RFQ settlement
A secondary sale uses the Ethereum Vault Connector (EVC) to combine payment, debt repayment and collateral delivery. It does not create an issuer-redemption escrow or mint a Receipt NFT.
Two parties, one settlement transaction
The seller signs an EVC permit off-chain. It binds the seller’s inner batch, the permitted buyer, a nonce namespace and a deadline. The inner batch fixes the accounts, share amount, repayment mode, proceeds and any fee.
The buyer submits an outer EVC batch containing its funding deposit, the seller’s permit and, normally, redemption of the purchased vault shares. Redemption sits outside the seller’s signed instructions. Omitting it lets an explicitly consenting buyer retain the shares without changing the permit.
Before settlement, the seller approves the debt vault to pull repayment from the seller’s wallet. The buyer approves it to pull the purchase funding. These approvals are separate on-chain transactions when needed; signing the permit itself costs no gas. A dirty settlement account may also need a separate seller cleanup transaction.
The funding deposit’s debt-vault hook checks the buyer as caller and the
seller as owner of the receiving settlement sub-account. It resolves each
account through EVC getAccountOwner, using the account address itself when
no owner is registered. Both owning wallets need a valid credential under
the hook’s policy, or one of the hook’s privileged roles; the sub-accounts do
not need separate credentials.
Who pays and who receives
The buyer’s payment has three destinations: repayment of the seller’s debt, the seller’s proceeds and any [un]wind fee. Collateral moves in the opposite direction. The buyer’s discount is the difference between the collateral’s reference value and the agreed price, not another payment taken from the batch.
The settlement account temporarily holds the payment as debt-vault shares. It belongs to the seller and is separate from the position being sold. Any remaining rounding funds are swept back to the seller; gas is paid separately by the buyer.
State changes, in execution order
| Step | Authority | Call and state change |
|---|---|---|
| Fund the sale | Buyer | Debt-vault deposit pulls the agreed total plus rounding allowance from the buyer. It mints debt-vault shares to the seller’s settlement account. |
| Release repayment funding | Seller permit | Debt-vault withdraw burns settlement shares and sends the fixed repayment funding to the seller’s wallet. |
| Repay the position | Seller permit | repay pulls base assets from that wallet and reduces the position’s debt. A partial sale uses a fixed amount; a full close uses the maximum-value sentinel to repay all debt. |
| Pay the seller | Seller permit | A second withdraw sends the agreed proceeds, after the [un]wind fee, to the seller. |
| Pay the fee, if nonzero | Seller permit | A separate withdraw sends base assets to the fee recipient. This call is absent at a zero fee. |
| Deliver collateral shares | Seller permit | Collateral-vault transfer moves the agreed shares from the position to the buyer. |
| Close the debt relationship, if full close | Seller permit | disableController removes the debt vault as the position’s controller after repayment. |
| Empty the settlement account | Seller permit | redeem converts its remaining debt-vault shares to base assets and sends them to the seller. |
| Deliver the underlying asset | Buyer | Collateral-vault redeem burns the purchased shares and sends the underlying tokenised asset to the buyer. Omitted for an accepted shares-only settlement. |
Balance reads bracket the batch for simulation and balance-delta checks. The EVC also runs the required account and vault checks. Any failed call or final health check reverts all state changes, including use of the permit nonce; transaction fees still apply.
Amounts and protection boundaries
The buyer’s total is repayment funding plus the bid’s pre-fee seller amount. The [un]wind fee is calculated on that total, rounded down, and deducted from the seller amount. The buyer adds rounding funding separately. The final sweep may increase the seller’s receipt above the quoted proceeds.
Repayment happens before proceeds are withdrawn, so it cannot consume that later proceeds leg. A full close can still use the seller’s existing wallet balance if actual debt exceeds the funded amount. Unused repayment funding stays with the seller.
Payment protection depends on the settlement account starting empty apart from permitted dust. The service checks it before acceptance and package release; the seller’s client checks it before signing. Unexpected deposits can still arrive afterwards and substitute for buyer funding. The signature fixes the withdrawals, not who supplied every unit in that account.
Requests, matching and quote reservations remain off-chain. Client validation checks the proposed calls independently before signing or sending; simulation checks execution against a snapshot. Neither guarantees future execution or that the service showed every available quote. On-chain nonce invalidation revokes an issued permit; service-side cancellation does not.
After execution, the service matches the permit’s nonce event, funding, repayment and collateral transfer to the receipt. It records whether the buyer received the underlying asset or retained vault shares. A reconciliation mismatch needs investigation; it cannot reverse a confirmed transaction.