -->|signal_intent, fulfill_intent| O[Orchestrator]
    D[Depositor] -->|deposit, set_rail_terms, withdraw| E[Escrow]
    O -->|lock, unlock, release| E
    O -->|verify, consume_nullifier| C[Claims]
    V[zkTLS verifier] -.->|signs claims| T
```

| Contract | Holds | Main job |
| - | - | - |
| [Escrow](/protocol/escrow) | Every depositor's USDC, rail terms and locks | Keeps USDC, locks it for an order, pays it out |
| [Orchestrator](/protocol/orchestrator) | Orders (intents), config, LP registry | Opens, fulfils, cancels and expires orders |
| [Claims](/protocol/claims-contract) | Verifier keys per network and epoch, spent nullifiers | Checks a payment claim's signature and stops replays |

## Design rules

* **Only Stellar settles.** Every payable order is backed by exact, reserved, native Stellar USDC in the escrow. Bridge receipts, pending deposits and yield positions are never counted.
* **No privileged path.** USDC leaves the escrow only to the order's taker (on release), back to the depositor (on unlock), or to the depositor who withdraws unlocked funds. The admin cannot move escrowed USDC.
* **Fail before the fiat.** Anything that could block a release (rate, limits, rail terms, allowed takers) is checked when the order opens, before anyone pays.
* **One payment, one order.** The claim's nullifier is derived from the provider's transaction ID and is spent once.
* **7-decimal amounts.** All amounts are Circle USDC in Stellar's 7-decimal units. 20 USDC is `200_000_000`.

## Roles

| Role | Buy | Sell |
| - | - | - |
| Depositor (USDC locked, sets rate, receives fiat) | LP | User |
| Taker (pays fiat, proves, receives USDC) | User | LP |
| Payee account | LP's Wise | User's Wise or bank |

The **transfer prover** is always the party who made the fiat payment. In a buy that is the user; in a sell it is the LP.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.