Contracts

Accounts

The desk also calls two accounts Hushd does not run:

These come from packages/sdk/src/network.ts. The live state of each one is on transparency.

Pool

A shielded pool for NEP-141 tokens. Notes are Poseidon commitments in a Merkle tree of depth 20, and the pool keeps the last 100 roots, so a proof made a few blocks ago still lands. Every Groth16 proof is verified inside the call with NEAR's alt_bn128 host functions.

• Add: ft_transfer_call from the token to the pool with {"inner": "<field>"}. The pool computes the note from what it actually received, so a deposit needs no proof and cannot claim more than it sends.
• transact: spend up to two notes into two new ones, optionally cashing out with change. One proof. If the payout fails, a refund note goes back into the pool.
• settle_swap: two counterparties' legs in one call, only from the desk, for a deal it matched.
• verify_disclosure (view): checks a proof made for one named reader against chain state.
• Rules: listing a token, its deposit limits, the desk and the owner change only through propose_change and a timelock; anyone can apply_change after it. The owner can pause new deposits, never cash outs. There is no admin withdraw.

Views: get_root, is_known_root, next_leaf_index, leaves, is_spent, spend_of, assets, stats, config.

Desk

• Makers: register_maker, bonds posted with ft_transfer_call and the message bond, withdraw_bond, set_maker_active.
• Requests: open_rfq stores the sha256 of a sealed request and its quote window.
• Matches: request_match and its OutLayer callback, or submit_match with the enclave's signature. Either way the desk checks the maker's quote key signed the terms.
• Settlement: settle checks that the trader (the deal's owner key) and the maker (its quote key) both signed the deal's four outputs, then forwards both legs to pool.settle_swap; expire closes a deal nobody settled.
• Hedges: sign_hedge_order (the keeper or the deal's maker, up to three opening orders per deal) and close_hedge through Chain Signatures, record_hedge from the keeper, slash_overdue for anyone after the deadline (ten minutes later when an order was signed and not yet reported), and retry_slash_payout for anyone, or redirect_slash_payout signed by the deal's owner key, when the pool refused a slashed bond.
• Rules: the pool, the bond token and the MPC are fixed at init. The other settings (the owner, OutLayer, the matcher project (which can name one build, owner/project@<wasm hash>) and its secrets owner, the keeper, the OutLayer fee and min_bond) change only through propose_config and then apply_config after a one-day timelock, so makers can withdraw first. min_bond is 1,000 USDC, and a hedged deal's bond must be one of its steps (1, 2, 5, 10, 20, 50 and so on times it).

Views: config, enclave, makers, maker, rfq, deal, deals (newest first), stats, hedge_path.

Board

Where a payer leaves word of a payment for its recipient: post stores a ciphertext of up to 2048 bytes, paid for from the poster's NEP-145 storage balance. The board never records who posted, and posts cannot be deleted. Views: count and posts, a hundred at a time.

Test tokens

Standard NEP-141 tokens with NEP-145 storage and NEP-148 metadata, plus a faucet that pays a fixed amount to each account once an hour and registers the receiver's storage itself. Anyone can call faucet for themselves. faucet_for, which pays another account, is only for the token owner and the operators it names with set_operator; the relayer is one, so it can fund a new passkey account. These tokens exist only on testnet and have no value.

Events

The pool, the desk and the board log NEP-297 events with standard hushd, version 1.0.0. The test tokens log the standard NEP-141 events (standard nep141). The indexer reads them from FastNEAR's transactions API, which lists every transaction that touched each contract (or, with a key, from its neardata block stream).

Check them yourself

• Open each account on NearBlocks from the table above: its code hash, transactions and logs.
• Rebuild them. Each contract is a reproducible build: contract_source_metadata names the commit and the pinned Docker image it was built from, and near contract verify deployed-at pool.hushd.testnet network-config testnet now rebuilds it there and compares the hash, as NearBlocks' Verify and Publish does. The verifying keys in the pool are generated from the same files the browser proves with.
• Read any view directly with NEAR RPC, or with poolView and deskView from the SDK.