Vault integrations

​

The position model

1. Views accrue to now. get_collateral_amount(account_id, hub_asset) returns the current underlying balance with interest simulated to the ledger timestamp — no keeper dependency, and the same fixed-point math the pool persists on the next mutation. What a view reports is what a deposit or withdrawal in the same transaction applies.
2. Balance views read no oracle. get_collateral_amount, get_borrow_amount, and get_market_index stay callable through any oracle outage, so your balance() never bricks downstream accounting.
3. Rounding always favours the pool, never you. A supply mints shares floor-rounded; a partial withdrawal burns them ceil-rounded. Both directions cost you a sub-unit rather than the pool. Do not replicate the formulas — re-read the view after the call and use what it reports.

​

The core loop

// Every leg is keyed by HubAssetKey, not by a bare token address.
let hub_asset = HubAssetKey { hub_id, asset: asset.clone() };

// Deposit: pull tokens in, then supply. account_id = 0 opens an account on
// spoke_id; persist the returned id.
let id = controller.supply(&strategy, &stored_id_or_0, &spoke_id,
    &vec![&env, (hub_asset.clone(), amount)]);

// Balance: one call, underlying units, interest accrued to now.
let value = controller.get_collateral_amount(&id, &hub_asset);

// Withdraw: pay any recipient directly; returns actual amounts paid.
// amount = 0 closes the position; over-asking clamps to a full close.
let paid = controller.withdraw(&strategy, &id,
    &vec![&env, (hub_asset.clone(), amount)], &Some(recipient));

​

Authorize

env.authorize_as_current_contract(vec![&env,
    InvokerContractAuthEntry::Contract(SubContractInvocation {
        context: ContractContext {
            contract: asset.clone(),
            fn_name: Symbol::new(&env, "transfer"),
            args: (env.current_contract_address(), pool.clone(), amount).into_val(&env),
        },
        sub_invocations: Vec::new(&env),
    }),
]);

​

Size limits before acting

​

Lifecycle rules

• Account deletion on full close. Withdrawing the last position deletes the account. Reset your stored account_id to 0; supplying with a stale id raises #24 AccountNotFound. Views degrade gracefully for missing accounts (0, empty maps, i128::MAX health factor).
• Min borrow collateral. While the vault account carries debt, LTV-weighted collateral must stay above the instance-level MinBorrowCollateralUsd floor (get_min_borrow_collateral_usd, default $5 WAD).
• Pause. The protocol circuit breaker blocks supply, but not withdraw — a paused protocol still lets solvent users exit. repay, renew_account, and recapitalize also stay available. A paused spoke-asset flag is stricter: it blocks that asset’s exits too.
• Oracle posture. Every mutating flow needs a complete, valid price snapshot and fails closed otherwise — there is no lenient risk-decreasing path. Balance reporting is oracle-free.
• Storage rent. Account keys auto-extend on every touch: when their remaining life drops below 30 days, a read or write pushes it back to 120 days. A position nobody touches gets no such renewal, so call renew_account(caller, account_id) periodically. It works while paused. Archived entries are restorable with RestoreFootprint, not lost.
• Third parties can supply into your account, but only narrowly. A caller who is neither owner nor delegate may add only to hub assets the account already holds a supply position in, so it cannot consume your supply-position slots. Within that constraint your protocol balance is monotone-up from external action — relevant for share-price accounting; use a first-deposit inflation guard as the reference strategy does.
• Your account is an NFT. account_id is the position-NFT token_id, and whoever holds that token is the owner the controller checks. Your contract must hold it. Transferring it transfers the whole position.

​

Verify

​

Next