> ## Documentation Index
> Fetch the complete documentation index at: https://xoxno.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Stellar lending system architecture

> Current governance, controller, central pool, oracle, strategy, and keeper architecture.

Stellar Lending uses governance -> controller -> central pool.

```mermaid theme={"system"}
flowchart TB
  User["Users / liquidators / integrators"] --> Controller["Controller"]
  Governance["Governance timelock"] --> Controller
  Keeper["Off-chain keeper"] --> Controller
  Controller --> Pool["Central pool"]
  Controller --> Oracles["Reflector / RedStone"]
  Controller --> Router["Aggregator router"]
  Pool --> Tokens["SAC / SEP-41 tokens"]
```

## Contracts

| Contract          | Responsibility                                                                                          |
| ----------------- | ------------------------------------------------------------------------------------------------------- |
| Governance        | Owns controller and timelocks protocol-admin operations.                                                |
| Controller        | Accounts, spokes, oracle policy, risk checks, liquidation, flash loans, strategies, and pool ownership. |
| Pool              | Custody and accounting rows keyed by `HubAssetKey`.                                                     |
| DeFindex strategy | Adapter configured for one `HubAssetKey` and `spoke_id`.                                                |

## Market Coordinate

All market-specific flows use:

```rust theme={"system"}
HubAssetKey { hub_id, asset }
```

The same token on different hubs is independent.

## Account Risk

Accounts bind to one spoke. The spoke decides collateral flags, borrow flags,
caps, LTV, liquidation threshold, liquidation bonus, fee, and optional oracle
override for each hub asset.

## Pool Boundary

The controller is the pool owner. Users do not call pool mutators directly. The
pool tracks internal `cash`, indexes, scaled supply, scaled debt, and revenue.

## External Boundaries

* Oracle output is validated before use.
* Aggregator output is checked by token balance deltas.
* Flash-loan receivers are arbitrary code; the pool verifies repayment.
* Token contracts must be fixed-balance assets.

## Keeper

The keeper is off-chain. It renews TTL and may call `update_indexes`. It is
configured with launched `HubAssetKey` markets.