Mainnet release readiness

Mainnet remains unavailable through the borrower app. The contract is deployed and unfunded, while its monitored oracle and isolated indexer are active. This checklist records the evidence and requirements before funding or public app activation.

Dormant mainnet deployment

• Contract: 0x9911ce88d2750b7975e3758c1f9d2faf8d4c468bd32169eb0c47ec333d661bbb
• Deployment block: 63667884
• Transaction: 0x2a208b12140c342f1344a7aea4caaf34823a6737cca8acb04c771210f01fec3e
• Initial deployment owner: 0xed3f1e5c7424a1dcee2301de1407bd8f563120771deadc98637ea967926daa1f
• Current owner: 0xdfb9062f4c9f139bc7432630ec1dd4687d78bb33e0435d17cfa3121828b3ce6d
• Ownership transaction: 0x283bc8f2addee28dbffa9307a40be656127499600d0bbb3694badd4265eb40a0
• Price oracle: 0xd06f6b172d0307343d9fd48c4092c7cd59a55ab2ae52a259921b03631e049bb0
• Native gas spent: 0.000000177
• Pool balances and active loans: zero
• Manifest and public app: disabled
• Oracle Worker: active, monitored, and contract-bound; live scoped-signature smoke and twice-daily Telegram reporting are verified
• Mainnet indexer: active with isolated D1/queues/DO and contract-specific reader templates

Pre-activation smoke verified the artifact hashes, chain ID 9889, immutable FUEL/USDC IDs, owner, oracle, recoverable oracle signature, and zero contract state.

Audit remediation

Finding	Mitigation	Evidence	Status
Equal or zero asset configurables	Shared deployment boundary rejects malformed, zero, and equal asset IDs; deployed contract exposes FUEL, USDC, and chain-ID getters and the helper verifies them after deployment.	scripts/lib/deploy.ts, fuel_asset_id(), usdc_asset_id(), chain_id(), wallet deployment tests	Cleared
Deprecated signature recovery	Replaced std::ecr with pinned Sway std::crypto::secp256k1.	Release build and oracle interoperability tests	Cleared
Floating price conversion	Decimal source tokens are parsed and rounded to 15 places using BigInt; no floating-point multiplication is used.	Oracle decimal boundary tests	Cleared
Stale-price relabeling	Source timestamps are mandatory and checked before caching. Mainnet accepts a newly fetched source up to 120 seconds old, reuses a market observation for up to ten minutes, and refuses to re-sign observations older than eleven minutes. The contract accepts the signed Fuel-block timestamp for five minutes, so a caller retaining an attestation can extend the effective market-observation window to roughly sixteen minutes.	SOURCE_MAX_AGE_SECONDS, stale/source-time route tests, Durable Object cache policy	Cleared with explicit ten-minute cache and roughly sixteen-minute retained-attestation ceiling
Broad CORS	Exact production, preview, and local-development origin set.	Lookalike-origin rejection test	Cleared
User-driven upstream price usage	A Durable Object fetches keyless CoinGecko at most every ten minutes, falls back to Bitget then Gate bid/ask midpoints, and re-signs the cached observation every minute; public requests only read it.	Fallback/unit tests plus live testnet cache validation	Cleared
Weak deployment provenance	Mainnet manifest pins release ABI, bytecode, storage-slot hashes, source commit, Forc version, and release profile; preflight compares local artifacts.	bun run mainnet:preflight	Cleared
Weak smoke verification	Oracle-active smoke verifies immutable configurables, owner, oracle, chain, zero pool state, and cryptographically recovers the live oracle signer.	bun run scripts/mainnet-smoke.ts --oracle-active	Cleared for the current zero-state deployment
Deployment record loss	Deployment helper journals the transaction ID immediately after submission, then records confirmation before fallible verification/funding; the manifest writer later journals verification and atomically replaces the canonical manifest.	scripts/lib/deploy.ts, deployments/testnet.json.journal.jsonl	Cleared
SDK/Core compatibility	Fuels SDK 0.101.1 opened and repaid a real loan against Fuel Core 0.48.3 on public testnet; mainnet reports the same node version.	Testnet lifecycle record below	Cleared for the exercised calls
Mainnet indexing isolation	Separate D1, queues, Durable Object namespace, Worker, and contract-bound reader templates were provisioned and verified against zero onchain state.	workers/indexer/wrangler.mainnet.jsonc, live /v1/health and /v1/stats	Cleared and active
Production owner custody	Ownership transferred onchain to the foundation wallet; a domain/chain/contract-bound challenge signature recovered to the live owner().	deployments/mainnet-owner-proof.json, docs/CONTROLS.md	Signing control verified; operational backup/recovery procedures remain a separate custody responsibility

Audit-hardened testnet deployment

• Contract: 0x39110da123e676a01c9600a2a5953228860accee2411338e21ed14c78917f891
• Deployment block: 72746143
• Deployment transaction: 0x27415adb06936a30a10cfee2d978240a63017a54599a46df150919dd507b5f58
• Initial USDC funding transaction: 0x24a24fb3af180a4e339958a617663b6f5636f5464bc018c72e58420d6e55ff7e
• Bytecode SHA-256: 72af4d0389bfd0f87c7ba5a8e144f003a9fc01c9d6a6e83ab85102ffcfae40aa
• ABI SHA-256: 746f86bff3a1ecbf327123b31b521c8fb5b76d37fc571d27692ef12a47207788
• Storage slots SHA-256: 13f2d4bc21ebee7ea0601c8f618bda4e46d6e04ed9a8ff2b1cf0bcd97885193e

Validated on Fuel testnet/Core 0.48.3 using Fuels SDK 0.101.1:

1. Live immutable configuration reads matched chain 0, test FUEL, and test USDC.
2. Fresh Gate.io observation time was converted to TAI64, signed, matched the new contract digest, and passed onchain freshness/signature checks.
3. Loan 0 opened from a live Gate.io observation after freshness gating and validates the hardened signing path.
4. Partial and full repayment succeeded.
5. Repayment released no collateral and a pre-maturity claim reverted.
6. Raw-reader templates were regenerated against the new ABI/contract.
7. The indexer synchronized loan 0 from Fuel RPC and reported exact repaid state.

Maturity claim/default boundaries remain covered by release Sway tests and local E2E tests because public testnet time cannot be advanced six months for a smoke run.

Remaining mainnet sequence

1. Approve exact initial FUEL/USDC funding amounts and source wallets.
2. Fund approved amounts and reconcile balances with a deliberately small lifecycle smoke.
3. Activate the public app under a separate explicit approval.