Smart contract plugins for Orion Finance: onchain strategists, deposit access controllers, and external depositor helpers.

Each plugin implements a protocol-defined interface from @orion-finance/protocol.

If you have an idea for a strategist, access policy, or depositor flow, this is the place to build it, test it against the real protocol stack, and share it with others.

Development

Requires Node.js ≥ 22.13 and pnpm.

pnpm install
pnpm build
pnpm test
pnpm lint
pnpm coverage

@orion-finance/protocol is a direct GitHub dependency (2.7.2). precompile compiles it into node_modules before plugin builds and tests. Integration tests deploy the full protocol stack from those artifacts.

For protocol architecture and interface docs, see docs.orionfinance.ai.

Deploy

One Hardhat script deploys a single plugin. KBest operation (cron / submitIntent) stays in IOrionStrategist-template; this CLI is how you get an address. manager-only and non-transferable are safe to reuse across vaults; whitelist is per-manager.

PLUGIN	Contract	Extra env	What it does
whitelist	WhitelistAccessControl	OWNER (default: deployer)	Allowlist for deposit / holder / transfer
manager-only	ManagerOnlyDepositAccessControl	—	Only the vault manager may deposit
non-transferable	NonTransferableSharesAccessControl	—	Blocks P2P share transfers; redeem still works
tvl-cap	TvlCapDepositAccessControl	TVL_CAP	Caps projected vault TVL
nft	NftOwnerAccessControl	CREDENTIAL	Requires an ERC-721 credential
blacklist	BlacklistRejectAccessControl	DENYLIST	Rejects addresses on a denylist
signed-ticket	SignedTicketAccessControl	ATTESTER, EIP712_NAME, EIP712_VERSION	Off-chain signed tickets
ens	EnsSubtreeAccessControl	ENS_REGISTRY, ROOT_NODE	Wallet must resolve under an ENS root
eas	EasAccessControl	OWNER, EAS, SCHEMA_UID, TRUSTED_ATTESTERS, POLICY_MODE (0 email / 1 nationality), EMAIL_DOMAIN_HASH, COUNTRY_CODES	EAS attestation gate
all-of	AllOfDepositAccessControl	GATES (comma addresses)	AND-composes deposit gates
router	OrionDistributionRouter	SEPOLIA_ORION_CONFIG_ADDRESS	Distributor-routed requestDepositFor
tvl	KBestTvlWeightedAverage	SEPOLIA_ORION_CONFIG_ADDRESS, STRATEGIST_K (default 10), optional VAULT_ADDRESS (vault manager calls updateStrategist)	Top-K by TVL, TVL weights
apy-equal	KBestApyStrategist	same	Top-K by APY, equal weights
apy-weighted	KBestApyStrategist	same	Top-K by APY, APY weights

cp .env.example .env
PLUGIN=whitelist OWNER=0x... pnpm deploy:sepolia
PLUGIN=manager-only pnpm deploy:sepolia
PLUGIN=router pnpm deploy:sepolia

Required in .env: PRIVATE_KEY, SEPOLIA_RPC_URL. PLUGIN is set on the command. Writes deployments/<network>-<timestamp>.json.

SEPOLIA_ORION_CONFIG_ADDRESS is used by router, tvl, apy-equal, and apy-weighted only. Other plugins do not read it. On --network sepolia it defaults to 0xbDe3025d08681a02a1c6cf70375baBe2152DD06f. On every other network those four plugins require it; the script will not fall back to the Sepolia address.

Adding a new plugin

1. Implement the relevant interface from @orion-finance/protocol.
2. Add unit tests with mocks where possible.
3. Add integration tests using deployUpgradeableProtocol() from test/helpers/deployUpgradeable.ts.
4. Never import protocol implementation contracts in production plugin Solidity.

Contributing

We welcome contributions of all kinds! Bug reports, new plugins, tests, docs. See CONTRIBUTING.md to get started.