Architecture

Trust boundaries

The Vault, BondMarket, and moving-oracle Sway contracts are authoritative for positions, custody liabilities, listings, settlement, permissions, and opening prices. Cloudflare services provide indexing and submit permissionless oracle updates; they cannot create positions or change user-owned state without a signed Fuel transaction. The separate test-assets faucet is testnet-only and mints valueless assets directly to connected wallets.

Data flow

1. The Vault and BondMarket emit complete events with monotonic position/order IDs.
2. The API Worker queries finalized receipts from Envio HyperFuel every minute. Empty ranges advance only the cursor; projection and R2 writes run only when log receipts are present.
3. Each Envio page containing logs is written immutably to compressed R2.
4. ABI-decoded events are reduced idempotently into D1 by transaction and receipt ID.
5. D1 retains active/latest positions, orders, bounded activity, cursors, and reconciliation metadata.
6. Global statistics, marketplace discovery, and history are served from D1.
7. Connected account views call Vault::position_count and Vault::get_position directly, then match position NFT asset IDs against the wallet's live UTXOs.
8. Indexed account rows are merged only to retain escrowed listings, unbonding positions, claims, and history when the NFT is no longer in the wallet.
9. Fuel RPC/GraphQL reconciliation is required before the index is marked healthy.

Direct native NFT transfers that bypass the Vault transfer method are valid, so wallet UTXOs—not the indexed owner field—are authoritative for held positions.

Oracle

The shared simplified oracle samples the O2 Price Feed bid at most once every six hours and keeps a 120-sample rolling arithmetic mean. Its permissionless update() validates source prices and timestamps; price() fails closed after 25 hours without an accepted update.

The Vault validates price() and floors the 1e18 rolling bid to e6. There is no minimum sample count. Fuel Earn runs no oracle keeper; the independent updater attempts updates every 15 minutes. O2 source asset IDs never become Vault collateral IDs:

• Testnet source: O2 fFUEL 0x43eebd58e837c2e8fa94f1b2db1268175c551b5b1bf41a59fafc4f2c69ab7dc2 maps at the same per-unit rate to Fuel Earn tFUEL 0x35b4807838ac4087c393a1941a0dd02bb371c7201bb1bfdcd8563da91d060777 and tstFUEL 0xbe8c4c51d0a3d8f6f782bbc9c21b7f027f2fe3b6fdc070263dc58d07ded0a1de. O2's canonical testnet FUEL market currently has no published feed value.
• Mainnet source: native FUEL 0x27821a5432b60fb3e70c64d0a612c2c86218c1088dd0f0f1b0dd6ae5ae17bd5b.

Testnet FUEL and stFUEL use exactly the same O2 FUEL price while remaining distinct Vault collateral assets. This is an explicit testnet 1:1 simulation, not an independent stFUEL price. Mainnet stFUEL remains disabled until an authoritative rate is approved.

Storage

R2 stores complete compressed source evidence. D1 stores bounded current state. No unbounded raw receipts or decoded history belong in D1.