Controller ABI

Call the controller to use lending. The controller owns the pool and authorizes its accounting calls. Signatures omit the Soroban-injected Env argument. Amounts use raw token units unless a scale is specified. Use the full HubAssetKey to identify a market. Construction uses __constructor(admin: Address) and leaves the controller paused. Types are defined in Data types. Error codes are listed in Errors. Events are listed in Events. Governance owns the controller. Configuration follows the governance execution rules.

Reading the tables

User and maintenance calls require the explicit caller, liquidator, or payer to authorize. The Auth column gives the additional account check. Admin calls require the controller owner to authorize. accept_ownership requires the pending owner.

Value	Meaning
`signature`	Any address may call; only the caller’s own signature is needed.
`owner`	Caller must hold the account’s position NFT.
`owner/delegate`	NFT holder, or an active governance-approved position manager registered as a delegate on that account.
`owner (contextual)`	Third parties may call, with a narrowed effect.

Pause: gated calls fail while the controller is paused. open calls remain available. Account, listing-flag, and pool checks still apply. Flash-loan guard: financial calls fail with #400 FlashLoanOngoing during a flash loan. Account renewal and delegate changes use their own authorization checks. The flash-position callback can use allowed controller calls; final account checks still apply.

Core lending

Function	Auth	Pause	Returns
`supply(caller, account_id, spoke_id, assets)`	`owner (contextual)`	gated	`u64`
`borrow(caller, account_id, borrows, to)`	`owner/delegate`	gated	`()`
`withdraw(caller, account_id, withdrawals, to)`	`owner/delegate`	open	`Vec<(HubAssetKey, i128)>`
`repay(caller, account_id, payments)`	`signature`	open	`()`

fn supply(caller: Address, account_id: u64, spoke_id: u32,
          assets: Vec<(HubAssetKey, i128)>) -> u64;

fn borrow(caller: Address, account_id: u64,
          borrows: Vec<(HubAssetKey, i128)>, to: Option<Address>);

fn withdraw(caller: Address, account_id: u64,
            withdrawals: Vec<(HubAssetKey, i128)>,
            to: Option<Address>) -> Vec<(HubAssetKey, i128)>;

fn repay(caller: Address, account_id: u64, payments: Vec<(HubAssetKey, i128)>);

supply creates accounts in PositionMode::Normal; see account creation for the zero-id convention.
A caller who is neither owner nor delegate may only add to hub assets the account already holds a supply position in. New accounts skip the check because the caller becomes the owner.
to selects the recipient on borrow and withdraw; it defaults to caller. Debt is always booked to account_id.
On withdraw, a zero amount withdraws the entire position for that asset. The return value reports the resolved pool payout for each asset.
Anyone may repay an account’s debt; the caller’s signature is needed only to pull the tokens.
Amounts credited are measured from receipts. A token that delivers less than it is sent credits the delivered amount.

Liquidation

Function	Auth	Pause	Returns
`liquidate(liquidator, account_id, debt_payments, seize_mode)`	`signature`	open	`u64`
`clean_bad_debt(caller, account_id)`	`signature`	open	`()`

fn liquidate(liquidator: Address, account_id: u64,
             debt_payments: Vec<(HubAssetKey, i128)>,
             seize_mode: SeizeMode) -> u64;

fn clean_bad_debt(caller: Address, account_id: u64);

seize_mode is SeizeMode::Transfer (pool pays underlying, withholding the protocol fee) or SeizeMode::Credit(account_id) (seized supply shares move to a controller account). Credit(0) creates the receiving account and liquidate returns its id; Transfer returns 0. See Liquidations.

Leverage and strategies

All calls below are pause-gated. Account strategies check final solvency and publish position updates. flash_loan settles principal plus fee and creates no account debt. See Strategies.

Function	Auth	Returns
`multiply(caller, account_id, spoke_id, collateral, debt_to_flash_loan, debt, mode, swap, initial_payment, convert_swap)`	`owner/delegate`	`u64`
`flash_position(caller, account_id, spoke_id, mode, debt, amount, receiver, data, collaterals, refund_assets)`	`owner/delegate`	`u64`
`swap_debt(caller, account_id, existing_debt, amount, new_debt, swap)`	`owner/delegate`	`()`
`swap_collateral(caller, account_id, current, amount, new, swap)`	`owner/delegate`	`()`
`repay_debt_with_collateral(caller, account_id, collateral, collateral_amount, debt, swap, close_position)`	`owner/delegate`	`()`
`migrate_from_blend(caller, account_id, spoke_id, hub_id, blend_pool, collateral_assets, supply_assets, debt_caps)`	`owner/delegate`	`u64`
`flash_loan(caller, asset, amount, receiver, data)`	`signature`	`()`

fn multiply(
    caller: Address,
    account_id: u64,
    spoke_id: u32,
    collateral: HubAssetKey,
    debt_to_flash_loan: i128,
    debt: HubAssetKey,
    mode: PositionMode,
    swap: Bytes,
    initial_payment: Option<(HubAssetKey, i128)>,
    convert_swap: Option<Bytes>,
) -> u64;

fn flash_position(
    caller: Address,
    account_id: u64,
    spoke_id: u32,
    mode: PositionMode,
    debt: HubAssetKey,
    amount: i128,
    receiver: Address,
    data: Bytes,
    collaterals: Vec<(HubAssetKey, i128)>,
    refund_assets: Vec<Address>,
) -> u64;

fn swap_debt(
    caller: Address,
    account_id: u64,
    existing_debt: HubAssetKey,
    amount: i128,
    new_debt: HubAssetKey,
    swap: Bytes,
);

fn swap_collateral(
    caller: Address,
    account_id: u64,
    current: HubAssetKey,
    amount: i128,
    new: HubAssetKey,
    swap: Bytes,
);

fn repay_debt_with_collateral(
    caller: Address,
    account_id: u64,
    collateral: HubAssetKey,
    collateral_amount: i128,
    debt: HubAssetKey,
    swap: Bytes,
    close_position: bool,
);

fn migrate_from_blend(
    caller: Address,
    account_id: u64,
    spoke_id: u32,
    hub_id: u32,
    blend_pool: Address,
    collateral_assets: Vec<Address>,
    supply_assets: Vec<Address>,
    debt_caps: Vec<(Address, i128)>,
) -> u64;

fn flash_loan(caller: Address, asset: HubAssetKey, amount: i128, receiver: Address, data: Bytes);

swap and convert_swap are opaque route bytes. The published SDK 1.0.228 builders accept routeXdr for swap routes. Equal underlying tokens require empty route bytes. repay_debt_with_collateral nets supply against debt directly only when the full HubAssetKey matches. close_position = true requires an empty debt map before it withdraws all remaining collateral. multiply and swap_debt charge a strategy fee on gross new debt. flash_position mints fee-free debt and must finish with supply and positive debt in its declared debt market. For an existing account, multiply and flash_position require mode to match the stored mode (#25 AccountModeMismatch). Receiver requirements are described in Flash positions and Flash loans.

Account and delegation

Function	Auth	Pause
`add_delegate(caller, account_id, delegate)`	`owner`	gated
`remove_delegate(caller, account_id, delegate)`	`owner`	open
`renew_account(caller, account_id)`	`owner`	open

fn add_delegate(caller: Address, account_id: u64, delegate: Address);

fn remove_delegate(caller: Address, account_id: u64, delegate: Address);

fn renew_account(caller: Address, account_id: u64);

add_delegate requires an active, governance-approved position manager. Delegates are capped at 16 (#45 RegistryCapReached).
remove_delegate remains available during a controller pause.
A delegate grant is bound to the owner who made it. Transferring the position NFT deactivates the previous owner’s grants immediately.
renew_account extends both the account’s storage TTL and the NFT Owner entry.

Permissionless maintenance

Caller-signed; none carries a privileged role.

Function	Pause	Notes
`update_indexes(caller, assets)`	gated	`assets: Vec<HubAssetKey>`. Accrues pool indexes.
`claim_revenue(caller, assets) -> Vec<i128>`	gated	Proceeds go only to the configured accumulator; reverts with `#211 NoAccumulator` if unset. Returns the claimed amount per asset, in input order.
`update_account_threshold(caller, has_risks, account_ids)`	gated	Refreshes listed collateral LTVs. With `has_risks = true`, also attempts gated liquidation-tuple refresh and requires final HF ≥ `1.05` WAD (`#102`). See refresh rules.
`recapitalize(payer, hub_asset, amount) -> i128`	open	Applies only up to the actual shortfall, refunds the excess, and returns the amount actually applied.

fn update_indexes(caller: Address, assets: Vec<HubAssetKey>);

fn claim_revenue(caller: Address, assets: Vec<HubAssetKey>) -> Vec<i128>;

fn update_account_threshold(caller: Address, has_risks: bool, account_ids: Vec<u64>);

fn recapitalize(payer: Address, hub_asset: HubAssetKey, amount: i128) -> i128;

Owner-gated configuration

Configuration calls require the owner, except accept_ownership, which requires the pending owner. get_app_version is public. In production, governance owns the controller and applies its proposal and timelock rules.

fn set_swap_aggregator(addr: Address);

fn set_price_aggregator(addr: Address);

fn set_accumulator(addr: Address);

fn set_position_limits(limits: PositionLimits);

fn set_min_borrow_collateral_usd(floor_wad: i128);

fn set_position_manager(manager: Address, is_active: bool);

fn approve_blend_pool(pool: Address);

fn revoke_blend_pool(pool: Address);

fn create_hub() -> u32;

fn add_spoke() -> u32;

fn remove_spoke(id: u32);

fn set_spoke_liquidation_curve(
    id: u32,
    target_hf_wad: i128,
    hf_for_max_bonus_wad: i128,
    liquidation_bonus_factor_bps: u32,
);

fn add_asset_to_spoke(input: SpokeAssetArgs);

fn edit_asset_in_spoke(input: SpokeAssetArgs);

fn set_spoke_asset_flags(spoke_id: u32, hub_asset: HubAssetKey, paused: bool, frozen: bool, no_seize: bool);

fn relax_spoke_asset_flags(
    spoke_id: u32,
    hub_asset: HubAssetKey,
    expected_epoch: u64,
    paused: bool,
    frozen: bool,
    no_seize: bool,
);

fn remove_asset_from_spoke(hub_asset: HubAssetKey, spoke_id: u32);

fn deploy_pool(wasm_hash: BytesN<32>) -> Address;

fn deploy_position_nft(wasm_hash: BytesN<32>, uri: String, name: String, symbol: String) -> Address;

fn create_liquidity_pool(hub_id: u32, asset: Address, params: MarketParamsRaw) -> Address;

fn upgrade_liquidity_pool_params(hub_asset: HubAssetKey, params: InterestRateModel);

fn upgrade_pool(new_wasm_hash: BytesN<32>);

fn upgrade_position_nft(new_wasm_hash: BytesN<32>);

fn force_socialize_bad_debt(account_id: u64);

fn pause();

fn unpause();

fn upgrade(new_wasm_hash: BytesN<32>);

fn migrate(new_version: u32);

fn get_app_version() -> u32;

fn transfer_ownership(new_owner: Address, live_until_ledger: u32);

fn accept_ownership();

set_spoke_asset_flags and edit_asset_in_spoke can retain or tighten halt flags. They cannot clear a set flag (#317 SpokeAssetFlagRelaxation). Clear flags with timelocked AdminOperation::RelaxSpokeAssetFlags and the current get_spoke_asset_flags_epoch as expected_epoch. Governance checks the epoch at proposal time. The controller checks it again at execution. A later flag write invalidates the old proposal (#319 SpokeFlagsEpochMismatch). Listing and relisting advance the epoch. Explicit flag writes advance it even when the requested flags are unchanged. Risk-only edits that retain all flags do not advance it. Removing a listing preserves the epoch.

Views

Views require no authorization and do not persist economic state. Storage reads can renew TTL. get_market_indexes_detailed and get_liquidation_estimate accept at most MAX_VIEW_INPUTS = 256 inputs. A larger list fails with #16. Account risk

View	Returns
`is_liquidatable(account_id: u64) -> bool`	Health factor below 1 WAD.
`get_health_factor(account_id: u64) -> i128`	WAD ratio of liquidation-weighted collateral to debt; `i128::MAX` when debt-free or the account does not exist.
`get_total_collateral_usd(account_id: u64) -> i128`	WAD, unweighted.
`get_total_borrow_usd(account_id: u64) -> i128`	WAD.
`get_liquidation_collateral(account_id: u64) -> i128`	WAD, threshold-weighted collateral used in the HF numerator. Use the liquidation estimate to size seizure.
`get_ltv_collateral_usd(account_id: u64) -> i128`	WAD borrowing power, after refreshing listed LTVs in memory and clamping each to its stored liquidation threshold.

Account state

View	Returns
`get_account_positions(account_id: u64) -> ( Map<HubAssetKey, AccountPositionRaw>, Map<HubAssetKey, DebtPositionRaw>)`	`(Map<HubAssetKey, AccountPositionRaw>, Map<HubAssetKey, DebtPositionRaw>)`
`get_account_attributes(account_id: u64) -> AccountAttributes`	Spoke id and position mode.
`account_exists(account_id: u64) -> bool`	Whether the account has been created.
`get_collateral_amount(account_id: u64, hub_asset: HubAssetKey) -> i128`	Asset units; zero if no such position.
`get_borrow_amount(account_id: u64, hub_asset: HubAssetKey) -> i128`	Asset units; zero if no such position.

Simulation

get_liquidation_estimate(account_id: u64, debt_payments: Vec<(HubAssetKey, i128)>, seize_mode: SeizeMode) -> LiquidationEstimate

returns seized_collaterals, protocol_fees, refunds, max_payment_wad, and bonus_rate_bps.

seized_collaterals is gross of protocol_fees. These two fields use asset units for Transfer and RAY-scaled supply shares for Credit; their difference is the estimated net. refunds always uses native debt-token units, max_payment_wad is USD-WAD and bonus_rate_bps is BPS. A full Transfer close can pay one native unit less because the pool floors its payout; simulate execution for exact amounts.

Market and configuration

View	Returns
`get_market_index(hub_asset: HubAssetKey) -> MarketIndexRaw`	Supply and borrow indexes, RAY.
`get_market_indexes_detailed(hub_assets: Vec<HubAssetKey>) -> Vec<MarketIndexView>`	Indexes plus resolved price, primary and anchor legs, `stale` / `deviation` / `valid` flags and optional `error_code`.
`get_spoke(spoke_id: u32) -> SpokeConfig`	Deprecation flag and liquidation-curve parameters.
`get_spoke_asset(spoke_id: u32, hub_asset: HubAssetKey) -> SpokeAssetConfig`	Per-spoke risk config; panics `#307 AssetNotInSpoke` if unlisted.
`get_spoke_usage(spoke_id: u32, hub_asset: HubAssetKey) -> SpokeUsageRaw`	RAY-scaled supply and borrow usage against caps.
`get_spoke_asset_flags_epoch(spoke_id: u32, hub_asset: HubAssetKey) -> u64`	Current epoch for flag recovery; `0` if never written.
`get_pool_address() -> Address`	Deployed pool.
`price_aggregator() -> Address`	Configured price aggregator.
`get_min_borrow_collateral_usd() -> i128`	WAD floor for LTV-weighted collateral in indebted borrow/withdraw/account-strategy solvency checks.
`is_blend_pool_approved(pool: Address) -> bool`	Blend migration allowlist.
`get_app_version() -> u32`	Migration version.

get_collateral_amount and get_borrow_amount use half-up rounding. A full withdrawal floors its payout; a full debt repayment needs the ceiling-rounded debt. Do not use a display balance as an exact close amount. There is no max_withdraw, max_borrow, or max_supply view on the controller. Size an action against get_collateral_amount, get_ltv_collateral_usd, get_spoke_usage, and the pool’s get_reserves, or simulate the call.

Account creation and batching

account_id = 0 creates an account. It applies to supply, multiply, flash_position, migrate_from_blend, and as SeizeMode::Credit(0) in liquidate. Each returns the resolved account id. Creating an account mints its position NFT; there is no separate account-creation entrypoint.
The spoke id is fixed at creation. Calls accepting a spoke id check it against existing account metadata (#310 SpokeMismatch); others use the stored spoke.
Position mode is fixed at creation.
Zero has different meanings. On entry legs (supply, borrow, repay) zero is rejected. On withdraw it means “the entire position”.
Payment batches sum duplicate legs by full HubAssetKey. They preserve first-appearance order. Overflow fails with #33 MathOverflow. flash_position collateral declarations instead require distinct tokens.

The account_id is the position NFT’s token_id. Ownership and transfer behavior are documented in Position NFT.

Start here

Core concepts

Lending actions

Strategies and integrations

System behavior

Reference

Operations

Reading the tables

Core lending

Liquidation

Leverage and strategies

Account and delegation

Permissionless maintenance

Owner-gated configuration

Views

Account creation and batching

​Reading the tables

​Core lending

​Liquidation

​Leverage and strategies

​Account and delegation

​Permissionless maintenance

​Owner-gated configuration

​Views

​Account creation and batching

Reading the tables

Core lending

Liquidation

Leverage and strategies

Account and delegation

Permissionless maintenance

Owner-gated configuration

Views

Account creation and batching