SecurityPoolForker
Freezes parent pools, creates selected child pools, migrates vault and escalation state, and settles collateral-repair auctions. SecurityPoolForker source contract
Read surface
Use zoltar, forkData, getUnassignedPosition, isEscalationDepositClaimedDirectly, getEscalationDepositId, getDirectlyClaimedEscalationPrincipal, isEscalationWinnerHaircutPaidByFork, getEscalationMigrationEntitlementStatus, getOwnForkRepBuckets, getOwnForkMigrationStatus, getMigrationProxyAddress, getQuestionOutcome, attoRepToBackingUnits, and backingUnitsToAttoRep to reconstruct fork progress and preview migration conversions. forkData includes cumulative migrated REP and the fork-activation timestamp. getUnassignedPosition returns pending REP backing units, capacity ownership, raw auction bad debt, that debt’s generation, and the auction-finalization fee index; consumers count the debt only while its generation equals the pool snapshot’s current badDebtGeneration.
Child-game trust boundary
Fork entrypoints and child setup may receive contracts through unauthenticated pool lineages. External-universe initiation requires the supplied pool to be authorized by its declared share token, but that relationship alone does not prove factory registration; own-game initiation does not perform that authorization check. Canonicality comes from the configured SecurityPoolFactory registry. A game relationship check is point-in-time: the reported nonzero game address must return the supplied pool or child from securityPool() when validated. This does not prove that an arbitrary game getter is immutable or that the address was factory-deployed. Child setup captures one reported game address, validates it before privileged use, and reuses that exact address for continuation backing and escrow work. When unresolved escalation requires a continuation and setup initially reports no game, initialization creates one; the forker then captures and validates it before continuation use. Combined vault migration passes the captured child/game pair into unresolved cleanup without reading the child getter again. Truth-auction completion performs a fresh point-in-time validation of the game reported then before checking continuation readiness. Genuine factory-deployed EscalationGame instances store their pool immutably, but safety on unauthenticated paths does not assume arbitrary contracts do.
State-changing interactions
| Transaction | Caller | Main prerequisites | State or asset effect | Primary signals |
|---|---|---|---|---|
initiateSecurityPoolFork(securityPool) |
Anyone | Pool operational with no inherited fixed outcome; the pool is authorized by its declared share token; its universe already forked; fork state not initialized; if an escalation game exists, it reports the supplied pool from securityPool() when validated and the universe fork occurred before that game settled. Declared-token authorization is not configured-factory registration; see the child-game trust boundary. |
Freezes the supplied pool after an external universe fork, drains its pool and game REP, and records a migration snapshot keyed by that address. The snapshot is canonical only when the supplied pool is already registered by the configured SecurityPoolFactory. |
SecurityPoolForkSnapshot and ParentRepLocked; additionally DisputeStakedRepDrainedAtFork when unresolved escalation exists |
forkZoltarWithOwnEscalationGame(securityPool) |
Anyone | Pool operational with no inherited fixed outcome; its escalation game reports the supplied pool from securityPool() when validated and canTriggerOwnFork() is true because it recorded a local non-decision or inherited a threshold tie without a game-level fixed outcome; universe not already forked. The game-local predicate does not bypass the pool guard. Unlike external-universe initiation, this entrypoint does not require declared-share-token authorization; neither path authenticates the supplied address against the configured pool factory. See the child-game trust boundary. |
Uses the supplied pool game's non-decision to fork Zoltar, freezes that pool, and records own-fork REP buckets and snapshot state keyed by its address. The snapshot is canonical only when the supplied pool is already registered by the configured SecurityPoolFactory. |
SecurityPoolForkSnapshot, ParentRepLocked, and Zoltar fork events; additionally DisputeStakedRepDrainedAtFork when unresolved escalation exists |
migrateRepToZoltar(securityPool, outcomeIndices) |
Anyone | Migration proxy exists and the pool is PoolForked. Only a positive migration amount with at least one selected outcome checks the eight-week window, existing child ForkMigration state, outcome validity, and cumulative split bound. A zero amount skips those checks even when outcome values are supplied. |
For a positive migration amount and nonempty list, ensures that the forker's recorded pool migration amount has been split into each selected child REP branch. A zero migration amount or empty list returns after the proxy and pool-state guards without per-outcome validation or events. | MigrationRepSplit and ChildRepSplit when a selected branch requires a new split; no event for a zero amount, empty list, or already-satisfied branch |
createChildUniverse(securityPool, outcomeIndex) |
Anyone | Parent in migration window; selected fork outcome is well formed; child pool is not already deployed. The returned auction is nonzero, deployed, and has never been trusted by this forker; the child's fork-data slot is unused; and the child reports the expected parent, universe, source factory, forker, and auction. The selected child's reported nonzero escalation game passes the child-game trust boundary. These relationship checks do not independently prove configured-factory registration. | Loads an already deployed child universe and REP token or deploys them when absent, then lazily deploys the selected child pool, coordinator, and auction; authorizes and links the child; captures and validates the child's escalation game; and initializes any continuation snapshot and materializes or sweeps child backing through that validated game. | DeployChild only when child REP was absent; always SecurityPoolRegistered, DeploySecurityPool, AuthorizationUpdated, ChildPoolLinked, and TotalRepBackingUnitsSet; AwaitingForkContinuationSet, EscalationGameSet, GameContinuedFromFork, ForkCarryCheckpoint, MigrationRepSplit, ChildDisputeStakedRepMaterialized, and PoolHeldRepSweptToChild as continuation and backing state requires |
migrateVault(securityPool, outcomeIndex) |
Vault owner for their non-escrowed position | Migration window open; the selected child's reported nonzero escalation game passes the child-game trust boundary. The optional unresolved parent escalation-deposit accounting cleanup wrapper calls this function first to migrate transferable vault state. | Converts the caller's parent REP backing-unit claim to REP at the fork snapshot and credits that REP amount as child-local backing units; transfers REP-denominated capacity ownership and vault bad debt into one child pool; checkpoints but retains claimable fees in the parent vault; and separately routes proportional pool-level settlement collateral while preserving aggregate bad debt. Child vault configuration inherits the parent saved target when the child vault has no target of its own. Repeat calls can have no additional REP backing units, capacity ownership, or vault bad debt to move. | VaultBadDebtMigrated and VaultMigrationCheckpoint |
migrateVaultWithUnresolvedEscalation(securityPool, vault, childOutcomeIndex) |
The named vault owner | Migration window open; caller equals vault; selected child not already recorded for this optional cleanup; the selected child's reported nonzero escalation game passes the child-game trust boundary. |
First runs ordinary migration for the same vault, which may convert its parent REP backing-unit claim to REP and credit that REP as child-local backing units; transfer capacity ownership and vault bad debt to the selected child while preserving aggregate bad debt; checkpoint but retain claimable fees in the parent vault; and separately route proportional pool-level settlement collateral. Child vault configuration inherits the parent saved target when the child vault has no target of its own. It returns the selected child and its captured, validated escalation game to the unresolved-accounting cleanup phase, which reuses those exact addresses without reading the child's game again. The cleanup then clears that vault's unresolved parent escalation-deposit accounting in constant-size work and records it; the cleanup neither funds dispute-staked REP backing nor authorizes carried proofs. | Vault migration events, including VaultBadDebtMigrated, plus EscalationMigrationEntitlementInitialized on first export and EscalationMigrationEntitlementMaterialized for the selected child |
claimForkedEscalationDeposits(...) |
The named vault owner | Caller equals vault; unresolved escalation existed when the pool initiated its own fork and the parent game still satisfies canTriggerOwnFork() by having either a local non-decision or an inherited threshold tie without a fixed outcome; selected child can be created or loaded, remains in ForkMigration, has a continuation game that passes the child-game trust boundary, and is inside the eight-week claim window. A nonempty list additionally requires the matching winning outcome, unclaimed deposit identities, and every deposit to commit vault as its immutable depositor. |
First gets or lazily deploys the selected child universe, REP token, pool, coordinator, and auction, then captures and validates the child's escalation game and uses that same game for continuation backing and escrow payment. A nonempty list claims winning own-fork parent deposits and records their stable identities against descendant replay. An empty list still performs child setup and emits a zero-valued claim summary. | DeployChild, SecurityPoolRegistered, DeploySecurityPool, AuthorizationUpdated, ChildPoolLinked, TotalRepBackingUnitsSet, AwaitingForkContinuationSet, EscalationGameSet, GameContinuedFromFork, ForkCarryCheckpoint, MigrationRepSplit, ChildDisputeStakedRepMaterialized, and PoolHeldRepSweptToChild as setup requires; per claimed deposit, CarryDepositConsumed and ClaimDeposit; escrow record/export events when REP is paid; always ClaimForkedEscalationDepositsToWallet, including for an empty list |
startTruthAuction(securityPool) |
Anyone | Child migration window ended; pool is in fork migration; required child REP is available. If unresolved escalation existed at fork, any game reported during immediate completion passes the child-game trust boundary. | Copies the frozen parent's remaining economic claim supply into the child, closes migration accounting, and either reopens a fully backed child or starts its repair auction. | ShareTokenSupplySet and TruthAuctionStarted; immediate no-auction completion also emits TruthAuctionFinalized, pool accounting checkpoints, and ForkContinuationResumed for an unresolved continuation |
finalizeTruthAuction(securityPool) |
Anyone | Truth Auction started, its one-week window has passed, and msg.value is zero. Actual child ETH covers the installed settlement collateral plus accrued fee liabilities. Installing these inherited liabilities does not require current REP capacity or backing. If unresolved escalation existed at fork, the game reported at completion passes the child-game trust boundary. |
Finalizes the ended auction, accounts migration-routed settlement collateral plus accepted bid ETH, and records every unmigrated REP backing unit, capacity unit, and proportional bad debt in an explicit nonwithdrawable unassigned position. It activates the child and saves the fee index. For positive existing-owner REP residue, total backing units are P × H / (H − Q), rounded up to a whole unit, where P is fork-time pool-held REP for all existing owners including unmigrated vault owners, H is finalization pool-held REP including sold escrow REP, and Q is purchased REP. The bidder backing-unit budget is total units minus P. If H − Q is zero, bidder units use H × PRICE_PRECISION (1e18) while migrated units remain in the total. Capacity ownership has a separate budget. Positive-purchase auction ownership becomes fee eligible immediately; after a zero-purchase auction, the unassigned capacity remains outside fee eligibility. A nonzero repair contribution is rejected. | TruthAuctionFinalized, auction AuctionFinalized, and pool accounting checkpoints; TruthAuctionHaircutApplied when purchased REP removes a positive escalation allocation; ForkContinuationResumed for an unresolved continuation |
settleAuctionBids(securityPool, vault, claimTickIndices, refundTickIndices) |
Anyone on behalf of the named bidder vault | At least one index; before finalization the claim list must be empty and refund indexes must be eligible; after finalization all indexes must belong to the named vault owner and remain unsettled. | Before finalization, settles only provably losing bids. After finalization, combines claim and refund indexes into one settlement withdrawal and transfers each claim's proportional REP backing units, capacity ownership, and finalization-to-claim fees from the unassigned position to the bidder vault. Its bad-debt share transfers only while the auction's recorded debt generation is still current; after those collateral claims are exhausted, the old debt expires while raw claimed-auction counters continue to settle deterministically. Capacity and bad-debt division dust follows each bid's deterministic cumulative ETH position, so claim order cannot change individual or aggregate settlement. The transfer does not change total capacity, fee eligibility, active open interest, total bad debt, retention, or aggregate accrued fees. A winning dust bid may receive capacity ownership even when its REP allocation rounds to zero. The call's aggregate positive refund is credited to the named bidder's pull-payment balance without calling recipient code. | Underlying auction BidSettled; one aggregate EthRefundCredited per call when total credited ETH is positive; ClaimAuctionProceeds when REP backing, capacity ownership, or raw auction bad-debt settlement advances. Its cumulative claimed and total auctioned bad-debt fields are raw counters; effective vault debt still requires the recorded auction generation to match the pool’s current generation |
claimAuctionProceeds(securityPool, vault, tickIndices) |
Anyone on behalf of the named bidder vault | Auction finalized. A nonempty list additionally requires every index to belong to the named vault owner and remain unsettled. | For a nonempty list, withdraws finalized bid settlements and transfers each claim's proportional REP backing units, capacity ownership, and finalization-to-claim fees from the unassigned position to the bidder vault. Its bad-debt share transfers only while the auction's recorded debt generation is still current; after those collateral claims are exhausted, the old debt expires while raw claimed-auction counters continue to settle deterministically. Capacity and bad-debt division dust follows each bid's deterministic cumulative ETH position, so claim order cannot change individual or aggregate settlement. The transfer does not change total capacity, fee eligibility, active open interest, total bad debt, retention, or aggregate accrued fees. A winning dust bid can receive positive capacity ownership when its REP allocation rounds to zero. The call's aggregate positive refund is credited to the named bidder's pull-payment balance without calling recipient code. For an empty list, the wrapper exits after the finalization guard without validating bids or the named beneficiary, changing state, or emitting events. | For processed bids, underlying auction BidSettled; one aggregate EthRefundCredited per call when total credited ETH is positive; ClaimAuctionProceeds when REP backing, capacity ownership, or raw auction bad-debt settlement advances. Its cumulative claimed and total auctioned bad-debt fields are raw counters; effective vault debt still requires the recorded auction generation to match the pool’s current generation; no event for an empty list |
initializeChildForkedEscalationGameIfNeeded(parent, child, childEscalationGame) |
This SecurityPoolForker contract only, through its migration delegate callback |
External caller is the forker itself; parent and child match the active migration path; a supplied nonzero game passes the child-game trust boundary. | Allows delegated migration code to initialize a child continuation while preserving the forker as the authoritative caller and the already captured child-game identity. When unresolved escalation requires a continuation and no game existed, it captures and validates the game created by initialization before any continuation use. | ChildDisputeStakedRepMaterialized and escalation-continuation events when initialization is required |
Direct ETH transfer to receive() |
A child-pool Truth Auction trusted by this forker during ChildPoolLinked |
trustedAuctionAddresses[msg.sender] was set when the forker linked the child and emitted ChildPoolLinked; configured-factory registration determines whether that lineage is canonical. |
Accepts auction ETH during forker-controlled auction finalization. | No dedicated receive event; auction AuctionFinalized is followed by forker TruthAuctionFinalized and pool accounting checkpoints |