Architecture

Protocol shape

Borrower wallet ── fuels-ts ── FuelCredit Sway contract
                                      ├── FUEL collateral and upfront fee in
                                      ├── USDC principal out
                                      ├── partial/full USDC repayment
                                      ├── proportional FUEL release
                                      └── terminal maturity finalization

Price oracle ── signed FUEL price + timestamp attestation ──┘

The release build is deployed on Fuel testnet, with its configured owner and price oracle verified by contract reads. Its pools are unfunded and the production application is not wired to it. Production currently provides quoting and an explicitly browser-only Burner simulation; production price-oracle operations, pool funding, transaction wiring, an independent audit, and mainnet deployment remain pending.

Contract configuration and storage

The protocol uses one Sway contract with:

• environment-specific FUEL and USDC asset IDs;
• an INITIAL_OWNER address and transferable current owner;
• a configurable INITIAL_PRICE_ORACLE and owner-rotatable current price-oracle address;
• chain- and contract-bound price attestations;
• six, nine, and twelve-month duration/LTV configurations;
• fixed 10% APY prorated into an upfront FUEL fee;
• immutable original loan terms;
• separate mutable repayment, collateral-release, default, and vault-claim fields;
• cumulative FUEL/USDC pool accounting.

Core calls

• fund_pool() allows any wallet to add FUEL or USDC.
• owner() returns the current owner address.
• transfer_ownership(new_owner) is owner-only and rejects the zero address and the current owner.
• price_oracle() returns the current oracle; set_price_oracle(new_oracle) is owner-only and rejects zero or unchanged addresses.
• withdraw_pool(asset_id, amount) is owner-only and can withdraw idle balances, never locked borrower collateral.
• price_attestation_digest_for(price, timestamp) exposes the canonical oracle digest.
• quote(collateral, term, price) computes principal and the complete upfront fee.
• open_loan(collateral, term, price, timestamp, signature) validates the attestation and payment, then atomically transfers USDC principal.
• repay(loan_id) accepts partial or full USDC principal strictly before maturity and releases FUEL pro rata.
• mark_delinquent(loan_id) is permissionless for active loans at or after maturity. It records remaining USDC as defaulted and makes unreleased FUEL vault-owned.
• get_loan() and pool_stats() expose loan and aggregate accounting.

Price attestations

The oracle signs:

domain_hash = sha256("FuelCredit:PriceAttestation:v1")
digest = sha256((domain_hash, chain_id, contract_id, fuel_usdc_price, price_timestamp))

Attestations expire after 300 seconds and are intentionally reusable across borrowers and supported terms while current. The contract—not the oracle—binds the caller as borrower, validates the term, computes LTV/principal/fee, checks exact FUEL payment, and enforces USDC liquidity.

Loan lifecycle

1. Any wallet may top up FUEL or USDC liquidity.
2. A borrower submits collateral, selected term, current attested price, timestamp, and oracle signature.
3. The borrower sends collateral plus the complete upfront FUEL fee.
4. The contract atomically transfers USDC principal.
5. Before maturity, partial repayments release collateral pro rata; final repayment releases all remaining collateral.
6. At maturity, repayment closes permanently. Any wallet or automation bot may finalize the loan.
7. Finalization records unpaid USDC as defaulted and unreleased FUEL as vault-owned.

Ownership and pools

See Protocol control structure for the complete authority and recovery matrix.

Funding is permissionless. Withdrawals remain restricted to the current owner and only to balances not locked as borrower collateral. Ownership can move through transfer_ownership; after transfer, the former owner immediately loses withdrawal, ownership-transfer, and oracle-rotation authority. The current owner can rotate a compromised or obsolete oracle without changing existing loan records.

Fuel Labs manages the ecosystem credit vault. Available FUEL may support market-making operations on Reactor and O2 and ecosystem collateral such as Moor, while recorded borrower and liquidity obligations must remain preserved.

Assets and networks

Use verified network-specific asset IDs. Current public network values and deployment status are recorded in Deployments. Fuel contract reads are authoritative for balances, loan state, ownership, and pool accounting.