Credit Support Annex

CreditSupportAnnex.sol is the per-relationship collateral valuer: it decides which tokens may be posted and shaves each by a haircut, priced off the core's global oracle. A custom credit policy is a new CSA contract, named at agreement creation.

Code

CreditSupportAnnex.sol is the external collateral-pricing contract, chosen per Account Control Agreement at creation. It decides which tokens may be posted, shaves each by a haircut, and reads every token's USD price from the global oracle the core binds. The haircut is the only discount, the same on every unit of a token, however much of it a basket holds. The core never prices collateral itself: it asks the CSA. A custom credit policy is deployed as a new CSA contract and named at agreement creation, with no change to the core.

The price is global; only the haircut is per-relationship. The CSA reads the per-token price from the core's IOracleRegistry at valuation time. One feed serves every CSA and the valuation of the safe.

State

TokenConfig struct

Each eligible token carries a config. It is defined as follows:

struct TokenConfig {
    bool eligible;
    uint16 haircutBps;          // shave: value *= (1 - haircutBps/BPS)
    YieldMode yieldMode;
    uint16 holderShareBps;
}

config[token] returns the TokenConfig for a token. A token with eligible == false may not be posted.

registry

IOracleRegistry public immutable registry;

The CRX core, which serves the global per-token price oracle. The CSA resolves a token's oracle through registry.collateralOracle(token) and reads its USD price (expo -8, 1e8 = $1) at valuation time.

Functions

setToken

function setToken(
    address token,
    bool eligible,
    uint16 haircutBps,
    YieldMode mode,
    uint16 holderShareBps
) external;

Configures a collateral token. Owner-only.

• Retirement is allowed. The owner may flip a live token eligible → false or raise its haircut at any time. A retired token does not brick an open agreement: the lenient and value-conserving paths (valueBasketLenient, fairValue) skip it instead of reverting, which lets a close-out still run, while the strict valueBasket reverts Ineligible to ensure a party can never withdraw against a token the CSA no longer accepts.
• Reverts HaircutTooHigh if haircutBps > 10_000. That is the only revert; the write is otherwise unconditional.

Parameters:

valueBasket

function valueBasket(address[] calldata tokens, uint256[] calldata amounts) external view returns (uint256 usd);

The sufficiency test: values a basket at the global price after this CSA's haircut. The haircut is the only discount. Returns USD scaled to 1e18.

• tokens must be strictly ascending and distinct (the same set validation the core applies to position sets).
• Reverts Ineligible on any token whose eligible is false. deallocate depends on this. A party can never withdraw against a token the CSA no longer accepts.
• Reverts LengthMismatch, UnsortedOrDup, NoOracle, BadMarkScale, or StaleMark on a malformed input or feed.

Parameters:

Return Values:

valueBasketLenient

function valueBasketLenient(address[] calldata tokens, uint256[] calldata amounts) external view returns (uint256 usd);

As valueBasket (haircut only), but skip-not-revert on an ineligible token: it contributes zero instead of reverting the whole basket. Returns USD scaled to 1e18.

• The cascade's solvency gate reads this to ensure a token retired mid-life cannot brick a close-out. valueBasket stays strict.
• tokens must be strictly ascending and distinct.

Parameters:

Return Values:

fairValue

function fairValue(address[] calldata tokens, uint256[] calldata amounts) external view returns (uint256 usd);

The value-conserving valuation: every token at its pure global oracle USD price, no haircut, no eligibility revert. Returns USD scaled to 1e18.

• This is the denomination for every money-movement leg in the cascade. valueBasket is the sufficiency test; mixing the two manufactures a phantom shortfall.
• tokens must be strictly ascending and distinct.

Parameters:

Return Values:

isEligible

function isEligible(address token) external view returns (bool);

Whether token may be posted as collateral under this CSA.

Parameters:

Return Values:

yieldMode

function yieldMode(address token) external view returns (YieldMode mode, uint16 holderShareBps);

How a token's yield is routed. Informational.

Parameters:

Return Values:

Events

Errors

The credit policy lives outside the core, swappable per agreement. See CRX (~10 min) and CRX Contracts (~3 min).