Contracts
SukukDAO runs on Robinhood Chain (chain 4663). None of its contracts is an upgradeable proxy: each contract's code is fixed when it is deployed. Every admin role belongs to the Safe described in Control of money.
Addresses
Addresses are published at deployment, with a role audit listing every privileged address and what it can do. Nothing is deployed yet.
One address is fixed already. The protocol uses only canonical USDG on Robinhood Chain:
0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
Another token on the chain uses the same name. The protocol never accepts it.
Token and pool
| Contract | What it does |
|---|---|
SUKUK | The ERC-20 token. Four minter contracts, each with a cap, burners that burn only their own balance with a reason, the 120-minute launch-window gate, the official-pool gate and the venue list. No admin mint, burn or redeem. |
TollMath | The launch toll formula, as pure arithmetic. |
TollHook | The Uniswap v4 hook on the official SUKUK/USDG and SUKUK/TAO pools. Charges and routes the toll, applies demand cooling and each trader's maximum, and keeps liquidity in the official pools protocol-only. |
PriceObserver | Records every counted second of trading and serves the 4-hour average (with its floor) and the 30-minute average. |
LaunchController | Runs launch day: mints the 4,000,000 launch supply, opens the official pools (SUKUK/USDG at $0.25), starts the clock and releases the sale money. Holds the protocol's pool position. |
Launch
| Contract | What it does |
|---|---|
SyndicateSale | The seat sale: whitelist, sealed-bid commit and reveal, clearing price, tie draw, go or no-go, escrow, refunds and forfeits. |
MigrationDeposit | Deployed on each source chain. Takes NRCH and NUKEM deposits during the window and locks them for good. |
MigrationClaim | On Robinhood Chain. Pays migration claims from a published list: genesis claims into the genesis Agency's stake, everyone else on the vesting schedule, each release directed by the depositor. |
Sukuks and accounting
| Contract | What it does |
|---|---|
TrancheRegistry | One record per tranche: capacity, money raised, deployed and returned, status, payment dates, missed payments, write-downs and the raising-fee budget. |
Ledger | The protocol's ledgers, backing and backing per token. Each address counts in one ledger only. |
BondDepository | Sells Sukuks: tier pricing at the 4-hour average, the backing floor, the breaker, issuance caps and the release period. |
PledgeVault | Holds every Sukuk position: locks, release, claims, credits, early exit, insider notice, the penalty pool and loss burns. |
SupplyReporter | Read-only. The supply page: minted, burned by reason, held in Sukuks, protocol-owned, locked, circulating and still to be created. |
Agencies and Syndicates
| Contract | What it does |
|---|---|
ConflictsRegistry | People, wallets, roles and interests. Read for recusal, signer rules, insider notice and the separation of roles. |
GatedSale | The only way a seat or an Agency changes hands: named buyer, public notice, eligibility checks, no sale while any tranche is impaired. |
AgencyRegistry | Agency NFTs, stakes, the fee cap, high-water marks, holdback, the liability tail and the genesis stake release. |
SyndicateRegistry | Seat NFTs and referral codes, each seat's locked SUKUK, allocations to Agencies and the raising fee. |
Capital and profit
| Contract | What it does |
|---|---|
VaultDeploymentExecutor | Tranche escrow. Deploys USDG into whitelisted duPRT vaults, redeems only to the reserve, and realises profit: write-down refills, Agency fees and holdback, then the buyback. |
BuybackExecutor | Buys SUKUK with realised profit within the buyback policy, then credits and burns it. Has no other destination. |
LossHandler | Records a tranche loss, weighs every Sukuk and Agency over the loss period, and burns their shares at backing per token. |
WallKeeper | The bid wall: a USDG-only position below the price that burns everything it buys. |
WallSweeper | The wall's keeper contract. Lifts a dust push on the price, then sweeps or re-centres the wall. |
Zap
| Contract | What it does |
|---|---|
SukukDAOZap | Turns a token delivered from any chain into a Sukuk or a SUKUK purchase for its owner, through a one-time address per order. Orders outside their limits wait; the owner can settle, loosen their own limits by signature, or reclaim at any time. |
IntentExecutor | The one-time address for a zap order. Only the zap can move what it holds. |
The routing service that sends tokens to a zap order is off chain and not built yet.
Treasury control
| Contract | What it does |
|---|---|
TreasuryGuard | The guard on the Safe: 7-day public queue, 5 signatures with 2 independents, recusal, signer-set rules and freezes. |
RoutineModule | Capped routine payments along routes the Safe has approved, signed by 3 of 5 operators including 1 independent. |
Outside dependencies
SukukDAO builds on code it does not control: the Uniswap v4 pool manager, Safe version 1.4.1 and OpenZeppelin's contract library. The duPRT vaults that tranches deploy into belong to SukukFi, a separate entity. They are outside the scope of SukukDAO's audit.
Audit status
The v2 code has been through:
- internal security reviews and a review against OpenZeppelin's standard patterns, with each fix covered by a regression test;
- three automated multi-agent audit passes of twelve agents each, with their findings fixed or recorded as open questions;
- more than 450 tests, including end-to-end runs on a real Uniswap v4 pool and two invariant campaigns. Every rule was mutation-tested: broken on purpose to confirm the tests fail.
An external audit is pending. The seat sale opens when the contracts are deployed. Known issues and accepted risks are summarised on the Risks page.