Skip to main content
The controller manages lending accounts and risk. One central pool holds tokens and records market balances. Governance schedules configuration changes through a timelock and provides limited immediate controls.

​
Core contracts

Each account belongs to one spoke. Each market is identified by a hub and token address, so the same token in two hubs has separate accounting. A spoke selects which markets its accounts can use and sets their risk terms. See Markets. The position NFT identifies the account owner. Transferring it transfers the account’s collateral and debt together. The controller checks NFT ownership when a call requires account authority. NFT transfer approval and lending delegation are separate permissions. See Position NFT.

​
External contracts

The controller uses a swap aggregator for strategy routes. Governance selects its address, but the aggregator has its own owner and upgrade authority. Route execution and slippage constraints are covered in Strategies. The price aggregator reads Reflector, RedStone, and XOXNO oracle feeds, and can value Aquarius LP shares. The XOXNO oracle accepts authenticated signer submissions and has its own owner; lending governance has no typed forwarding operation for its administration. See Oracles. The DeFindex strategy adapter holds one controller account per vault. It exposes a vault integration interface and holds no privileged lending role. See DeFindex strategy.

​
Off-chain services

Wallets can read positions and supported markets through the integrator API. The SDK’s lightweight read entry supplies the public response types. Its transaction entry builds unsigned XDR; RPC prepares the transaction, and the wallet signs and submits it. The wallet guide covers this lifecycle. Indexers consume controller and pool events. Their results can lag the ledger, especially after NFT transfers or transaction confirmation. Display indexed estimates, then use ownership views and simulation before acting on an account. A keeper extends storage lifetime and restores archived entries. It needs no privileged lending role. It can also call update_indexes, but interest accrues from ledger time when a market is used, so accounting does not depend on a periodic index update. Account holders must also arrange account renewal. Contract integrations renew their own stored account-id keys separately from protocol storage. Storage lifetimes and renewal are documented in Storage. The Security model explains authorization and checks at external contract boundaries.