On-chain contracts

Sentico matches orders off-chain and uses contracts on Arbitrum One (chain ID 42161) for collateral custody and state commitments.

Private beta, not a public launch

These contracts are live on a public chain, but the venue remains a capped, whitelisted private beta. The contracts and the complete system have not yet completed the external audit required for a public launch.

Current deployment

Contract	Network	Address	Current role
MultiCollateralVault	Arbitrum One	0xd1f0fffb736d75fd402121eb14bdc46bfe80ca02	Holds supported collateral and executes the withdrawal/emergency paths
StateCommitment	Arbitrum One	0xf88424085805b55ac6ad584aa9bb8e1f8eb6cf89	Stores publisher-quorum state checkpoints; owner() is the TimelockController below
TimelockController	Arbitrum One	0x4e2b7ac35b42dac4266ff375799db7409ae19162	48-hour governance timelock; owner of StateCommitment, admin and governor of the vault

Never obtain an address from a direct message or search result. Compare it with this page and verify the bytecode and current roles on Arbiscan.

What is live

• Checkpoints require a 7-of-10 publisher quorum.
• The production scheduler targets one checkpoint per hour.
• At the 2026-09-04 review latestCheckpointId() returned 1005, requireExitRoot() was true, and the contract was unpaused.
• Supported collateral: USDC, USDT, WETH (listed as ETH in the asset registry), WBTC, ARB, CKT, and TCO — all with deposits and withdrawals enabled on-chain and in GET /api/v1/public/assets.
• Deposits are credited after 12 confirmations. The engine credits an asset only when its vault listener is configured for it; confirm a credit in GET /api/v1/accounts/{account}/bootstrap (engine truth). The lighter GET /api/v1/accounts/{account} read can omit recently added assets.

The dynamic protocol endpoints under /api/v1/protocol/* and the chain itself override copied checkpoint numbers or status values on this page.

Current authority model

Verified on-chain on 2026-09-04 with read-only eth_calls:

Power	Holder today
StateCommitment.owner()	TimelockController 0x4e2b…9162 (48-hour delay). It is a contract, so renounceOwnership and EOA transfers are blocked by the contract rules.
Vault DEFAULT_ADMIN_ROLE	TimelockController and the pre-timelock governor EOA 0x3352…9491
Vault GOVERNOR_ROLE	TimelockController and the same EOA
Vault GUARDIAN_ROLE	The same EOA (emergency pause)
Vault WITHDRAW_EXECUTOR_ROLE	Operational executor signer
Checkpoint publishers	Fixed 10-slot set, 7 signatures required

The Timelock is driven by a 3-of-4 governance Safe whose signers include two cloud-HSM keys; the Safe holds no direct vault role, so every parameter change passes the 48-hour delay. The residual EOA roles are the open item. As long as 0x3352…9491 still holds DEFAULT_ADMIN_ROLE, a compromise of that key bypasses the timelock. Revoking it is itself a timelocked governance action and must be proven on-chain before public launch. Read the current state as "timelock governance live, legacy admin not yet revoked", not as the finished target model.

Custody flow

See MultiCollateralVault, StateCommitment, and the Trust Model for mechanics and limitations.