DeFindex strategy

The defindex-strategy contract is a reference vault adapter. It maps each DeFindex vault to one controller supply account for a single underlying asset. Share accounting lives in the DeFindex vault contract; the strategy holds only a vault-to-account mapping.

Deployment model

One WASM per underlying asset. Deploy a separate strategy instance per listed market.
One controller account_id per vault. Vaults never share a lending account.
Strategy is the caller on all controller mutations (supply, withdraw).

Constructor:

__constructor(asset: Address, init_args: Vec<Val>)
// init_args decodes as (controller: Address, hub_id: u32, spoke_id: u32)

A missing or wrongly-typed argument panics with #401 NotInitialized. The constructor then checks that a market index exists for asset on hub_id, resolves the pool address from the controller, and stores this in instance storage:

Config { hub_id, spoke_id, asset, controller, pool }

The one other storage key is VaultAccount(vault_address) -> u64, which maps a vault to the controller account holding its collateral.

Trait API

The contract implements DeFindexStrategyTrait and exposes exactly these five entrypoints — there is no account-id lookup view.

Entrypoint	Auth	Returns	Behavior
`asset()`	—	`Address`	Configured underlying asset.
`deposit(amount, from)`	`from.require_auth()`	`i128`	Pull tokens (measured), supply to the controller, return the post-deposit collateral balance.
`balance(from)`	—	`i128`	The vault’s current collateral, or `0` when it has no live account.
`withdraw(amount, from, to)`	`from.require_auth()`	`i128`	Withdraw to `to`, return remaining collateral. `amount` must be positive; passing exactly the balance triggers the controller’s full-close sentinel internally.
`harvest(from, data)`	`from.require_auth()`	—	Emits `HarvestEvent` with a 12-decimal `price_per_share`. Moves no funds.

Deposit flow

from (vault) --auth--> deposit(amount, from)
transfer_amount_measured(from → strategy, amount)   // credits what arrived
resolve_vault_account(...)             // clears a stale mapping before auth
authorize_as_current_contract(transfer(strategy → pool, received))
controller.supply(strategy, stored_id_or_0, spoke_id, [(hub_asset, received)])
persist the returned account_id in VaultAccount(vault)
return the account's collateral balance

Step 2 runs before authorize_as_current_contract, and that ordering is load-bearing: it reconciles the stored mapping against controller.account_exists first, so a re-deposit after a full withdraw does not fail with Auth InvalidAction. Step 1 is a measured transfer — the amount actually received is what gets supplied, not the amount requested.

Withdraw flow

from (vault) --auth--> withdraw(amount, from, to)
reconcile vault → account_id (0 → InsufficientBalance)
balance = the account's current collateral
reject if amount > balance (strategy-level check; stricter than the controller's clamp)
if amount == balance → withdraw_amount = 0 (the controller's full-close sentinel)
controller.withdraw(strategy, account_id, [(hub_asset, withdraw_amount)], Some(to))
clear VaultAccount(vault) on a full withdraw; return remaining collateral

Withdraw pays to directly from the pool. No pre-authorization is required on the strategy side. harvest emits HarvestEvent (["strategy", "harvest"]) with a 12-decimal price_per_share (PPS_DECIMALS = 12). It reads the controller’s get_market_index(hub_asset).supply_index and floor-rescales it from RAY:

price_per_share = floor(supply_index / 10^(27 - 12))

The value is market-wide, not per-vault. harvest moves no funds — the event’s amount field is always 0 — and makes no on-chain state change; DeFindex vaults use the event for share accounting.

Controller integration

Concern	Implementation
Balance reads	`get_collateral_amount(account_id, hub_asset)` — oracle-free, accrues to now
Supply auth	Pre-authorize `transfer(strategy → pool)`
Withdraw auth	None; pool pays recipient directly
Pool address	Resolved at init via `controller.get_pool_address()`
Stale mapping	Cleared on full withdraw and reconciled on the next supply; `balance` returns `0` until re-deposit

Auth recipe

Supply requires the strategy to authorize its own token transfer to the pool before calling controller.supply:

// The nested call is on the *asset* token contract, not on the pool.
env.authorize_as_current_contract(vec![
    &env,
    InvokerContractAuthEntry::Contract(SubContractInvocation {
        context: ContractContext {
            contract: asset_address,
            fn_name: Symbol::new(&env, "transfer"),
            args: (strategy_address, pool_address, amount).into_val(&env),
        },
        sub_invocations: Vec::new(&env),
    }),
]);

Withdraw does not need a pre-authorization; the pool transfers to to on the controller’s behalf.

Strategy errors

These are the adapter’s own enum, independent of the protocol error codes.

Code	Error
401	`NotInitialized`
460	`AmountNotPositive`
461	`InsufficientBalance`
462	`ArithmeticError`
463	`AccountLookupFailed`

The vault-to-account mapping is one-way

VaultAccount(vault) is the only route back to a vault’s collateral, and there is no entry point to re-point it. If you clear it while the account is still alive, that collateral becomes unreachable through the adapter. resolve_vault_account is written around that. It calls controller.try_account_exists(stored) and treats the three outcomes differently:

Controller answers	Adapter does
`true` — account is live	Extend the mapping’s TTL, return the id.
`false` — account is gone	Clear the mapping, but only on the deposit path. Return `0`.
The call itself failed	Panic with `#463 AccountLookupFailed`. Never clear.

That third row is the important one. A lookup that merely failed to answer is not evidence the account is gone. Treating it as gone would clear the only pointer to live collateral.

If you fork this adapter, keep that distinction. “I could not reach the controller” and “the controller says the account no longer exists” must not collapse into the same branch.

Fork checklist

When adapting the reference strategy:

Keep the three-way lookup above. Only an explicit “gone” may clear a mapping.
Enforce vault-side inflation guards before trusting deposit return values.
Extend TTL for the strategy instance and the vault-mapping keys.
Cover deposit, balance, and withdraw round trips; third-party payout; interest accrual with no index maintenance; and account recreation after a full exit.
Keep one WASM per asset. Do not share a strategy instance across underlyings.

Vault integrations

Generic vault integration model, lifecycle rules, and auth patterns.

Supply and borrow

Underlying controller supply and withdraw semantics.

Interest and revenue

How supply indexes accrue and how price_per_share tracks yield.

Controller ABI

supply, withdraw, and get_collateral_amount signatures.

Start here

Concepts

Integration guides

Reference

Operations

Deployment model

Trait API

Deposit flow

Withdraw flow

Controller integration

Auth recipe

Strategy errors

The vault-to-account mapping is one-way

Fork checklist

Next

Vault integrations

Supply and borrow

Interest and revenue

Controller ABI

​Deployment model

​Trait API

​Deposit flow

​Withdraw flow

​Harvest and price per share

​Controller integration

​Auth recipe

​Strategy errors

​The vault-to-account mapping is one-way

​Fork checklist

​Next

Vault integrations

Supply and borrow

Interest and revenue

Controller ABI

Deployment model

Trait API

Deposit flow

Withdraw flow

Harvest and price per share

Controller integration

Auth recipe

Strategy errors

The vault-to-account mapping is one-way

Fork checklist

Next