credit

without

permission

a k-of-n threshold credit oracle on stellar soroban. your borrowing reputation lives on-chain, signed by an independent quorum, with zero fintech in the trust path.

3 of 5

ed25519 threshold sigs

104

tests green across the matrix

92 b

canonical mint message

evaluate any stellar address

real horizon read, 180-day window, p2p churn discounted 70%. no signup, no fintech credentials. paste any G-address or connect a wallet up top to auto-fill.

run an evaluation to see live features

watch the threshold sign

every mint requires k of n independent oracle signatures over the canonical 92-byte message. no single party can authorise alone.

oracle 0

oracle 1

oracle 2

idle

oracle 3

idle

oracle 4

canonical signed message — 92 bytes

borrower xdr (44)score u32 (4)expiration u64 (8)age_days u32 (4)nonce (32)

each oracle signs the same byte sequence with ed25519. the contract calls env.crypto().ed25519_verify k times. fewer than k valid signatures, a duplicated oracle index, or any single tampered byte rejects the mint at simulation — no ledger pollution, no gas spent.

architecture

three components, each independently verifiable. nothing in the trust path is owned by a single party.

1off-chain

synthetic scoring engine

off-chain reader of stellar horizon. 180-day window, 200-op cap. p2p churn discounted 70% against an ecosystem whitelist. zero fintech dependency.

2off-chain

threshold oracle quorum

five independent ed25519 keypairs. three signatures required. each signs the canonical 92-byte mint message. tampering one byte breaks all signatures.

3on-chain

soroban contracts

vigente-badge (soulbound credit token, threshold-verified mint, immutable slash) + reference-vault (credit-gated lending with TVL cap, util limit, withdrawal timelock).

data flow

① user (or wallet) sends G-address → scoring engine reads horizon

② engine returns features + tier → threshold oracle signs message

③ relayer assembles soroban call → badge contract verifies k-of-n

④ badge minted, nonce consumed, event emitted → readable by any vault for credit-gated lending

threat model

six adversarial scenarios. each one has a code-level mitigation that ships in the current testnet contracts.

vector

mitigation

status

carousel / wash trading

ecosystem whitelist + 70% penalty on p2p volume, monthly bins and effective tx count

shipped

sybil bot farms

30-day wallet age floor folded into the signed mint message; tampered age breaks all sigs

shipped

long-con default

credit ladder: first loan = 10% of tier ceiling; full cap unlocked only after first successful repay

shipped

vault drainage / unbounded exposure

admin circuit breaker + TVL cap + 85% utilization rail (15% always liquid for LPs)

shipped

centralized oracle compromise

k-of-n ed25519 verification on-chain; anti-replay nonce stored per-mint

shipped

LP bank run

14-day withdrawal timelock + utilization floor — no single LP can drain on rumor alone

shipped

out-of-scope items (validator collapse, compromised user wallet, sdk bugs) are deliberately listed as such so the boundary of the protocol's responsibility is explicit.

partners we're building with

vigente is the credit primitive — the yield + lending stack lives on top. we're actively forming partnerships in two directions.

apr partners (yield for LPs)

anchors, money-market protocols, stablecoin issuers

vigente badges unlock undercollateralised credit — LPs want stable USDC yield while their capital is at work. partners that already serve LATAM stablecoin holders are first in line.

apply as yield partner

decentralised lending pools

blend, soroswap-lend, fixed-rate protocols on soroban

reference-vault is a working example, not the production lending market. mature soroban lending protocols can read get_score / is_defaulted from vigente-badge to gate their own pools, instantly underwriting micro-commerce credit risk.

integrate vigente as oracle

for protocol founders

if you run a soroban lending market and want to plug vigente's credit primitive in front of your pool — same week integration, zero token swap.

zzzbedream@gmail.com

see it live on testnet

two real soroban calls against CDLLO7QE…. the negative one shows the age floor enforcing on-chain through the signed account_age bytes.

positive mint

tx on ledger

score880

age days90

statusSUCCESS

sigs3 of 5

get_score returned880

8b9fccfc9daaf594e457e19808ef9c0746e8e45f37aab8417b5fe8d59641bc85

age-floor trap

rejected

score700

age days10 (below 30 floor)

statusError(WasmVm, InvalidAction)

ledger affectedno — rejected at simulation

gas spent0

try a mint yourself

roadmap

built in the open, funded in tranches. everything marked shipped is verifiable on-chain today — the rest is scoped, costed, and labeled by the tranche that pays for it.

shipped · live now

credit primitive

·3-of-5 threshold oracle verified on-chain
·soulbound credit badge + immutable defaults
·credit-gated reference vault (TVL cap, timelock)
·credit oracle interface v1 + ABI for integrators
·180-day on-chain credit heat map

tranche 1 · hardening

production posture

·oracle ops + key rotation runbook
·score cache to persistent storage
·vigente.app domain + admin dashboard
·SEP draft: credit attestation standard

tranche 2 · yield layer

capital efficiency

·LP yield accounting (claim without exit)
·SEP-0056 tokenized vault + DeFindex listing
·idle reserve earning in Blend pools
·/earn — one-click USDC deposits for LPs

tranche 3 · mainnet

open infrastructure

·mainnet deploy behind multi-sig
·typescript SDK on npm
·tier-segmented pools + staking
·micro-commerce pilot with fintech partners

deliberately out of scope until mainnet: own token, multi-chain, retail KYC, competing with existing lending markets. vigente is the credit layer other protocols read — not another lending app.