Reference

Contract inventory

The contract interaction reference covers the contracts users and keepers call. This page inventories the supporting production contracts: deployment helpers, delegate modules, storage and type libraries, the shared utility library, and vendored dependencies, with the trust boundary of each.

Caller and trust boundaries

Deployment helpers are not interchangeable with canonical protocol discovery. Several are intentionally permissionless and namespace CREATE2 salts by msg.sender; an application must discover canonical instances through SecurityPoolFactory, recognized pools, and recognized forker events rather than treating every factory-created address as canonical.

Module Direct caller boundary Canonical-use boundary
EscalationGameFactory deployEscalationGame and deployEscalationGameFromFork have no permission check, but a successful caller must implement the ISecurityPool reads used during construction; an EOA or incompatible contract reverts. The caller is bound into the new game as its securityPool; the factory itself becomes the game's immutable owner and immediately calls start or startFromFork. Ordinary deployment requires a threshold above one attoREP and lowers a start bond at or above that threshold to threshold - 1. The factory has no owner role and no later resumeFromFork relay. Accept a game only after EscalationGameSet from a recognized pool. In the supported continuation path, the owning pool calls resumeFromFork, which also verifies aggregate funding.
ShareTokenFactory Anyone can call deployShareToken to deploy or retrieve a token under keccak256(abi.encode(msg.sender, salt, questionId)); that caller is the token's initial authorized address. Origin lineage tokens are the instances created by SecurityPoolFactory and named in DeploySecurityPool; children reuse the parent's token.
UniformPriceDualCapBatchAuctionFactory Anyone can call deployUniformPriceDualCapBatchAuction. Its salt is namespaced by caller and supplied salt, and its operational owner is the caller-supplied owner address. During external-universe initiation, the source must be authorized by its declared share token; own-game initiation does not perform that check, and neither relationship proves configured-factory registration. Child linking requires a deployed auction that this forker has never trusted before and preserves the source's factory and forker. Canonical pools remain the instances registered by the configured SecurityPoolFactory.
PriceOracleManagerAndOperatorQueuerFactory Anyone can call deployPriceOracleManagerAndOperatorQueuer under a caller-namespaced salt with caller-supplied OpenOracle, REP token, and positive initialReportPriorityFeeAttoEthPerGas; coordinator construction rejects zero and values that would consume the reserved OpenOracle uint128 report and escalation-halt capacity. The caller therefore chooses this immutable gas-price assumption within that bound. A pool coordinator is the instance named by canonical DeploySecurityPool; SecurityPoolFactory atomically binds it to that pool before returning, and canonical child deployment inherits the value from the parent coordinator.
SecurityPoolDeployer and SecurityPoolDeploymentWorker Only the configured SecurityPoolFactory may call the deployer; only that deployer may call its worker. They are code-size deployment plumbing. ProxyDeployer deploys one deterministic SecurityPoolOperationsDelegate, and its address is passed into the SecurityPoolFactory constructor. The factory passes that address through its deployer and worker to every pool. Its deterministic address is published as securityPoolOperationsDelegate. Pools become canonical only when the factory emits SecurityPoolRegistered and DeploySecurityPool.
SecurityPoolMigrationProxy Only its immutable owner, the SecurityPoolForker that created it, may call lockRep, forkUniverse, splitToChild, or sweepChildRep. Its deterministic per-parent address is exposed by getMigrationProxyAddress and recorded in fork snapshot events; users do not call it.
EscalationGameDepositDelegate, EscalationGameClaimDelegate, EscalationGameForker, SecurityPoolForkerVaultMigrationDelegate, SecurityPoolSettlementDelegate, and SecurityPoolOperationsDelegate Their public methods are delegatecall implementations. The deposit delegate implements recordDeposit, recordForkedEscrowForOutcome, applyTruthAuctionHaircut, funding-gated resumeFromFork, consumeEscrowedRepForOwner, consumeUnresolvedRepForClaimOwners, creditClaimOwners, and creditExternalClaimOwners. The shared claim delegate handles retention checkpoint reads and initialization; it has no ownership or import surface. The forker delegates implement escalation and vault migration. SecurityPoolSettlementDelegate is abstract and contributes complete-set minting validation and funded inherited-collateral installation to the single deployed SecurityPoolOperationsDelegate. That operations delegate implements setVaultCapacity, funded REP-backing-unit, capacity-ownership, receiver-debt, and full-request bad-debt liquidation accounting while isolating fees and claims, plus permissionless continuation resume. A direct call may revert against uninitialized state or may mutate only the helper's isolated storage; it is not a protocol action. Accept resulting state and logs only when the recognized game, pool, or forker executes the matching wrapper through delegatecall. State changes and events then occur in that recognized contract's context. Canonical liquidation enters through SecurityPool.performLiquidation; continuation progress enters through SecurityPool.resumeForkedEscalationGame.
SecurityPoolEventEmitter and SecurityPoolForkEventEmitter SecurityPoolEventEmitter inherits the pool's typed SecurityPoolStorage base and exposes emitPoolAccountingCheckpoint and emitVaultAccountingCheckpoint. SecurityPoolForkEventEmitter inherits the forker's typed SecurityPoolForkerStorage base and exposes emitForkSnapshotEvents. The entrypoints are externally callable and payable, but direct calls execute against the helper's own storage and emit from the helper address. Payability permits delegatecalls from value-bearing protocol flows; callers must not send ETH directly because it is not protocol collateral and the helpers have no recovery surface. Pools delegate accounting checkpoints to their pool-layout emitter, while the forker delegates fork snapshots to its forker-layout emitter, so logs are emitted from the recognized pool or forker address. Indexers must reject matching signatures from either helper or any unrecognized emitter. External-universe fork initiation requires declared-share-token authorization; own-game initiation does not. Child linking preserves the source factory and forker and rejects undeployed or previously trusted auctions. Configured-factory registration remains the canonicality boundary. Storage-layout tests protect both typed delegate layouts.
EscalationGameProofVerifier, MerkleMountainRange, and SecurityPoolUtils Stateless or library math and proof routines have no lifecycle authority. Public verifier calls can be used for previews, but do not mutate a game or pool. A result becomes protocol state only through a recognized game, pool, or forker transaction and its events.
DeploymentStatusOracle Anyone can call getDeploymentMask; the constructor alone fixes the ordered address list and emits DeploymentAddressesSet. It reports code presence only, not canonical wiring or readiness. Decode it using its constructor event or the matching deployment manifest order.

SecurityPoolUtils read surface

These external pure previews distinguish REP-denominated capacity ownership from ETH-denominated open interest. REP-per-ETH prices use PRICE_PRECISION, and health factors and security multipliers use basis points. The previews have no lifecycle, caller, freshness, or canonical-pool authority; only a recognized pool or coordinator transaction can apply their result.

Function Exact boundary behavior Conceptual owner
calculateFeeAccrual(settlementCollateralAttoEth, retentionRate, timeDelta, indexRemainder, feeEligibleCapacityOwnershipAttoRep, feesOwedRemainder) Applies fixed-point retention over elapsed time to settlement collateral net of the already-counted but uncredited decay (indexRemainder + feesOwedRemainder) / 1e18, carries the global index remainder, and returns whole credited fees plus the next fee remainder. Credited fees therefore never exceed settlement collateral. Canonical callers avoid zero eligible capacity ownership before this division. Fee accrual
calculateVaultFee(capacityOwnershipAttoRep, feeIndexDelta, remainder) Floors the vault's whole fee credit and returns the remaining fixed-point numerator for its next checkpoint. Fee accrual
calculateMintingCapacityAttoEth(capacityOwnershipAttoRep, repEthPrice, securityMultiplierBps) Converts aggregate REP-denominated ownership into current ETH capacity using the live REP-per-ETH price and pool multiplier. Zero ownership or price returns zero. Dynamic capacity
calculateVaultOpenInterestAttoEth(activeOpenInterestAttoEth, vaultCapacityOwnershipAttoRep, totalCapacityOwnershipAttoRep) Attributes live pool open interest pro rata to capacity ownership, rounding a positive vault share upward. Zero vault or total ownership returns zero. Dynamic capacity
calculateBundledLiquidationTransfer(targetBackingUnits, targetCapacityOwnershipAttoRep, targetOpenInterestAttoEth, requestedDebtAttoEth, repEthPrice, currentPoolHeldAttoRepBalance, currentTotalRepBackingUnits, minimumRemainingAttoRep) Returns zero when the request, target open interest, capacity ownership, or price is zero. Caps a nominal debt quote by target open interest and by the complete 5%-bonus award fundable from target pool-held REP, then rounds proportional capacity ownership downward. Execution derives moved debt separately from the receiver's exact live open-interest increase. Partial requests preserve the configured REP minimum. On a full-target request, bad debt is target open interest minus exact moved debt and can include both an award-unfunded slice and integer-allocation residue. Vault liquidation
isVaultHealthy(poolHeldVaultRepBackingAttoRep, disputeStakedAttoRep, openInterestAttoEth, repEthPrice, poolSecurityMultiplierBps) Checks the associated-REP and free pool-held REP requirements against live open interest. Both requirements round upward; zero open interest is healthy. isVaultHealthyAtFactor applies an approval-selected factor of at least 10,000 to both branches. Capacity and health
calculateRetentionRate(settlementCollateralAttoEth, mintingCapacityAttoEth) Zero live minting capacity returns the maximum retention rate. Otherwise retention decreases linearly through the 80% utilization dip and remains at the minimum rate above it. Retention rate

Production contract inventory

Area Named contracts and modules Role
Deployment tracking DeploymentStatusOracle.sol Reports one code-presence bit per configured deployment-step address. See Deployment Status Oracle.
Carry proof hashing MerkleMountainRange.sol, EscalationGameProofVerifier.sol, EscalationGameTypes.sol Defines the carried-deposit leaf shape, the 64-peak limit, proof-length rules, and nullifier-root replay protection. See Merkle Mountain Range carry proofs.
Escalation game composition EscalationGame.sol, EscalationGameCalculations.sol, EscalationGameCarry.sol, EscalationGameClaimDelegate.sol, EscalationGameDepositDelegate.sol, EscalationGameEscrow.sol, EscalationGameSettlement.sol, EscalationGameState.sol, EscalationGameStorage.sol Splits the game across immutable ownership and storage, claim and deposit delegation, calculations, continuation proofs, escrow, and settlement without exposing those internal modules as separate canonical games.
ERC-20 support ERC20.sol, IERC20.sol, IExternalGenesisReputationToken.sol, IERC20Metadata.sol, Context.sol, SafeERC20Ops.sol, GenesisReputationToken.sol, ReputationToken.sol Base REP token implementation, ERC-20 and external genesis REPv2 interfaces, metadata, execution context, safe transfer wrappers, the constructor-allocated genesis token with fixed theoretical supply, and the inherited transfer, approve, and transferFrom entrypoints.
ERC-1155 and token ids ERC1155.sol, ShareToken.sol, TokenId.sol, IERC1155.sol, IERC1155Receiver.sol, IERC165.sol, IShareToken.sol Outcome-share token plumbing, interface support, token-id encoding, inherited setApprovalForAll, and both single and batch safeTransferFrom forms.
Factories and deployers EscalationGameFactory.sol, SecurityPoolFactory.sol, SecurityPoolDeployer.sol, ShareTokenFactory.sol, UniformPriceDualCapBatchAuctionFactory.sol, PriceOracleManagerAndOperatorQueuerFactory.sol Deterministic deployment entrypoints for pool, share-token, oracle-coordinator, escalation-game, and auction instances.
Migration, settlement, liquidation, and storage modules SecurityPoolStorage.sol, DelegateCallForwarder.sol, SecurityPoolSettlementDelegate.sol, SecurityPoolOperationsDelegate.sol, SecurityPoolMigrationProxy.sol, SecurityPoolForker.sol, SecurityPoolForkerAuctionSettlementBase.sol, SecurityPoolForkerBase.sol, SecurityPoolForkerStorage.sol, SecurityPoolForkerTypes.sol, SecurityPoolForkerVaultMigrationBase.sol, SecurityPoolForkerVaultMigrationDelegate.sol, UniformPriceDualCapBatchAuctionStorage.sol, OpenOraclePriceCoordinatorTypes.sol, EscalationGameForker.sol, SecurityPoolEventEmitter.sol , LiquidationApprovalRegistry.sol, SignatureValidation.sol Defines shared pool storage, delegated liquidation accounting and bounded approval reservations, Elliptic Curve Digital Signature Algorithm (ECDSA) and ERC-1271 signature validation, funded continuation delegatecalls, fork-time state, truth-auction settlement, vault and unresolved-escalation migration, event encoding, and stable proxy identity used while routing parent state into child pools.
Protocol interfaces IEscalationGame.sol, ISecurityPool.sol, ISecurityPoolForker.sol, ISecurityPoolForkerChildEscalationGameInitializer.sol, IUniformPriceDualCapBatchAuction.sol, IWeth9.sol Typed boundaries used by games, pools, migration delegates, auctions, and WETH integration.
Protocol utilities Constants.sol, ScalarOutcomes.sol, BinaryOutcomes.sol, SecurityPoolUtils.sol, Multicall3.sol, WETH9.sol Shared constants and math, outcome representations, Multicall3 aggregate, tryAggregate, tryBlockAndAggregate, blockAndAggregate, aggregate3, aggregate3Value, and block-context reads, plus standard WETH9 deposit, withdraw, approval, and transfer support.
Operator deployment helper GenesisUniswapV3Seeder.sol Lets the Chaos bot mint a bounded full-range genesis REP/WETH Uniswap V3 position, pays the pool callback from exact operator approvals, and refunds unused tokens.
Trading protocol PredeploymentShareSink.sol, TradingLiquidityToken.sol, TwoWayConstantProductFactory.sol, TwoWayConstantProductMath.sol, TwoWayConstantProductPair.sol, TwoWayConstantProductRouter.sol, ITradingShareToken.sol, ITwoWayConstantProductFactory.sol, ITwoWayConstantProductPair.sol. Deterministic two-outcome pool deployment, constant-product pricing and reserves, routed liquidity and swap operations, receive-based share authorization, permit-enabled liquidity tokens, canonical Statoblast share-token integration, and quarantine of shares sent to counterfactual pair addresses before deployment.
REP authorization support AuthorizationSignatures.sol, ERC20Authorization.sol, IERC20Authorization.sol. Pinned signature recovery, EIP-712 domain handling, ERC-2612 permits, and recipient-bound ERC-3009 transfers used by newly deployed child REP.
Imported oracle integration UPSTREAM.md, OpenOracle.sol, Errors.sol, ISignatureTransfer.sol, interfaces/IERC20.sol, interfaces/IERC165.sol, token/ERC20/IERC20.sol, IERC1363.sol, SafeERC20.sol, Panic.sol, ReentrancyGuard.sol, StorageSlot.sol, utils/introspection/IERC165.sol, Math.sol, SafeCast.sol OpenOracle's imported source, exact openPunt revision, compiler profile, and dependency provenance are owned by UPSTREAM.md. The coordinator submits attoETH/attoREP reports with dispute history and full game storage enabled; it does not enable the new optional flags. OpenOracle's packed event stream remains separate from Zoltar replay.