Ordinary capacity
Withdrawals consume the oldest unexpired deposit credit first, then a capped allowance that accrues per second. Credit expires after 24 hours and is consumed once. Deposits do not refill the allowance; trades, fees, internal transfers, and unsolicited token transfers create no credit.capacityUsd18 and ratePerSecondUsd18 are configuration units. Flow valuation and the available bucket use USD36. Convert configuration to USD36 by multiplying by 1e18. A configuration update first accrues under the old settings, then clamps to the new capacity; raising capacity grants no new credit.
Prices and custody
Each supported token has a configured price source. Deposits and ordinary or approved withdrawals require a positive, fresh, nonfuture price. Mainnet uses the mainnet price-source bindings, including Chainlink feeds for MON, USDC, WETH, and cbBTC and Kuru-published references for the other assets. Testnet uses Kraken-backed ManualPriceSource contracts with a 300-second maximum age. A source’s existence does not prove its latest quote is currently usable. Standard nonrebasing assets with exact custody receipts and debits are supported. Pricing and token amount precision are distinct; deposits round down and withdrawals round up when valuation must discard precision. Native MON uses the zero-address sentinel. Global or token withdrawal freezes block ordinary and approved payouts. Protocol pause also blocks deposits. Time continues passing during a freeze or pause; resuming grants no additional credit.Previews
previewWithdrawal reports valuation and capacity at the read state. It does not check every caller permission, reserve funds, reserve capacity, guarantee the recipient transfer, or guarantee the eventual transaction will succeed. Query free balance and permissions separately and simulate the exact payout.
Authority-approved payout
The root owner signsApprovedWithdrawal(address account,address token,address recipient,uint256 amount,uint256 nonce,uint256 deadline,uint64 authorityEpoch) using AccountCore’s version-1 domain. Here account is the root owner address. A delegate cannot substitute its signature for the owner’s signature.
The dedicated authority submits fulfillApprovedWithdrawal. The payout bypasses deposit credit and drip consumption, but preserves pricing, free-balance, freeze, pause, nonce, deadline, and transfer checks. Children must transfer funds to the root first. The approved-withdrawal nonce and authority epoch are separate from trading authorization epochs.
See the source specification for exact arithmetic and source validation. The mainnet and testnet deployment pages identify their respective limiters; do not assume a documented configuration value is live capacity.