Build
Architecture
The six planned UNDO contracts, what each one does, what comes from the open-source Refund Protocol and what is new.
The six contracts
UNDO is designed as six contracts with narrow roles. In the current draft, payment funds sit in two of them: UndoPay holds escrowed payments, and BondVault holds bonds. Disputes holds dispute deposits and StakeModule holds staked $UNDO. The other two keep records. This layout is a draft and may change before testnet.
| Contract | Role | Holds funds |
|---|---|---|
| UndoPay | Payment entry point and routing | Escrowed payments |
| BondVault | Bonds, capacity, exposure, refunds | Bonds |
| Disputes | Dispute process and arbitration | Dispute deposits |
| Receipts | Agent sessions and signed receipts | No |
| SellerRegistry | Seller age, tier, guardrails, profile | No |
| StakeModule | $UNDO staking and slashing | Staked $UNDO |
What each contract does
UndoPay
UndoPay is the payment entry point. Every protected payment, in either lane, goes through it. It takes the 0.5% fee from the seller's side, or 0.35% for a seller who stakes $UNDO. It then asks BondVault whether the amount fits in the seller's free capacity. If it fits, UndoPay routes an instant payout to the seller. If it does not, UndoPay holds the payment in escrow until its refund window ends. Nothing is rejected.
BondVault
BondVault holds seller bonds in USDC. It tracks each seller's capacity and open exposure, adds exposure when a payment is paid instantly, and releases it when the window ends. It deploys idle bonds to Arc lending markets and passes 90% of the yield to the seller. Yield is variable and can be zero. BondVault also pays refunds: when a seller loses a dispute and the escrowed balance is not enough, the rest comes out of the bond. A bond cannot be withdrawn while exposure is open against it.
Disputes
Disputes runs the dispute lifecycle. It takes the buyer's deposit of 2% with a 1 USDC minimum, starts the seller's 48h response period, and records a refund, a contest or a default. For contested cases it draws 3 arbitrators, runs the commit-reveal vote within 72h, and handles the single appeal to 7 arbitrators with a doubled deposit. It instructs StakeModule to slash minority and absent arbitrators, and instructs the refund path when the buyer wins.
Receipts
Receipts serves the Agent lane. It records protected sessions with their spending cap and window, from 10 minutes to 24 hours. It verifies EIP-712 receipts signed by the seller, including EIP-1271 signatures from smart-contract wallets. It processes automatic claims: a paid call with a missing or late signed receipt is refunded without arbitration. See Agent lane for the draft receipt struct.
SellerRegistry
SellerRegistry stores what the protocol knows about each seller. That includes the seller's age, which sets the leverage tier of 1x, 2x or 5x, and the refund window of 7, 14 or 30 days. It enforces the guardrails, including the 2,500 USDC per-payment cap and the auto-freeze to 1x above 5% lost disputes over 30 rolling days. It also exposes the public profile: protected volume, dispute rate, lost-dispute rate, bond and free capacity.
StakeModule
StakeModule holds staked $UNDO. A staker is eligible to be drawn as an arbitrator. The module applies slashing, gives staking sellers the fee discount from 0.5% to 0.35%, and distributes the buyback share of fees to stakers. In phase 2 it is also planned to provide the first-loss layer ahead of Guarantee Pool depositors.
From the Refund Protocol
The design extends Circle Research's Refund Protocol, which is open-source under the Apache 2.0 licence. UNDO is an independent project. It is not endorsed by Circle and has no affiliation with Circle.
Three ideas come from the Refund Protocol:
- Escrowed payments with a refund window. A payment is locked up for a period during which it can be refunded.
- An arbiter role that can refund. A designated party can send a locked payment back to the payer.
- Early withdrawal mechanics. A way for the recipient to receive funds before the lockup ends.
UNDO's contracts are a rewrite, not a fork deployed as is. The rewritten code will be audited before launch.
New in UNDO
| New element | Where it lives |
|---|---|
| Bonds and leverage-based instant payout | BondVault, UndoPay |
| The Agent lane with signed receipts | Receipts |
| Decentralised arbitration with staking and appeal | Disputes, StakeModule |
| The refund waterfall | BondVault, Disputes |
| The seller registry and guardrails | SellerRegistry |
In the Refund Protocol, the arbiter is a single role. In UNDO, that role is replaced by arbitrators drawn at random among stakers, with a commit-reveal vote and one appeal.
Design rules
- Non-upgradable contracts. The code that holds funds cannot be swapped after deployment.
- A pause with limits. A pause can stop new payments. It never blocks refunds or withdrawals.
- Bounded governance. $UNDO governance covers parameters only, never funds.
- Caps. A 2,500 USDC per-payment cap and a capped mainnet launch.
Details are on the Security page.