Contract Addresses

Address of record for every deployed BTR contract; integrations read this page. One section per chain, generated from the chain’s deploy manifest and deployment records and regenerated after every deploy: deploy metadata, core contracts, linked libraries, pools with their LP receipts and yield hooks, roles, timelock delays, mark signers and the public RPC. Live mainnets first, then testnets, then planned chains, which list no addresses. Tokens and feed IDs are in Asset Registry, pool rosters and leg parameters in Pool Composition. Verify every address before sending funds: cross-check the block explorer link on each row.

ABIs are served at GET /v1/abis/<ContractName> (API & SDK Reference §2.1), the endpoint @btr-protocol/sdk fetchAbi uses, and track current source. Do not wire integrations to the SDK’s CONTRACTS[chainId]: it holds placeholders, not deployments.

Network: Monad, chainId 143

Status: live mainnet. Native gas MON, wrapped WMON; block time 400 ms.

Explorer: https://monadvision.com

Redeployed 2026-10-01 by the mainnet deploy key through the CREATE3 factory; the earlier Monad fleet is superseded and is not an address of record. It still holds some reserved CREATE3 addresses (the old factory at 0xbbbbbbbb323d…d9b3, one retired pool, dust only). oracle, poolFactory and verifierP in the record are one address by design: PoolFactory is the fleet upgrader, the feed read surface (getFeed) and the primary-tier verifier. Assets are the real Monad tokens, not mocks. Gating of deposits and swaps: launch configuration.

Custody today

Pre-arm. The AccessControl owner is still the deployer EOA, and quorumPolicyArmed() is false. The owner Safe from the roles table below exists but holds no role yet.

transferOwnership is disabled by design. Rotation is requestOwnershipHandover() from the owner Safe, then completeOwnershipHandover(safe) from the deployer within 48 h, then armQuorumPolicy([guardianSafe]) from the Safe. Arming is irreversible and moves every later owner, treasury and factory change onto the timelocks in Admin. Until then the deployer key is the trust root for this chain, and the Safes in the roles table are the target, not the current custody.

This section changes in the same commit as the handover.

Deploy metadata

Core contracts

Linked libraries (fixed code, no upgrade path):

Pools

Every pool is an ERC-1967 proxy whose implementation slot only PoolFactory can write, so one timelocked executeReferenceUpgrade moves all of them. Other pools: officialPools(i) for i < getOfficialPoolsCount() lists BTR’s; enumerate every registered pool from PoolCreated events net of PoolDeregistered, or per token with getPoolsForToken(token), and confirm one with isPool(addr).

Core: LP receipts and yield hooks

Roles

Roles are the deploy manifest’s targets; read AccessControl for the holders in force. Guardians halt and never un-halt: Access Control §2.

Timelock delays

Schedule PROD_DELAYS, fixed at deploy (Access Control §3).

Mark signers

Wire version 8. A push needs the threshold of signers on the tier’s roster and a submitting address on its relayer list (Mark Relayer).

Coop arbitrage

Operator: 0xd1b33b54A6Fa47a58593eAe935898E429179a488.

Terms: discBps 3000 (max 3000); rebateBps 5000 (min 2000, max 9000).

RPC

Public endpoint: https://gm.monad.at.htw.tech. The failover list is served with the chain registry (GET /v1/chains).

Network: Arc Testnet, chainId 5042002

Status: live public testnet. Native gas USDC; block time 500 ms.

Explorer: https://testnet.arcscan.app

Hub token USDC.b, the mintable 18-decimal faucet twin of Circle’s USDC. Native USDC (0x3600…) is Circle’s testnet gas token: not faucet-mintable, not the base, not a listed leg. The owner is a single testnet key; the quorum policy is never armed because Arc has no Safe. Every pool asset except Circle’s EURC is a BTR mock minted through the on-app faucet under daily caps (Asset Registry).

Deployed 2026-09-27 by the mainnet deploy key through the CREATE3 factory, so every singleton and pool sits on its mainnet address and runs the source these docs describe. Stable core opened at block 64299445, crypto core at 64303621. The Forex and Equity cores are defined in the manifest but not created: the FX legs wait for signed marks on their currencies, the equity legs for their price source. Their tokens and feed lanes are registered; no pool lists them.

The earlier Arc fleet (pools 0x8e33…5BFE, 0xACe9…24F5, 0xCbB8…C232, 0xD98A…85e3) is halted and abandoned in place. It is not an address of record; do not integrate against it.

Native gas is USDC at 18 decimals while the ERC-20 view of the same balance at 0x3600000000000000000000000000000000000000 has 6, and there is no wrapped native token. A transfer of the entire balance therefore reverts TransferFromFailed, and the app reserves a gas buffer on that input.

Block production and ordering

Block production on Arc is a permissioned validator set with Circle-gated membership and a single block assembler; the intra-block ordering rule is undocumented. maxPriorityFeePerGas = 0 is the documented recommendation, so no priority-fee auction runs, and no third-party ordering privilege is sold. The only announced MEV path routes proceeds to validator and staker rewards and to burn, not to applications. This describes BTR’s rights on Arc; it does not mean Arc has no MEV: an opaque assembler still holds an unpriced ordering option and latency races persist. BTR has no ordering right to sell there. Permitted responses on Arc: lower the per-feed min_push_gap_s or the overshoot page threshold, raise the fee floor or the staleness premium, or escalate to Circle. Revisit only if Arc ships an application-addressable ordering primitive. Toxic-flow policy this responds to: Toxic Flow Mitigation §8.

Deploy metadata

Core contracts

Linked libraries (fixed code, no upgrade path):

Pools

Every pool is an ERC-1967 proxy whose implementation slot only PoolFactory can write, so one timelocked executeReferenceUpgrade moves all of them. Other pools: officialPools(i) for i < getOfficialPoolsCount() lists BTR’s; enumerate every registered pool from PoolCreated events net of PoolDeregistered, or per token with getPoolsForToken(token), and confirm one with isPool(addr).

Stable: LP receipts

Crypto: LP receipts

Roles

Roles are the deploy manifest’s targets; read AccessControl for the holders in force. Guardians halt and never un-halt: Access Control §2.

Timelock delays

Schedule TESTNET_DELAYS, fixed at deploy (Access Control §3).

Mark signers

Wire version 8. A push needs the threshold of signers on the tier’s roster and a submitting address on its relayer list (Mark Relayer).

RPC

Public endpoint: https://rpc.blockdaemon.testnet.arc.io. The failover list is served with the chain registry (GET /v1/chains).

Network: BNB Chain, chainId 56

Status: planned. Native gas BNB, wrapped WBNB; block time 450 ms.

Explorer: https://bscscan.com

Deploy metadata

No BTR contracts are deployed on BNB Chain yet, so there is nothing to integrate against: build on a live chain and switch the chainId when this section lists addresses. Planned configuration: Deployments Overview.

Reading these tables

Applies to every chain section.

• Core contracts are one deploy per chain. Admin and Flash are UUPS proxies; pools are PoolProxy contracts; everything else is fixed code, so a redeploy changes its address. Upgrade paths: Upgradeability.
• There is no oracle contract of its own. Marks live in one store inside the Pool implementation’s storage, run by the MarkStoreP8 logic; PoolFactory serves the reads (getFeed for the primary tier, feedOf(id, 2) for the reference tier). The reference tier backs the depeg band and the volatile-asset ref band, never a swap quote (Mark Relayer). Its pairs: Asset Registry.
• Every pool is an ERC-1967 PoolProxy, not an immutable clone and not a beacon proxy: each holds its implementation in its own slot, writable only by PoolFactory. A pool’s address is permanent; its code is not. One owner transaction, PoolFactory.executeReferenceUpgrade() after the GOVERNANCE tier delay (7 days in production), calls upgradeTo on every proxy the factory minted and moves every live pool on that chain to a new implementation at once. Vetoable by the owner or any guardian (cancelReferenceUpgrade); expires 7 days after maturity. See Admin.
• Testnet pool assets are BTR mocks unless the chain’s section says otherwise (Deployments §1).
• Feed identity is MITCH: feedId = bytes32(uint256(tickerId)), the packed instrument id (script/lib/MitchLib.sol; ids in deployments/<slug>.manifest.json). It is content-derived, so it carries the instrument type and is the same id on every chain.

Upgradeability

Three upgrade paths.

1. Pool fleet (largest): the PoolFactory fleet upgrade, its row above and Admin. Monitor ReferencePoolUpgradeRequested / ReferencePoolUpgraded on PoolFactory. A pool logic change ships as a new implementation address plus a fleet upgrade: an in-place upgrade of every existing pool.
2. Admin and Flash: UUPS proxies over the shared UpgradeGate base (timelocked requestUpgrade / executeUpgrade; a direct upgradeToAndCall is rejected even from the authority). Table addresses are the proxies, which is what Pool bakes in as immutables; implementations are tracked separately as adminImpl / flashImpl.
3. No upgrade path: AccessControl (Ownable, rotatable owner, fixed code), PoolFactory (holds the fleet implementation pointer, own code fixed), the LPToken implementation and the five linked libraries (PricingLib, PoolConfigLib, PoolLiquidityLib, NUQuarticLib, AdminParamsLib). The mark store has no path of its own: it lives in the Pool implementation and moves with path 1, which copies it across with migrateFrom.

Governance-critical DEX parameter changes, risk config, curves and feed additions route through Admin’s timelock rather than through a contract upgrade, so the deployed code for those paths does not change at all; see Admin.

Keeper on-chain touchpoints

Per chain, the oracle keeper is the only regular non-admin writer against the stack. It calls publishMarks() on the Pool implementation, the store: each segment carries one tier’s lanes and a k-of-n EIP-712 quorum of at least 2-of-3, and the submitting address must be on that tier’s relayer list. It pushes on a deviation-or-heartbeat trigger per lane. Trust model and signer set: Mark Relayer.

Deterministic addresses

Singletons are deployed through the BTR CREATE3 factory at 0x815d9297bB4dFf9eCaEB7C53017E0DE40300C75e. It is placed from a frozen initcode and the public salt keccak256('btr.create3.factory.v1') through the deterministic-deployment proxy 0x4e59b44847b379578588920cA78FbF26c0B4956C, so it lands at that address on any chain it is deployed to. On a new chain it is step 1 of the launch ceremony. An address out of the factory is f(factory, deployer, salt) and does not depend on bytecode, so a role keeps its address across chains and contract generations.

AccessControl, Admin and Flash (proxies), PoolFactory, Router and the pools come out of the factory; implementations, the mark-store logic and TestnetFaucet are plain CREATE deployments and follow the deployer’s nonce.

Pools go through the same factory, but PoolFactory is the sender rather than a deploy key, so a pool address is f(factory, poolFactory, salt). The base token and the token roster are mutable pool state and are not in the address: a base migration or a listing never moves a pool. PoolFactory.predictPool(salt) returns the address from the chain alone.

Two things follow for anyone integrating:

• A role’s address is a constant on a chain deployed through the factory: treat a change to one of these rows as an incident, not a migration. GET /v1/venues serves the same records as this page (API & SDK Reference §4.3).
• An address with a disclosed salt can be recomputed. effSalt = keccak256(deployer ++ salt) for a singleton, keccak256(poolFactory ++ salt) for a pool; proxy = keccak256(0xff ++ 0x815d9297bB4dFf9eCaEB7C53017E0DE40300C75e ++ effSalt ++ 0x21c35dbe1b344a2488cf3321d6ce542f8e9f305544ff09e4993a62319a497c1f)[12:]; the contract is the proxy’s nonce-1 CREATE address. Mainnet deployer: 0x0a37aEc263CbA0aaBC09Bac56A0F2074a22E69A3.

Salts of addresses not yet minted stay private until used, since a salt plus a leaked deployer key would squat the address. Treat anything that appears at one of the vanity addresses on a chain without a section here as not ours.