Blend migration

migrate_from_blend moves a Blend V2 position to XOXNO in one transaction. The controller repays your Blend debt, withdraws your Blend collateral and non-collateral supply, deposits what it withdrew as XOXNO collateral, and runs a final health check before it persists anything. If any step fails, the whole transaction rolls back on both protocols.

Entrypoint

migrate_from_blend(
    caller: Address,
    account_id: u64,                    // 0 creates a new account
    spoke_id: u32,
    hub_id: u32,
    blend_pool: Address,                // must be governance-approved
    collateral_assets: Vec<Address>,    // WithdrawCollateral, sweep-all
    supply_assets: Vec<Address>,        // Withdraw (non-collateral supply), sweep-all
    debt_caps: Vec<(Address, i128)>,    // (debt_asset, max_repay_cap)
) -> u64

Parameter	Semantics
`caller`	Must authorize the call, and must hold the account’s position NFT or be an active delegate on it. Owns the Blend position being migrated.
`account_id`	`0` creates a fresh account bound to `spoke_id`; non-zero merges into an existing account the caller owns or is delegated on, and the spoke must match (`#310 SpokeMismatch`).
`blend_pool`	Target Blend pool. Must pass `is_blend_pool_approved` or the call reverts with `#42 BlendPoolNotApproved`.
`collateral_assets`	Blend collateral tokens to withdraw. Each uses `WithdrawCollateral` with `i128::MAX` internally.
`supply_assets`	Blend non-collateral supply to withdraw. Each uses `Withdraw` with `i128::MAX`. Deposited as XOXNO collateral.
`debt_caps`	Per debt asset, the maximum the controller may borrow to repay Blend. Must be ≥ actual Blend debt.

At least one of {collateral_assets, supply_assets, debt_caps} must be non-empty.

Atomic flow

Repay Blend debt (internal zero-fee strategy borrow)
Withdraw Blend collateral / supply
Supply into XOXNO
Health factor / LTV check

One controller call. Any revert rolls back Blend and XOXNO changes.

Debt sourcing

Migration does not use the flash-loan receiver pattern. It uses an internal zero-fee strategy borrow:

Mechanism	`flash_loan`	Migration borrow
Entrypoint	`controller.flash_loan`	`execute_migration_debt_leg` inside `migrate_from_blend`
Pool call	`pool.flash_loan` → receiver callback	`pool.create_strategy`
Fee	Configured bps	0
Debt outcome	Repaid in same callback	Permanent debt on the migrated account
Receiver contract	Required	None
Solvency check	At callback end	At `strategy_finalize`

Refund reconciliation

debt_caps are upper bounds, not exact debt amounts. You set each cap at or above the real Blend debt, and Blend refunds whatever it did not need. The controller detects that refund by balance delta (reconcile_debt_refunds) and repays it straight back down (repay_debt_from_controller). So your migrated XOXNO debt equals your actual Blend debt, not the cap you passed. Over-sizing a cap costs you nothing.

Looped positions

When the same token is both collateral and debt (for example USDC collateral plus USDC debt), the controller uses a two-phase submit:

Phase 1 — repay debt with an isolated balance snapshot so refunds do not alias with withdrawals.
Phase 2 — withdraw collateral and supply with a fresh snapshot.

The same asset may appear in both collateral_assets and debt_caps — that is the looped case above. What is not allowed is listing the same asset twice within debt_caps, which reverts with #7 AssetsAreTheSame.

Blend request types

Request	Constant	Amount	Purpose
Repay	`REQ_REPAY = 5`	`cap` from `debt_caps`	Clear Blend debt
WithdrawCollateral	`REQ_WITHDRAW_COLLATERAL = 3`	`i128::MAX`	Sweep all collateral
Withdraw	`REQ_WITHDRAW = 1`	`i128::MAX`	Sweep non-collateral supply

Non-collateral Blend supply becomes collateral on XOXNO. XOXNO has no non-collateral supply concept.

Authorization

Leg	Who authorizes
`migrate_from_blend`	`caller.require_auth()`
Blend `submit(from=caller)`	Caller in the transaction auth tree (per phase)
`transfer(controller → blend_pool, cap)`	Controller `authorize_as_current_contract` before repay submit

Reentry guard

guarded_submit sets FlashLoanOngoing during Blend calls. Mutating controller entrypoints reject reentry while the guard is set (#400 FlashLoanOngoing).

Governance

Blend pools are allow-listed through governance:

# Schedule via governance (production):
propose(proposer, AdminOperation::ApproveBlendPool(blend_pool_address), salt)
# → execute after the timelock delay

Query approval with is_blend_pool_approved(blend_pool). Only governance-approved Blend pools can migrate.

Events

BlendMigrationEvent {
    topics: ["strategy", "blend_migration"],
    account_id,
    blend_pool,
    collateral_count,
    supply_count,
    debt_count,
}

Failure modes

Condition	Error
All three of `collateral_assets`, `supply_assets`, and `debt_caps` are empty	`#16 InvalidPayments`
Unapproved `blend_pool`	`#42 BlendPoolNotApproved`
Duplicate debt asset in `debt_caps`	`#7 AssetsAreTheSame`
`debt_cap` below actual Blend debt	Blend health check reverts; everything rolls back
End state fails health, LTV, or the minimum-collateral floor	`#100 InsufficientCollateral` at finalize
Caller does not own or is not delegated on the target account	`#44 NotAuthorized`
Target account is on a different spoke	`#310 SpokeMismatch`
A flash loan is in flight	`#400 FlashLoanOngoing`

Example invoke

stellar contract invoke --id <controller> --network <network> \
  --source <user> \
  -- migrate_from_blend \
  --caller <user> \
  --account-id 0 \
  --spoke-id 1 \
  --hub-id 1 \
  --blend-pool <approved_blend_pool> \
  --collateral-assets '[<XLM>]' \
  --supply-assets '[]' \
  --debt-caps '[["<USDC>", "1000000000"]]'

Set each debt_cap to at least the actual Blend debt for that asset. Use get_account_positions and Blend views to size caps before invoking.

Strategies

Multiply, swap debt, swap collateral, and repay-with-collateral flows.

Flash loans

The flash-loan receiver pattern — distinct from migration’s zero-fee borrow.

Accounts and risk

Account model, health factor, and spoke constraints after migration.

Controller ABI

Full migrate_from_blend signature and related admin entrypoints.

Start here

Concepts

Integration guides

Reference

Operations

Entrypoint

Atomic flow

Debt sourcing

Refund reconciliation

Looped positions

Blend request types

Authorization

Reentry guard

Governance

Events

Failure modes

Example invoke

Next

Strategies

Flash loans

Accounts and risk

Controller ABI

​Entrypoint

​Atomic flow

​Debt sourcing

​Refund reconciliation

​Looped positions

​Blend request types

​Authorization

​Reentry guard

​Governance

​Events

​Failure modes

​Example invoke

​Next

Strategies

Flash loans

Accounts and risk

Controller ABI

Entrypoint

Atomic flow

Debt sourcing

Refund reconciliation

Looped positions

Blend request types

Authorization

Reentry guard

Governance

Events

Failure modes

Example invoke

Next