Protocol control structure
Fuel Credit separates administrative authority, price signing, and permissionless protocol actions. No single role can rewrite loan terms or bypass contract accounting.
Control map
| Capability | Who can act | Contract guard |
|---|---|---|
| Add FUEL or USDC liquidity | Any wallet | Only configured assets and positive amounts are accepted |
| Open a loan | Any borrower | Valid current price attestation, supported term, exact FUEL payment, and sufficient USDC liquidity |
| Repay a loan | Its borrower | Active loan, USDC payment, and strictly before maturity |
| Finalize a matured loan | Any wallet or bot | Active loan and timestamp at or after maturity |
| Withdraw idle pool funds | Current owner | Cannot withdraw locked borrower collateral or unavailable balances |
| Transfer ownership | Current owner | New address must be nonzero and different |
| Replace the price oracle | Current owner | New address must be nonzero and different |
| Sign FUEL prices | Current price oracle | Attestation is domain-, chain-, contract-, price-, and timestamp-bound |
Owner
INITIAL_OWNER sets the owner at deployment. Thereafter, owner() is authoritative.
The current owner can:
- withdraw only idle FUEL or USDC;
- transfer ownership with
transfer_ownership(new_owner); - replace the oracle signer with
set_price_oracle(new_price_oracle).
The owner cannot:
- modify existing loan terms;
- withdraw locked borrower collateral;
- repay or seize an active loan early;
- mark a loan delinquent before maturity;
- bypass asset, balance, status, or accounting checks.
Ownership transfer takes effect immediately. The former owner loses withdrawal, transfer, and oracle-rotation authority.
Price oracle
INITIAL_PRICE_ORACLE sets the first signer. Thereafter, price_oracle() is authoritative.
The oracle signs only a current FUEL price and timestamp. It does not choose the borrower, collateral amount, term, LTV, principal, fee, maturity, or repayment rules; the contract computes and enforces those values.
The oracle key does not need transaction funds because signing occurs offchain. If the key is lost or compromised, the current owner can replace it. Old-key signatures stop verifying immediately after rotation, including otherwise-unexpired attestations.
Permissionless actions
Pool funding and matured-loan finalization do not require a privileged wallet. This allows independent liquidity providers and automation bots to participate without receiving administrative authority. All callers pass the same contract checks.
Recovery boundaries
| Loss scenario | Recovery path |
|---|---|
| Oracle key lost or compromised | Owner rotates to a new oracle address |
| Owner key lost | No onchain recovery unless ownership was transferred beforehand |
| Both keys lost | No privileged recovery path |
| Indexer or application unavailable | Contract state and direct contract calls remain authoritative |
Owner and oracle keys must remain separate, with encrypted offline recovery backups. A production owner should use custody appropriate for its withdrawal and rotation authority.
Deployment and verification
Deployment tooling records the initial owner and oracle. Because both can change, deployment files are historical configuration—not proof of current authority. Verify live control with:
owner()
price_oracle()The release build is deployed on testnet; owner() and price_oracle() were verified after deployment. Testnet pools remain unfunded and mainnet remains gated by the prerequisites listed in Deployments.