You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/fassets/2-minting.mdx
+15-14Lines changed: 15 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ The choice is based on the minting fee or the amount of free collateral, which m
30
30
The minter sends to the Asset Manager contract a collateral reservation transaction (CRT). The CRT includes:
31
31
32
32
- The address of the chosen agent.
33
-
- The amount to mint, which must be a whole number of [lots](/fassets/minting#lots).
33
+
- The amount to mint, which must be a positive integer of [lots](/fassets/minting#lots).
34
34
- The [collateral reservation fee (CRF)](#fees) to compensate for the locked collateral.
35
35
- The executor's address, if the minter is not the executor.
36
36
- The executor's fee, if the minter is not the executor.
@@ -51,7 +51,8 @@ The collateral reservation response is an event issued by the contract, which in
51
51
52
52
### 2. Underlying Payment
53
53
54
-
After this event is emitted, the minter must pay the full underlying amount plus the fee to the agent on the underlying chain in a certain amount of time.
54
+
After this event is emitted, the minter must pay the full underlying amount plus the fee to the agent on the underlying chain.
55
+
This payment must be completed within a specified time limit.
55
56
56
57
### 3. Payment Proof
57
58
@@ -148,11 +149,11 @@ The [agent's registration process](/fassets/overview#agents) verifies that the a
148
149
The following example shows proof of nonpayment.
149
150
150
151
<details>
151
-
<summary>Proof of nonpayment example.</summary>
152
+
<summary>Referenced payment nonexistence attestation type example.</summary>
152
153
153
154
The following example shows how the nonpayment proof works.
154
155
155
-
The Data Connector's [payment nonexistence attestation type](https://gitlab.com/flarenetwork/state-connector-protocol/-/blob/main/specs/attestations/active-types/ReferencedPaymentNonexistence.md?ref_type=heads) proves nonpayment.
156
+
The Flare Data Connector's [referenced payment nonexistence attestation type](/fdc/attestation-types/referenced-payment-nonexistence) proves nonpayment.
156
157
157
158
1. The minter sends a request to mint FBTC.
158
159
At the time the request is received, the last mined block on the Bitcoin chain is number 92, with timestamp 09:00 AM.
@@ -172,7 +173,7 @@ The Data Connector's [payment nonexistence attestation type](https://gitlab.com/
172
173
5. The agent sends a nonpayment attestation request, which includes the payment reference, the underlying amount that was expected, the last block (100), and the last timestamp (11:00).
173
174
6. Attestation providers attest to the following facts:
174
175
- Block 102 is finalized and has both the number and timestamp larger than required.
175
-
-Until this block, the required payment either was not made or was not sufficient.
176
+
-Before this block, the required payment either was not made or was not sufficient.
176
177
177
178
Now, the mint-payment failure and the nonpayment proof can be submitted to the FAssets system.
178
179
@@ -188,14 +189,14 @@ FAssets are still transferred to the minter's account, and the agent's collatera
188
189
189
190
### Expired proof
190
191
191
-
Proofs provided by the Data Connector are available for only 24 hours, approximately.
192
+
Proofs provided by the Flare Data Connector are available for only 24 hours, approximately.
192
193
If neither the minter nor the agent presents the proof of payment or nonpayment within 24 hours, the regular minting process cannot continue, and the agent's collateral could be locked indefinitely.
193
194
194
195
In this case, the agent can still recover the collateral by buying it back with native tokens.
195
196
The recovery is accomplished with the following procedure:
196
197
197
198
1. Request the proof from the time when the deposit should have happened.
198
-
The Data Connector's answer will indicate that payments proofs are no longer available for that time.
199
+
The Flare Data Connector's answer will indicate that payments proofs are no longer available for that time.
199
200
2. Provide the amount of FLR collateral equivalent to the price of the underlying assets that should have been deposited.
200
201
3. Present the proof.
201
202
@@ -214,7 +215,7 @@ The maximum duration of the process is the sum of:
214
215
- A system-defined maximum time for deposit.
215
216
It is either a few blocks on the underlying chain or a few minutes, whichever is longer.
216
217
- The underlying chain's finalization time.
217
-
- The Data Connector proof time, which is approximately 3 - 5 minutes, independent of the underlying chain.
218
+
- The Flare Data Connector proof time, which is approximately 3 - 5 minutes, independent of the underlying chain.
218
219
219
220
On fast chains like XRPL, the maximum total time is less than 10 minutes, while on Bitcoin it is approximately 1.5 hours.
220
221
For payment failures, the agent needs to wait the maximum time, as defined above, before the nonpayment proof can be retrieved.
@@ -243,11 +244,11 @@ The following example shows how the redemption queue works.
243
244
<details>
244
245
<summary>Redemption queue example.</summary>
245
246
246
-
1.Bob mints 10 FXRP with Agent 1.
247
-
2.Alice mints 20 FXRP with Agent 2.
247
+
1.Alice mints 10 FXRP with Agent 1.
248
+
2.Bob mints 20 FXRP with Agent 2.
248
249
3. Charlie mints 5 FXRP with Agent 1.
249
250
250
-
After Bob, Alice, and Charlie have minted their FAssets, the redemption queue according to the FIFO method is:
251
+
After Alice, Bob, and Charlie have minted their FAssets, the redemption queue according to the FIFO method is:
251
252
1. Agent 1 with 10 FXRP.
252
253
2. Agent 2 with 20 FXRP.
253
254
3. Agent 1 with 5 FXRP.
@@ -265,7 +266,7 @@ The following example shows how the redemption queue works.
265
266
266
267
## Lots
267
268
268
-
Every minting and redemption must be made in a whole number of lots.
269
+
Every minting and redemption must be made in a positive integer of lots.
269
270
Lots serve the following purposes:
270
271
271
272
- They prevent underlying transaction fees from exceeding minting or redemption fees.
@@ -284,9 +285,9 @@ Some processes generate a fractional number of lots:
284
285
285
286
- On minting, part of the minting fee is minted as the FAsset fee to the collateral pool.
286
287
This value is usually less than 1 lot.
287
-
- When the lot size is changed, redemptions close only a whole number of lots of each redemption ticket, which leaves the remainder unredeemed.
288
+
- When the lot size is changed, redemptions close only a positive integer of lots of each redemption ticket, which leaves the remainder unredeemed.
288
289
289
-
These amounts, known as dust, cannot be redeemed directly because redemption requires a whole number of lots.
290
+
These amounts, known as dust, cannot be redeemed directly because redemption requires a positive integer of lots.
290
291
291
292
In such cases, the generated dust is not included in any redemption ticket.
292
293
Instead, each agent's dust is accumulated until the dust amounts to a whole lot.
Copy file name to clipboardExpand all lines: docs/fassets/3-redemption.mdx
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ To do so, these holders, known as redeemers, send FAssets to the Asset Manager s
11
11
12
12
This is the summary of the redemption process:
13
13
14
-
1. The redeemer starts the redemption for a whole number of lots by issuing a request to the Asset Manager smart contract.
14
+
1. The redeemer starts the redemption for a positive integer of lots by issuing a request to the Asset Manager smart contract.
15
15
16
16
The FAssets system chooses one or more redemption tickets from the front of the [FIFO redemption queue](/fassets/minting#redemption-tickets-and-the-redemption-queue).
17
17
The number of chosen redemption tickets is capped to avoid high gas consumption.
@@ -24,7 +24,7 @@ This is the summary of the redemption process:
24
24
For every agent participating in the redemption, the system issues an event with the following redemption payment information:
25
25
- Redeemer's underlying address.
26
26
27
-
Agents can use the Data Connector to ensure the validity of this address.
27
+
Agents can use the Flare Data Connector to ensure the validity of this address.
28
28
Otherwise, malicious redeemers could provide an address that systematically blocks payments and exploit the redeeming process to their advantage.
29
29
30
30
- Amount to pay minus the fee that was already subtracted.
@@ -67,7 +67,7 @@ If the agent does not report the failed payment in time, anyone (including the e
67
67
68
68
:::info
69
69
70
-
When payment fails because of the redeemer, the agent can obtain a proof of the failed payment from the Data Connector and present it to the FAssets system.
70
+
When payment fails because of the redeemer, the agent can obtain a proof of the failed payment from the Flare Data Connector and present it to the FAssets system.
71
71
The agent's obligation is then fulfilled, and he can keep both the collateral and the underlying.
72
72
73
73
Two different proofs can be used:
@@ -76,13 +76,13 @@ If the agent does not report the failed payment in time, anyone (including the e
76
76
* Proof of blocked payment: Even if the address is valid, it might contain a contract that blocks the payment.
77
77
This can only happen on underlying networks supporting smart contracts.
78
78
79
-
The agent must still try to pay and, if the payment is blocked, the agent can request this proof from the Data Connector and present it to the FAssets system.
79
+
The agent must still try to pay and, if the payment is blocked, the agent can request this proof from the Flare Data Connector and present it to the FAssets system.
80
80
81
81
:::
82
82
83
83
During step 4 above, if any agent does not pay on the underlying chain, the redeemer completes the following procedure separately for each nonpaying agent:
84
84
85
-
1. The redeemer obtains a proof of nonpayment from the Data Connector.
85
+
1. The redeemer obtains a proof of nonpayment from the Flare Data Connector.
86
86
2. The redeemer presents the nonpayment proofs to the FAssets system, which triggers a redemption failure.
87
87
3. The redeemer is paid with collateral, according to the current price plus a premium.
88
88
4. FAssets are overcollateralized, so, even after paying the redeemer with a premium, a remainder is released.
@@ -107,7 +107,7 @@ After enough time for the agent to present the proof has elapsed, anyone, includ
107
107
108
108
### Expired proof
109
109
110
-
Proofs provided by the Data Connector are available for only 24 hours, approximately.
110
+
Proofs provided by the Flare Data Connector are available for only 24 hours, approximately.
111
111
If neither the redeemer, the agent, nor the executor presents the proof of payment or nonpayment within 24 hours, the regular redeeming process cannot continue, and the agent's collateral could be locked indefinitely.
112
112
113
113
The procedure to recover this collateral is the same as the procedure in the minting case.
@@ -135,4 +135,4 @@ As shown in the following process, agents can self-redeem for any reason, includ
135
135
3. The collateral that was backing those assets is released.
136
136
4. The underlying collateral is released and can be withdrawn from the underlying address later.
137
137
138
-
The self-redeemed amount is not limited to a whole number of lots and can be less than 1 lot, which makes self-closing ideal for redeeming an agent's dust.
138
+
The self-redeemed amount is not limited to a positive integer of lots and can be less than 1 lot, which makes self-closing ideal for redeeming an agent's dust.
Copy file name to clipboardExpand all lines: docs/fassets/4-collateral.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,7 +35,7 @@ If governance deprecates a type, agents must switch to a supported type.
35
35
Each vault is associated with a single, unique address on the underlying chain called the agent's underlying address.
36
36
It receives underlying assets when they are minted into FAssets and sends underlying assets to the redeemer's address when they are redeemed.
37
37
38
-
When an agent creates a vault, the underlying address is checked for validity using the Data Connector.
38
+
When an agent creates a vault, the underlying address is checked for validity using the Flare Data Connector.
39
39
Otherwise, malicious agents could provide an address that systematically blocks payments and exploit the [minting process](/fassets/minting) to their advantage.
Copy file name to clipboardExpand all lines: docs/fassets/5-core-vault.mdx
+45-25Lines changed: 45 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,35 +22,44 @@ import useBaseUrl from "@docusaurus/useBaseUrl";
22
22
/>
23
23
24
24
The **Core Vault (CV)** is a specialized FAsset system vault that operates on the underlying network.
25
-
It allows FAsset agents to deposit and withdraw underlying assets while optimizing capital efficiency through reduced collateral requirements.
26
-
The CV was introduced in **FAssets v1.1** to solve key limitations of v1, such as limited minting capacity, high collateral burdens, and poor agent exit flexibility.
25
+
It addresses a critical challenge in cross-chain systems: **protecting user funds from malicious agents while maintaining system scalability.**
27
26
28
-
Only whitelisted users can withdraw from the Core Vault.
27
+
### Why the Core Vault?
29
28
30
-
The Core Vault is:
29
+
- In **FAssets v1**, every agent had to keep the underlying asset (e.g., XRP) in their own wallet.
30
+
- To prevent theft, agents needed to be heavily overcollateralized - they had to lock up more value than they could ever profit from stealing.
31
+
- This worked, but it limited minting capacity and made the system capital-inefficient.
31
32
32
-
- A **multisig-controlled reserve** that enhances **agent liquidity and profitability**
33
-
- Integrated into the **FAssets smart contract system** on Flare
34
-
- Designed to operate with **manual, auditable, and time-bounded signing routines**
35
-
- Supported by **escrow-based fund throttling** to mitigate security risk
33
+
The **Core Vault** changes this model:
36
34
37
-
FAsset users don't need to take any action to benefit from CV — it automatically integrates with FXRP and other v1 tokens.
35
+
- Instead of holding XRP in their own wallets, **agents can transfer underlying assets into a shared, insured vault**.
36
+
- The vault is **multisig-controlled** and governed by Flare, so agents cannot unilaterally take the funds.
37
+
- Because theft is structurally prevented, agents no longer need extreme levels of overcollateralization.
38
+
39
+
The Core Vault prevents agents from running away with XRP while simultaneously lowering collateral requirements and improving system scalability.
40
+
41
+
### Key Properties
42
+
43
+
-**Secure by design**: Agents cannot withdraw underlying assets directly.
44
+
-**Capital efficient**: Agents can mint more FAssets with less collateral.
45
+
-**System-wide liquidity**: Assets in the CV form a shared pool available to all agents.
46
+
-**Governance oversight**: Multisig with pause controls and time-bounded fund release.
47
+
48
+
Introduced in **FAssets v1.1**, the Core Vault enables the system to expand its minting capacity while maintaining the same strong guarantees of safety for users.
38
49
39
50
## Key Features
40
51
41
52
### Transfer Capacity
42
53
43
-
A system parameter defines the minimum percentage of minting capacity (based on collateral) that must remain on an agent's address after transferring assets to the CV.
44
-
This ensures redemption liquidity and protects the system from agent insolvency.
54
+
To ensure redemption liquidity, a parameter enforces that after transferring assets to the Core Vault, **an agent must still maintain a minimum portion of minting capacity outside the CV**.
55
+
This prevents agents from moving everything into the vault and leaving the system unbalanced.
45
56
46
57
### Security Design
47
58
48
-
Each asset type has a dedicated Core Vault, which is managed by a multisig account on the underlying network under a formal agreement with Flare.
49
-
The assets stored in the CV do not belong to any specific agent and can be requested to return to the agent's collateralized security.
50
-
To ensure security, governance has the authority to pause deposits and withdrawals if necessary, such as in the event of a system compromise.
51
-
52
-
The Core Vault operates through a predefined address on the underlying chain and is managed via a multisig setup with smart contract oversight under formal Flare contracts.
53
-
Governance has the authority to pause operations in the event of a security issue.
59
+
- Each supported asset (XRP, BTC, DOGE, etc.) has its **own dedicated Core Vault**.
60
+
- Each CV is a **multisig account on the underlying chain**, operated under a formal governance agreement with Flare.
61
+
- Funds in the CV **no longer belong to a single agent** - they are pooled, with withdrawals only allowed under system rules.
62
+
- Governance can pause deposits or withdrawals if suspicious activity is detected.
54
63
55
64
## Core Vault Implementation
56
65
@@ -61,21 +70,21 @@ The Core Vault operates differently depending on the underlying network:
61
70
**For XRP Ledger (XRP CV):**
62
71
63
72
- The CV is implemented as a **multisig account** on the XRP Ledger.
64
-
- Only the designated**multisig signers** can move XRP from the vault.
73
+
- Only the authorized**multisig signers** can move XRP from the vault.
65
74
- These signers are authorized by Flare governance and operate under formal agreements.
66
75
- All outgoing transactions require multiple signatures from the authorized signers.
67
76
68
-
### Agent Ownership Clarification
77
+
### Agent Ownership vs. Core Vault Ownership
69
78
70
79
There's an important distinction between agent ownership and CV ownership:
71
80
72
-
### Agent Ownership (Standard FAssets)
81
+
####Agent Ownership (Standard FAssets)
73
82
74
83
- Agents hold underlying assets in their own wallets.
75
84
- These assets belong to the specific agent and are part of their collateral.
76
85
- Agents have direct control over these assets.
77
86
78
-
### Core Vault Ownership
87
+
####Core Vault Ownership
79
88
80
89
- Assets transferred to the CV become part of a shared pool.
81
90
- These assets **do not belong to any specific agent** once in the CV.
@@ -90,7 +99,7 @@ Agents are required to provide collateral in the form of:
90
99
-**USDC/USDT (stablecoins)**
91
100
92
101
When agents transfer underlying assets to the CV, they can reduce their collateral requirements while maintaining their minting capacity.
93
-
The CV acts as a shared reserve that backs the system, allowing agents to operate more efficiently.
102
+
The CV effectively acts as an **insurance-backed reserve** that boosts efficiency without weakening security.
94
103
95
104
## Operational Workflow
96
105
@@ -102,7 +111,7 @@ The CV acts as a shared reserve that backs the system, allowing agents to operat
102
111
103
112
2.**Proof of Payment Submitted**
104
113
105
-
Anyone (including the agent) submits a proof of the transfer to the FAsset system.
114
+
Anyone (including the agent) submits the proof of the transfer to the FAsset system.
106
115
107
116
3.**Verification and Redemption**
108
117
@@ -127,7 +136,7 @@ There is no time limit for the CV to honor the request, but governance ensures t
127
136
#### Direct Redemption (Users)
128
137
129
138
Approved users can burn FXRP and receive underlying XRP from the CV.
130
-
This Requires KYC approval and a minimum redemption threshold.
139
+
This requires KYC approval and a minimum redemption threshold.
131
140
It is typically processed once per day and has a lower priority than agent return requests.
132
141
It is helpful for large, less time-sensitive redemptions.
133
142
@@ -157,7 +166,7 @@ Multisig signers validate all outgoing transactions against a pre-approved rule
157
166
158
167
2.**Withdrawals & Payouts**
159
168
160
-
Users request withdrawals; multisig operators validate Flare's offchain instructions and process payouts.
169
+
Users request withdrawals; multisig operators validate Flare's off-chain instructions and process payouts.
161
170
162
171
3.**Re-escrow Excess & Maintain Reserve**
163
172
@@ -170,3 +179,14 @@ Three escrows are created if `remaining_funds = M + 3L`, and M stays in the wall
170
179
The XRP Core Vault features enhanced security measures for managing daily liquidity, including escrow time-locking and a minimum reserve in multisig setups. It has an emergency pause function and "Red Alert Mode" for urgent threats.
171
180
172
181
In case of a security issue, all signing is halted pending governance review. Escrow accounts may be unlocked to prevent asset loss, with governance overseeing the restoration of operations. Only one escrow can be unlocked per day, minimizing potential damage.
182
+
183
+
## Summary
184
+
185
+
The **Core Vault** fundamentally strengthens FAssets:
186
+
187
+
-**Prevents loss of underlying assets** by removing agent control over pooled funds.
188
+
-**Lowers collateral burdens**, improving capital efficiency.
189
+
-**Expands minting capacity**, making the system more scalable.
190
+
-**Adds layered security**, combining multisig, escrow, and governance controls.
191
+
192
+
It is the key to making cross-chain assets on Flare both **secure** and **efficient**.
0 commit comments