Seven contracts. One mathematics.
The whole protocol is seven contracts, and both of its engines are built the same way: a pure-math library at the base, imported by the working contracts, so no number is ever redefined and nothing trusts a value it did not compute. Five make the aggregator; two make the staking engine. Every address below is the real, verified deployment on Base; the same bytecode runs on Ethereum, Optimism and Arbitrum (full matrix in /verify).
The Aggregator Pentad
5 contracts“Five contracts, one of which is pure mathematics imported by the other four.” The Core computes; the Hub remembers; the Solver decides; the Router settles; the Quoter previews. Each exposes a single compact error path, keeping the revert surface as legible as the happy path.
Ω · 𝒟 · Φ · ΨNo storage, no owner, no upgrade path — only functions. The Eightfold Dispatcher Ω, Deterministic Derivation 𝒟, Iron Law Φ and Vitality Field Ψ live here as pure computations. Imported by the other four; no math is redefined anywhere else.
Ψ · registryHolds the candidate-pool registry (16 packed slots per pair), the vitality field and the bridge-token set, under ERC-7201 namespacing so its storage can never collide with a consumer’s slots.
𝒰(route)A pure read-path optimiser that maximises the meta-equation over routes and touches no state it cannot derive. It decides; it never settles.
Φ · executeThe single contract that moves value, and it moves it atomically under the caller’s minimum-output bound — re-deriving the Iron Law floor on-chain so a poisoned frontend can never lower it. Holds nothing at rest.
previewPlanMirrors the Solver for off-chain preview via previewPlan — by construction producing the same number the Router will realise. The quote IS the execution logic.
The Staking Dyad
2 contractsThe same discipline, applied to the protocol's own capital: a pure-math library and the engine that imports it. Because the collateral and the borrowed asset are the same token (BZPX), no price oracle exists anywhere — an entire attack surface is absent by construction.
mulDiv · rawBalanceOfThe full 512-bit multiply-then-divide every proportion flows through, plus rawBalanceOf — the staticcall that lets the contract read its OWN backing. All-internal, so it is inlined into the engine’s bytecode (no separate address), exactly as the Core is to the aggregator.
conservesOne contract doing what most protocols split across three — vault, lending market and lock-boost — reconciled through a single UserInfo record and two accumulators, every value-moving path wrapped in the conserves guard. 180M BZPX over 7 years; solvency is a revert condition, not a dashboard reading.
The one equation each engine stands on
The aggregator maximises a single objective over candidate routes — take the net output, but only from routes that clear the Iron Law floor, weighted by each pool's vitality:
The staking engine stands on the Master Conservation Identity — physical balance equals what the ledger owes, enforced per transaction by the conserves guard, so an insolvent state is unreachable, not merely observable:
== (totalStaked − totalDebt) + rewardReserve + protocolReserve
+ (totalRewardDistributed − totalRewardsPaid)
Read it live, for free, from the chain: /solvency (or isSolvent() · solvency() · auditInvariants()).
Verify the whole thing yourself
Nothing here asks for trust. The staking engine is live and solvent right now:
cast call 0x3f60C7aa0c36a78D200405feBE143d2Cf3fA0c77 "isSolvent()(bool)" --rpc-url https://mainnet.base.orgCode license: contracts are BUSL-1.1 until 2030 — read, audit and verify freely; production use needs a license. Partner, don't clone ›