The contracts

Four contracts do the work. None of them holds a private list or a secret number: everything below can be read from Ethereum by anyone. This page explains what each one holds, who can call what, and the events worth watching.

How they fit together#

1. Subscription holds your account. It takes your USDC deposits, keeps your balance, issues shares when you buy a machine or the pool, pays withdrawals and queues redemptions.
2. Registry says what exists. Every machine, its site, its status, and the key allowed to sign for each site.
3. Ledger records what happened. One Merkle root per site and hour, posted by that site's key.
4. Distributor pays it out. It receives each day's net rent in USDC and credits every shareholder's balance, pro rata.

Subscription#

Your account. A deposit moves USDC from your wallet into your balance here. A purchase names a machine, or the pool with machineId 0, takes USDC from your balance and issues shares in the same transaction at the current NAV per share. Each machine has a fixed number of shares, and purchases stop when they are all owned. Withdrawals pay any part of your available balance back to your wallet at any time. Redemption requests are queued here and paid into your balance in the monthly window at NAV, with the 0.5% fee left in the pool.

Shares are internal records in this contract, keyed by your wallet address. The contract has no function that moves shares from one wallet to another, so they cannot be passed on, listed or traded. They leave your record only when they are redeemed.

uint256 constant POOL = 0;  // pass as machineId to buy into or redeem from the pool

// your USDC balance and your shares are internal records, keyed by wallet.
// There is no function that moves shares between wallets: they are non-transferable.
mapping(address => uint256) public balanceOf;                       // USDC, 6 decimals
mapping(uint256 => mapping(address => uint256)) public sharesOf;    // machineId => holder => shares

function deposit(uint256 usdc) external;                            // USDC from your wallet to your balance
function buy(uint256 machineId, uint256 usdc) external;             // shares at the current NAV, paid from your balance
function withdraw(uint256 usdc) external;                           // USDC from your balance to your wallet, any time
function requestRedemption(uint256 machineId, uint256 shares) external;  // locks shares until the next window 30+ days away
function processWindow() external;                                  // anyone may call once the window opens

event Deposited(address indexed holder, uint256 usdc);
event SharesBought(uint256 indexed machineId, address indexed holder, uint256 shares, uint256 navPerShare);
event Withdrawn(address indexed holder, uint256 usdc);
event RedemptionRequested(uint256 indexed machineId, address indexed holder, uint256 shares, uint64 window);
event RedemptionPaid(uint256 indexed machineId, address indexed holder, uint256 shares, uint256 usdcCredited, uint256 feeToPool);

Distributor#

Once a day the SPV pays net rent in USDC into the Distributor and states the day's lines. The contract checks that the lines add up to gross and that the fee is exactly 8% of gross, then raises a per-share accumulator for each machine and the pool by net ÷ shares. The rent credited to your balance is your shares times the rise in that accumulator. There is nothing to claim: it is part of your available balance on the Subscription contract as soon as the day settles.

function settle(uint64 day, Lines calldata lines) external;              // SPV only, once a day
function rentCredited(address holder) external view returns (uint256 usdc);  // all rent credited to your balance so far

event Settled(
  uint64 indexed day, uint256 gross, uint256 power, uint256 space, uint256 reserve,
  uint256 insurance, uint256 fee, uint256 net, uint256 received, uint256 navPerShare, uint256 rentPerShare
);
event RentCredited(uint64 indexed day, uint256 indexed machineId, uint256 net, uint256 rentPerShare);

received is the USDC tenants actually paid for that day. If it is lower than gross, the difference is unpaid rent, and it is shown when it arrives. See Verifying a record for how to check a settlement against the records.

Ledger#

One root per site and hour. Only the key listed in the Registry for that site can post, a root can never be replaced, and postedAt shows whether it arrived within the 10 minutes. The full interface is on The record format.

Registry#

The list of machines and sites. Each machine has its site, rack, slot, a hash of its serial numbers, and a status: pending, burn-in, active, repair, retired. Each site has a history of signing keys, so old records can always be checked against the key that was valid at the time.

function machine(bytes32 machineId) external view
  returns (bytes32 site, uint16 rack, uint16 slot, bytes32 serialsHash, uint8 status);
function custodianKeyAt(bytes32 site, uint64 at) external view returns (address);

event MachineAdded(bytes32 indexed machineId, bytes32 indexed site, bytes32 serialsHash);
event StatusChanged(bytes32 indexed machineId, uint8 status, string reason);
event KeyRotated(bytes32 indexed site, address oldKey, address newKey, uint64 validFrom);

Admin and upgrades#

Some actions need an administrator: adding machines, changing their status, rotating a custodian key, opening a new machine for purchase. What the admin cannot do matters more:

• It cannot move or withdraw any holder's balance, including rent already credited.
• It cannot issue shares outside a purchase, cancel shares outside a redemption their holder asked for, or move shares between wallets.
• It cannot stop you withdrawing your available balance.
• It cannot edit or delete a posted root or a signed record.
• It cannot change the 8% fee or the 0.5% redemption fee.