Controller ABI

The controller is the integrator-facing lending contract. The pool is owned by the controller and is not called directly by users. Types are defined in Data types. Error codes are listed in Errors. Events are listed in Events.

In production, governance owns the controller. Owner-gated configuration is reached through governance proposal, timelock, and execution.

Reading the tables

Every state-changing entrypoint takes an explicit caller: Address and calls require_auth() on it. The Auth column describes the additional authority required beyond that signature:

Value	Meaning
`signature`	Any address may call; only the caller’s own signature is needed.
`owner`	Caller must currently hold the account’s position NFT.
`owner/delegate`	NFT holder, or an active governance-approved position manager registered as a delegate on that account.
`owner (contextual)`	Third parties may call, with a narrowed effect.

Pause — gated means the entrypoint carries #[when_not_paused] and reverts while the controller is paused. open means it stays callable, so a paused protocol never traps a solvent user’s exit or blocks a liquidation. Flash-loan reentrancy — every monetary verb routes through require_authorized_caller, which combines caller.require_auth() with the flash-loan guard. A call made while a flash loan is in flight reverts with #400 FlashLoanOngoing.

Core lending

Function	Auth	Pause	Returns
`supply(caller, account_id, spoke_id, assets)`	`owner (contextual)`	gated	`u64`
`borrow(caller, account_id, borrows, to)`	`owner/delegate`	gated	`()`
`withdraw(caller, account_id, withdrawals, to)`	`owner/delegate`	open	`Vec<(HubAssetKey, i128)>`
`repay(caller, account_id, payments)`	`signature`	open	`()`

fn supply(caller: Address, account_id: u64, spoke_id: u32,
          assets: Vec<(HubAssetKey, i128)>) -> u64;

fn borrow(caller: Address, account_id: u64,
          borrows: Vec<(HubAssetKey, i128)>, to: Option<Address>);

fn withdraw(caller: Address, account_id: u64,
            withdrawals: Vec<(HubAssetKey, i128)>,
            to: Option<Address>) -> Vec<(HubAssetKey, i128)>;

fn repay(caller: Address, account_id: u64, payments: Vec<(HubAssetKey, i128)>);

account_id = 0 on supply creates the account, mints its position NFT to caller, binds it to spoke_id in PositionMode::Normal, and returns the new id. There is no separate account-creation entrypoint.
Third-party supply is narrowed. A caller who is neither owner nor delegate may only add to hub assets the account already holds a supply position in. New accounts skip the check because the caller becomes the owner.
to separates borrower from recipient on borrow and withdraw; it defaults to caller. Debt is always booked to account_id.
On withdraw, a zero amount withdraws the entire position for that asset. The return value is the resolved figure — the only way a caller learns what a withdraw-all actually paid.
repay is fully permissionless. Anyone may repay anyone’s debt; the caller’s signature is needed only to pull the tokens.
Amounts credited are measured, not requested. A token that delivers less than it is sent credits the delivered amount.

Liquidation

Function	Auth	Pause	Returns
`liquidate(liquidator, account_id, debt_payments, seize_mode)`	`signature`	open	`u64`
`clean_bad_debt(caller, account_id)`	`signature`	open	`()`

fn liquidate(liquidator: Address, account_id: u64,
             debt_payments: Vec<(HubAssetKey, i128)>,
             seize_mode: SeizeMode) -> u64;

fn clean_bad_debt(caller: Address, account_id: u64);

seize_mode is SeizeMode::Transfer (pool pays underlying, withholding the protocol fee) or SeizeMode::Credit(account_id) (seized supply shares move to a controller account). Credit(0) creates the receiving account and liquidate returns its id; Transfer returns 0. See Liquidations.

Leverage and strategies

All are pause-gated and end in strategy_finalize: restamp listed collateral risk parameters, apply post-pool risk gates, persist, emit the position batch.

Function	Auth	Returns
`multiply(caller, account_id, spoke_id, collateral, debt_to_flash_loan, debt, mode, swap, initial_payment, convert_swap)`	`owner/delegate`	`u64`
`flash_position(caller, account_id, spoke_id, mode, debt, amount, receiver, data, collaterals, refund_assets)`	`owner/delegate`	`u64`
`swap_debt(caller, account_id, existing_debt, amount, new_debt, swap)`	`owner/delegate`	`()`
`swap_collateral(caller, account_id, current, amount, new, swap)`	`owner/delegate`	`()`
`repay_debt_with_collateral(caller, account_id, collateral, collateral_amount, debt, swap, close_position)`	`owner/delegate`	`()`
`migrate_from_blend(caller, account_id, spoke_id, hub_id, blend_pool, collateral_assets, supply_assets, debt_caps)`	`owner/delegate`	`u64`
`flash_loan(caller, asset, amount, receiver, data)`	`signature`	`()`

fn multiply(caller: Address, account_id: u64, spoke_id: u32,
            collateral: HubAssetKey, debt_to_flash_loan: i128, debt: HubAssetKey,
            mode: PositionMode, swap: Bytes,
            initial_payment: Option<(HubAssetKey, i128)>,
            convert_swap: Option<Bytes>) -> u64;

fn flash_position(caller: Address, account_id: u64, spoke_id: u32,
                  mode: PositionMode, debt: HubAssetKey, amount: i128,
                  receiver: Address, data: Bytes,
                  collaterals: Vec<(HubAssetKey, i128)>,
                  refund_assets: Vec<Address>) -> u64;

fn flash_loan(caller: Address, asset: HubAssetKey, amount: i128,
              receiver: Address, data: Bytes);

multiply and flash_position accept account_id = 0 to create the account, and otherwise assert the passed mode equals the account’s stored mode (#25 AccountModeMismatch). See Strategies and Flash loans.

Account and delegation

Function	Auth	Pause
`add_delegate(caller, account_id, delegate)`	`owner`	gated
`remove_delegate(caller, account_id, delegate)`	`owner`	open
`renew_account(caller, account_id)`	`owner`	open

add_delegate requires the delegate to be an active, governance-approved position manager at the moment of the grant. Delegates are capped at 16 (#45 RegistryCapReached).
remove_delegate is deliberately not pause-gated — revoking authority must never be blocked.
A delegate grant is bound to the owner who made it. Transferring the position NFT deactivates the previous owner’s grants immediately.
renew_account extends both the account’s storage TTL and the NFT Owner entry.

Permissionless maintenance

Caller-signed; none carries a privileged role.

Function	Pause	Notes
`update_indexes(caller, assets)`	gated	`assets: Vec<HubAssetKey>`. Accrues pool indexes.
`claim_revenue(caller, assets) -> Vec<i128>`	gated	Proceeds go only to the configured accumulator; reverts with `#211 NoAccumulator` if unset. Returns the claimed amount per asset, in input order.
`update_account_threshold(caller, has_risks, account_ids)`	gated	Refreshes cached risk parameters after a listing change. With `has_risks = true` it also reloads the debt side and reverts (`#102`) if health factor falls below `1.05` WAD.
`recapitalize(payer, hub_asset, amount) -> i128`	open	Applies only up to the actual shortfall, refunds the excess, and returns the amount actually applied.

Owner-gated configuration

Every mutating entrypoint in ControllerAdmin carries #[only_owner], and the owner is the governance contract. Reaching them requires a governance proposal, the applicable timelock tier, and execution.

Wiring: set_swap_aggregator, set_price_aggregator, set_accumulator
Limits: set_position_limits, set_min_borrow_collateral_usd
Delegation: set_position_manager(manager, is_active)
Blend: approve_blend_pool, revoke_blend_pool
Topology: create_hub, add_spoke, remove_spoke, set_spoke_liquidation_curve
Listings: add_asset_to_spoke, edit_asset_in_spoke, set_spoke_asset_flags, remove_asset_from_spoke
Deployment: deploy_pool, deploy_position_nft, upgrade_pool, upgrade_position_nft
Markets: create_liquidity_pool, upgrade_liquidity_pool_params
Emergency: pause, unpause, force_socialize_bad_debt
Lifecycle: upgrade, migrate, transfer_ownership, accept_ownership

Two entries are ungated: get_app_version, a permissionless read of the stored migration version, and accept_ownership, callable only by the pending owner.

Emergency asymmetry: the guardian can pause and tighten listing flags immediately, but reopening requires timelocked governance (#317 SpokeAssetFlagRelaxation).

Views

Read-only; none mutates state. Views that accept a list are bounded by MAX_VIEW_INPUTS = 256. Account risk

View	Returns
`is_liquidatable(account_id) -> bool`	Health factor below 1 WAD.
`get_health_factor(account_id) -> i128`	WAD ratio of liquidation-weighted collateral to debt; `i128::MAX` when debt-free or the account does not exist.
`get_total_collateral_usd(account_id) -> i128`	WAD, unweighted.
`get_total_borrow_usd(account_id) -> i128`	WAD.
`get_liquidation_collateral(account_id) -> i128`	WAD, threshold-weighted — the ceiling on seizable collateral.
`get_ltv_collateral_usd(account_id) -> i128`	WAD, LTV-weighted — the ceiling on borrowing power.

Account state

View	Returns
`get_account_positions(account_id)`	`(Map<HubAssetKey, AccountPositionRaw>, Map<HubAssetKey, DebtPositionRaw>)`
`get_account_attributes(account_id) -> AccountAttributes`	Spoke id and position mode.
`account_exists(account_id) -> bool`	Whether the account has been created.
`get_collateral_amount(account_id, hub_asset) -> i128`	Asset units; zero if no such position.
`get_borrow_amount(account_id, hub_asset) -> i128`	Asset units; zero if no such position.

Simulation get_liquidation_estimate(account_id, debt_payments, seize_mode) -> LiquidationEstimate returns seized_collaterals, protocol_fees, refunds, max_payment_wad, and bonus_rate_bps.

Two traps: seized_collaterals is gross of protocol_fees (the liquidator ends up with the difference), and the units follow the mode — asset units for Transfer, RAY-scaled supply shares for Credit.

Market and configuration

View	Returns
`get_market_index(hub_asset) -> MarketIndexRaw`	Supply and borrow indexes, RAY.
`get_market_indexes_detailed(hub_assets) -> Vec<MarketIndexView>`	Indexes plus resolved price, primary and anchor legs, `stale` / `deviation` / `valid` flags.
`get_spoke(spoke_id) -> SpokeConfig`	Deprecation flag and liquidation-curve parameters.
`get_spoke_asset(spoke_id, hub_asset) -> SpokeAssetConfig`	Per-spoke risk config; panics `#307 AssetNotInSpoke` if unlisted.
`get_spoke_usage(spoke_id, hub_asset) -> SpokeUsageRaw`	RAY-scaled supply and borrow usage against caps.
`get_pool_address() -> Address`	Deployed pool.
`price_aggregator() -> Address`	Configured price aggregator.
`get_min_borrow_collateral_usd() -> i128`	WAD floor for opening a borrow.
`is_blend_pool_approved(pool) -> bool`	Blend migration allowlist.
`get_app_version() -> u32`	Migration version.

There is no max_withdraw, max_borrow, or max_supply view on the controller. Size an action against get_collateral_amount, get_ltv_collateral_usd, get_spoke_usage, and the pool’s get_reserves, or simulate the call.

Cross-cutting semantics

account_id = 0 means “create”. It applies to supply, multiply, flash_position, migrate_from_blend, and as SeizeMode::Credit(0) in liquidate. Each returns the resolved account id.
Spoke binding is permanent. Every later call rechecks it (#310 SpokeMismatch).
Position mode is fixed at creation.
Zero is overloaded by direction. On entry legs (supply, borrow, repay) zero is rejected. On withdraw it means “the entire position”.
Batching is uniform. Multi-asset calls sum duplicate legs per asset and preserve first-appearance ordering. Overflow reverts #33 MathOverflow.
Pause protects exits. withdraw, repay, liquidate, clean_bad_debt, recapitalize, renew_account, and remove_delegate stay callable while the protocol is paused.

Notes

HubAssetKey { hub_id, asset } is the market coordinate used by user flows, pool rows, keeper config, and most views.
Account creation uses spoke_id, not an account category.
The account_id is the position NFT token_id. The controller stores no owner address; it calls owner_of(account_id) on every authority check, so transferring the token transfers the whole position. Its own ABI is on Position NFT.
Prices are resolved by the price aggregator, keyed by PriceKey::Token(asset).

Start here

Concepts

Integration guides

Reference

Operations

Reading the tables

Core lending

Liquidation

Leverage and strategies

Account and delegation

Permissionless maintenance

Owner-gated configuration

Views

Cross-cutting semantics

Notes

​Reading the tables

​Core lending

​Liquidation

​Leverage and strategies

​Account and delegation

​Permissionless maintenance

​Owner-gated configuration

​Views

​Cross-cutting semantics

​Notes

Reading the tables

Core lending

Liquidation

Leverage and strategies

Account and delegation

Permissionless maintenance

Owner-gated configuration

Views

Cross-cutting semantics

Notes