Central Pool

Central Pool

The central pool holds lending tokens and accounts for supply, debt, interest, and protocol revenue. The controller owns the pool in the repository's deployment flow and authorizes its accounting mutations.

One custodian, separate market books

A market is identified by a hub asset: a hub ID and token address. Every market has its own cash balance, supply and debt shares, indexes, revenue shares, and rate settings.

The same token can appear in several hubs. Those markets have separate accounting, while their tokens share one physical balance in the pool contract. Separate market books do not isolate the effects of a malicious token contract.

The pool does not own user accounts or decide account health. The controller manages account authority, spoke rules, caps, and price-based risk checks; the pool enforces its cash and accounting constraints. See Architecture Overview and Controller.

Cash is available liquidity

Market cash is recorded in native token base units. It is distinct from both supplied shares and the token contract's reported pool balance.

Flow	Effect on booked cash
Supply	Credit the receipt measured by the controller
Repayment	Credit the applied repayment; refund excess
Borrow	Debit the amount sent
Withdrawal	Debit the net payout after any liquidation fee
Charged strategy borrow	Debit principal less the withheld fee
Cash flash loan	Return principal within the call; credit the fee
Revenue claim	Debit the amount paid
Recapitalization	Credit only the amount applied to the backing shortfall
Same-market net settlement	No cash movement

Sending tokens directly to the pool does not increase lendable cash or mint shares. Supported inbound flows measure receipts before accounting; this handles under-delivery where supported but does not make arbitrary rebasing, dishonest balance reporting, or token hooks safe.

Liquidity and backing checks

Every outgoing market cash debit must fit its booked cash. A healthy account can still fail to borrow or withdraw when its market lacks liquidity.

Borrow draws also preserve a liquidation cash buffer equal to 200 BPS of the floor-valued supplied amount. Strategy debt openings use the same borrow checks on the full principal before withholding any fee. Ordinary borrowing, user withdrawals, and revenue claims enforce the configured maximum utilization. Liquidation withdrawals skip that utilization gate.

Withdrawals, same-market net settlement, and revenue claims reject a state with no total supply but outstanding debt. Separately, new supply rejects a market whose floor-valued supplier claims exceed cash plus ceiled outstanding debt.

Bad-debt socialization can lower the supply index to its nonzero floor and leave a backing shortfall. Recapitalization contributes tokens without receiving supply shares, applies no more than that shortfall, and refunds any excess. A direct donation does not substitute for this accounted recovery flow. The equations are in Accounting and Numeric Domains.

Shares, interest, and revenue

Supply and debt balances are stored as shares against their respective indexes. Market operations accrue elapsed interest before applying their accounting changes. Rate-model updates accrue using the old settings before installing the replacement.

Protocol revenue is a supply-share claim included in total supplied shares. It participates in the supply index, so it can gain interest and bear a bad-debt write-down alongside other suppliers. Sources include reserved borrow interest, cash flash-loan fees, charged strategy fees, liquidation fees, and seized collateral reclassified as revenue.

A claim pays at most the lesser of booked cash and the floor-valued revenue claim, subject to market guards. The pool burns the corresponding revenue and total supply shares, then pays its owner, the controller. The controller forwards its measured receipt to the configured accumulator. Revenue is an outstanding claim, not a cumulative earnings counter.

See Interest Rates for accrual and Risk and Liquidations for seizure and socialization.

Atomic operations

Cash Flash Loans are settled with exact token-balance checks around payout, callback, and repayment. The pool computes the fee from market settings and pulls principal plus fee through token allowance. These calls leave no lending debt position.

Account Strategies can open debt before later collateral arrives, but the controller must finish account risk checks before the transaction succeeds. Same-market collateral repayment offsets supply and debt without a token transfer. Fee-free strategy openings and cash flash loans have different settlement rules.

Authority and views

Pool market mutations, interest maintenance, and WASM upgrades require owner authorization. The pool exposes no separate ownership-transfer endpoint. Read-only views are open.

Reserve views return booked cash. Ordinary pool amount, revenue, rate, and utilization views use stored indexes. Bulk index views project accrued indexes to the current ledger without writing them. A view is therefore not a guarantee of the amount or liquidity available to a later transaction.

A pool upgrade changes the code serving every market. Market separation is an accounting boundary, not separate upgrade authority.

References

• Architecture reference
• Endpoint reference
• Accounting and Numeric Domains
• Governance and Timelock