Docs
Trust model
No admin, no pause, isolated clones. What a Term can and cannot do. Unaudited.
This is an unaudited testnet build. Do not treat it as safe for real value.
No admin
No contract in Arrha has an owner. There is no pause, no upgrade, no fee switch, no allowlist and no emergency withdraw. Nobody, including the team, can move funds out of a Deal except through the rules written in it.
| Contract | Owner | Pause | Upgrade | Holds funds |
|---|---|---|---|---|
| DealFactory | None | No | No | Never |
| Deal (each clone) | None | No | No | Its own earnest and bond |
| Treasury | None | No | No | Fees, with no withdraw |
| TermRegistry | None | No | No | Never |
| Official Terms | None | No | No | Never |
| ArrhaLens | None | No | No | Never, read-only |
Isolated clones
Every Deal is its own EIP-1167 minimal-proxy clone of one Deal implementation. Each clone holds only its own earnest and bond. A fault in one deal cannot reach the funds of another.
The implementation itself is locked at deployment and can never be initialized. Each clone is initialized once, in the same transaction that creates it.
The factory never holds funds. Native HYPE is forwarded to the clone in the creating call. ERC-20 is pulled from the payer straight into the clone, and the factory checks that the full amount arrived. Tokens that charge a fee on transfer are rejected.
Who can move funds
| Function | Caller | Where funds go |
|---|---|---|
cancel | Payer | Payer |
acceptDelivery | Payer | Payee, fee to Treasury |
reject | Payer | Kill fee to payee, rest to payer |
settle | Anyone | Payee or payer, by rule |
claim | Anyone | Caller, bounties only |
No function sends funds to an arbitrary address chosen by the caller, except claim on a bounty whose Term is true.
Reentrancy
Every function that moves funds is behind a reentrancy lock. A payee contract that tries to call back into the deal while receiving a payment gets a revert.
What a Term can do
A Term is called with check, a view function. It cannot change state, hold funds or move them. Stateful Terms write only their own bookkeeping through observe, keyed by deal and parameters.
A Term that reverts is read as false. A broken Term therefore leads to a refund at the deadline, never to a release.
What a Term cannot be trusted to do
A Term decides when a deal pays. A malicious custom Term can lie: it can return true at once, or never. The Deal cannot tell.
- Official Terms are immutable and listed on the Terms catalog.
- Custom Terms are listed in the TermRegistry by anyone. Listing is not review.
- Before locking earnest against a custom Term, read its code, or use an official Term.
Testnet mocks
On testnet, the official Terms read mock contracts: MockLaunchpad, MockTwapPool, MockListingOracle and MockOath. Their setters are permissionless by design, so anyone can drive the demo deals through every state. Any testnet deal can be made true or false by anyone. On mainnet, the Terms read real launchpads, pools, HyperCore and Horkos.
Push payments
Deals pay by pushing funds to the payee and payer. If either address is a contract that rejects HYPE, the transfer reverts and so does the settlement. This only blocks the party that controls that contract. Use an externally owned account or a wallet contract that accepts HYPE.
Audit status
Unaudited testnet build. The contracts have a full Foundry test suite covering happy paths, refunds, kill fee math, bond forfeiture, bounties, tranches, vesting with pause, fee routing, cancellation, reentrancy and drain attempts. Tests are not an audit.