Core Concepts

Foundational models and mechanisms that define how Aset works. Items with 🟡 BD or 🟠 PD badges have open decisions — see Decisions.

🏊 Pool Type (AS_POOL vs FUND_POOL)

Two pool architectures. AS_POOL — Aset manages deposits via Pool Smart Contract, auto-mints LP (PLATFORM_ISSUED), no receipt token. FUND_POOL — Investor deposits into Pool Contract, receives receipt token; FM reviews and calls mintLP() (FUND_ISSUED), receipt burned.

How it works

AS_POOL: USDC → Pool Smart Contract → auto LP mint (PLATFORM_ISSUED, no receipt) → deposit split: (amount × (1 - reserve_%)) → Pool Wallet, remainder stays in contract as reserve. FUND_POOL: USDC → Pool Smart Contract → receipt token minted → FM notified → FM calls mintLP() → receipt burned → deposit split to Fund Wallet + reserve. D+7 safety: if LP not minted within 7 days, auto-refund triggers.

🔀 LP Issuance Model

Two modes: FUND_ISSUED — the fund mints its own LP token; Platform verifies receipt via RPC. PLATFORM_ISSUED — Platform deploys and mints the LP token on the fund's behalf. AS Pools default to PLATFORM_ISSUED; Fund Pools default to FUND_ISSUED.

How it works

FUND_ISSUED: deposit received → FM notified (fm_notified_at) → FM mints LP → Aset verifies → lp_minted_at → receipt burned. PLATFORM_ISSUED: deposit received → platform auto-mints LP (lp_minted_at) → receipt burned → COMPLETED. No FM action needed.

💰 NAV Token Pricing · 🟡 BD3

LP token price floats between $0.00–$1.00 (no floor). Token price IS the loss indicator — no separate PF multiplier. New investors pay the current NAV (fair entry). Investment always stays open — never auto-blocked. tokens_minted = deposit / nav_per_token.

How it works

Deposit $10,000 when NAV = $0.92 → you receive 10,000 / 0.92 = 10,869 tokens. At writedown to $0.92 your tokens are worth $10,000 but you get more tokens than original investors. On recovery to $1.00 your tokens are worth $10,869.

🔮 Oracle-Driven NAV Updates · 🟠 Oracle Contract

Fund operator calculates NAV off-chain → reports to oracle endpoint → oracle validates and posts updateNAV() on PlatformPool → NAV decreases enter 24h timelock, increases apply immediately. No safety bounds (PD6 removed).

How it works

Operator submits NAV off-chain → oracle validates and calls updateNAV() on PlatformPool → if decrease: enters 24h pending queue → after timelock: nav_per_token updated on-chain. NAV increases skip the queue and apply immediately.

🛡️ Reserve Fund · 🟡 BD4

Proposed: 10% of pool deposits allocated as first-loss reserve. Covers losses before NAV drops below $1.00. Open questions: per-pool vs platform-wide %, how reserve is funded (upfront vs accrued), what triggers payout vs writedown.

How it works

Fund operator sets a reserve % at pool creation → reserve absorbs loss first → NAV only drops once reserve is exhausted. Proposed: 10% of pool deposits allocated to reserve at creation time (not accrued over time). Reserve payout vs writedown trigger is an open question (BD4).

📈 Yield Model · ✅ Decided

Claim-based only (MANUAL_CLAIM). DISTRIBUTING deprecated — not DeFi standard, high gas cost. Fund/FM deposits yield USDC into Pool Smart Contract. Yield tagged per investor (pro-rata by LP holdings). Investor calls claimYield() → USDC to wallet, or reinvest(fullYield) → new LP minted (lockup exempt).

Settings: yield_frequency (MONTHLY/QUARTERLY/CUSTOM), yield_trigger (AUTO/MANUAL), allow_rollover, min_reinvest_amount (pool config, default $50 or min_investment×50% whichever lower). V1: full reinvest only (no partial). Same-pool only. Cross-pool reinvest is V2.

→ Full Reinvest V1 policy in Investment Lifecycle

How it works

Fund deposits yield USDC → Pool Smart Contract → tagged per investor (pro-rata by LP) → investor calls claimYield() → USDC to wallet. Or reinvest(fullYield) → yield re-deposited into same pool → new LP minted. V1: full amount only (no partial). Reinvest requires yield ≥ min_reinvest_amount. Overdue tracking: if now > next_yield_due → yield_overdue = true → alert admin + investors. Aset never touches yield — contract is custodian.

🔐 Escrow Model · Deprecated

Always SMART_CONTRACT. MULTI_SIG and NO_ESCROW no longer apply under the non-custodial architecture — all funds flow through Pool Smart Contract. Multi-sig is still relevant for contract governance (e.g., who can call pausePool()) but that's a separate concern deferred to Security Architecture doc.

💸 Yield Distribution Model · Deprecated

Always MANUAL_CLAIM. DISTRIBUTING dropped — not industry standard, high gas cost (N transactions per distribution), fails on rejecting wallets. All major RWA platforms (Ondo, Centrifuge, Maple) use claim-based yield. Claim-based enables one-click reinvest() natively.

🎫 Receipt Token (ERC-721)

Proof-of-deposit NFT minted when investor deposits to escrow. Tracks status: MINTED → LP_PENDING → LP_VERIFIED or → REFUNDED. Not the LP token — just a receipt. Burned when investment fully settles.

🪪 KYC / Soulbound Token

SumSub integration for KYC/KYB. On approval, a non-transferable ERC-721 (Soulbound Token) is minted on-chain. kyc_status = APPROVED required before any investment. ❓ Open: what happens if KYC is revoked — can investor still redeem?

📊 Risk Transparency

No numeric risk rating (1–5) — false precision + legal liability. Instead: transparent data points. Risk signals: collateral_type (FULLY / PARTIALLY / UNSECURED), collateral_ratio, category, reserve_percentage, nav_per_token, apy_rate, lockup_days, penalty_type, pool_type, lp_issuance_model, pool age. Investors assess risk themselves.

How it works

Risk data points: collateral_type (FULLY_COLLATERALIZED / PARTIALLY_COLLATERALIZED / UNSECURED), collateral_ratio, category, reserve_percentage, nav_per_token, apy_rate, lockup_days, penalty_type, pool_type, lp_issuance_model, pool age. Why: numeric ratings = false precision + legal liability. risk_tier enum deprecated. Investor-facing "Risk Profile" card shows all data points on Pool Detail page. No aggregated score.

🏦 Non-Custodial Architecture

All investor funds flow through Pool Smart Contracts. Aset has an operator role (can call functions like pausePool()) but never holds investor funds. No VASP license required (€150K MiCA capital threshold avoided). Where funds live: Deposit → Pool Contract, Reserve → Pool Contract, Fund capital → Pool/Fund Wallet, Yield (pre-claim) → Pool Contract, Yield (post-claim) → Investor wallet, Redemption → Pool Contract → Investor.

How it works

Aset is a facilitator, never a custodian. Industry standard for RWA platforms (Ondo, Centrifuge, Maple). Smart contract governance (multi-sig for privileged functions) is a separate concern deferred to Security Architecture doc.

🚫 KYC Rejection Criteria

Sumsub auto-decides based on rejection reason code → mapped to RETRY or FINAL. RETRY: blurry photo, glare, cropped ID, expired doc, name mismatch, wrong doc type — no limit on retries. FINAL: sanctioned country (OFAC/EU), fraud detected, underage, duplicate applicant — admin cannot override.

How it works

Sumsub webhook fires with rejection reason → system maps reason code to reject_type (RETRY or FINAL) → RETRY: investor prompted to re-upload, unlimited attempts. FINAL: account permanently blocked from investing, admin can view but not override (compliance requirement).