XOXNO Stellar Lending ships more than basic supply and borrow. The hub-and-spoke foundation plus three core contracts (governance, controller, pool) enable timelocked changes, atomic migration from Blend, spoke-specific liquidation economics, flash loans, and strategy composition.
All of these are described in the rs-lending-xlm repository and the public docs.
Timelocked governance
Governance owns the controller. Roles (PROPOSER, EXECUTOR, CANCELLER, ORACLE) propose and execute admin operations through a timelock.
From ADR 0010 and SCF_BUILD_ARCHITECTURE.md:
- Risk, oracle, spoke, hub, and pool parameter changes are timelocked.
- Emergency pause and unpause remain immediate.
- Governance-self operations (role changes, upgrades) are also delayed.
Users see proposed changes before they take effect. The delay is on-chain and visible.
Blend migration
XOXNO provides a built-in migrate_from_blend entrypoint on approved pools listed in blend.json.
The flow (one transaction):
- Repay the user’s debt in the Blend pool.
- Withdraw the collateral.
- Open the equivalent supply/borrow position on the chosen XOXNO hub and spoke.
If any step fails the entire transaction reverts. Non-collateral supply on Blend is treated as collateral during migration.
See the XOXNO docs and the Blend migration banner in the app for the user path. The controller ABI exposes the call for integrators.
Per-spoke liquidation curves
ADR 0012 added a three-parameter curve per spoke:
- liquidation_target_hf_wad — health factor the liquidation restores the account toward (default 1.02).
- hf_for_max_bonus_wad — depth at which max bonus applies.
- liquidation_bonus_factor_bps — how aggressively the bonus ramps.
The math lives in the controller liquidation module. It sizes repayment to the target and interpolates the bonus linearly with health-factor depth. Spoke operators can tune via timelocked governance without a protocol upgrade.
INVARIANTS.md records the validation that keeps every curve within safe bounds.
Flash loans and strategies
Flash loans are controller-orchestrated and pool-settled:
- Snapshot pool balance.
- Transfer requested amount.
- Execute receiver callback.
- Verify final balance covers principal plus fee.
Strategies (multiply, collateral swap, debt swap, repay debt with collateral) route through the same controller. The aggregator output is untrusted; the controller validates the final balance delta against what the strategy promised.
DeFindex strategy adapters map one HubAssetKey + spoke to a controller account.
Shared liquidity with spoke risk
Because everything sits in one pool keyed by HubAssetKey, liquidity for USDC and XLM remains deep even when accounts use different spokes. Cross-asset health still works because the controller sees the whole account.
Spoke configs only affect the risk math and caps for that account’s actions.
Start here
The simplest on-ramp is still the two live markets:
- Supply USDC or XLM on the lending markets.
- Convert via the swap if you hold other assets.
From a healthy supply position you can explore multiply strategies or the Blend migration flow. For the architecture that makes these features possible across different spokes and the growing RWA set, read the hubs and spokes article. For how this compares to the other major lending design on Stellar, see the XOXNO vs Blend V2 comparison.
