#Architecture Overview

The ARU protocol is three immutable contracts plus off-chain infrastructure. Everything is on Arbitrum. Everything written in Solidity 0.8.24. Everything uses OpenZeppelin primitives.

#Contracts

┌───────────────┐      mint rights      ┌──────────────────────────────┐
│     ARU       │◀─────────────────────│ ARUSubscriptionManager (v2)  │
│  (ERC-20 +    │                       │  per-request flow            │
│   Permit)     │                       │  AP-bound pricing            │
└───────────────┘                       └──────────────────────────────┘
       ▲                                              │
       │ mint rights (fallback)                       │ approveSubscription / approveRedemption
       │                                              ▼
┌──────────────────────────────┐                ┌───────────┐
│ ARUMintRedeemManager (v1)    │                │ MANAGER_  │
│  epoch-batched (fallback)    │                │ ADMIN     │
└──────────────────────────────┘                │ multisig  │
                                                 │ (3-of-5   │
                                                 │  + Auto-  │
                                                 │  Signer)  │
                                                 └───────────┘

┌───────────────────────┐
│    ARUPriceOracle     │  AggregatorV3-compatible NAV feed; consumers only
│    (read-only)        │  (not gating primary market)
└───────────────────────┘

#Contracts in detail

#ARU

• ERC-20 + ERC-20Burnable + ERC-20Permit (EIP-2612)
• Immutable, no proxy, no upgrade mechanism
• Multi-minter model: isMinter[address] mapping, not a single slot
• Timelocked minter add/remove (48h) from owner role
• Two-step ownership transfer with 48h timelock
• No transfer hooks, no rebasing, no blocklist, no fee-on-transfer

#ARUSubscriptionManager (v2, primary)

Per-request subscription/redemption manager.

AP-side:

• requestSubscription(usdcAmount, maxPricePerARU) → bytes32 id
• requestRedemption(aruAmount, minPricePerARU) → bytes32 id
• cancelSubscription(id) / cancelRedemption(id) — any time before fulfillment

Admin-side:

• approveSubscription(id, pricePerARU) — must respect AP's max bound
• approveRedemption(id, pricePerARU) — must respect AP's min bound
• addAP / removeAP — AP registry
• pauseSubscriptions / pauseRedemptions / freeze
• setTreasuryAddress / setMinimumMintAmount / setMinimumRedeemAmount / setRequestTTL

Permissionless keeper-side:

• cancelExpiredSubscription(id) / cancelExpiredRedemption(id) — after 48h TTL

Custody properties:

• Pending subscription USDC held in the contract (not treasury) until approval
• Pending redemption ARU held in the contract (escrowed, not burned) until approval
• Treasury only sees USDC corresponding to already-issued ARU
• Cancellation and expiry refunds come from contract-held assets; don't depend on treasury state

#ARUMintRedeemManager (v1, retired)

The original epoch-batched design. It has been removed from the codebase (commit 1153227) and is not part of the audited production system — the Nethermind NM-0902 audit covered the per-request contracts only. Its review history is retained in Audit History for the audit trail.

#ARUPriceOracle

Chainlink-compatible NAV feed. Fed by Redstone relayer. Two read functions:

• latestRoundData() — drop-in Chainlink compat, returns stale data silently
• latestRoundDataStrict() — reverts PriceStale when older than stalenessThreshold

Not used for gating primary market mint/redeem (that would be an availability single point of failure). Used only by downstream DeFi integrators consuming ARU as a price reference.

#Roles

Role	Contract	Holder	Purpose
owner	ARU	Cold multisig (2-of-3)	Add/remove minters, transfer ownership (all 48h timelocked)
isMinter	ARU	v1 Manager + v2 Manager	Ability to call aru.mint and aru.burn
MANAGER_ADMIN	v1 + v2 managers	Operational multisig (3-of-5 w/ AutoSigner)	Approvals, AP registry, pause/freeze, config
DEFAULT_ADMIN_ROLE	v1 + v2 managers	Same as MANAGER_ADMIN	OZ AccessControl default (role management)
ADMIN_ROLE	Oracle	Oracle admin multisig	Safety parameter tuning
PRICE_UPDATER	Oracle	Redstone relayer hot key	setPrice calls subject to rate-of-change + interval guards

#Data flows

#Subscription

AP → requestSubscription(amount, maxPrice)
  ↓ USDC: AP → ARUSubscriptionManager (escrow)
  ↓ Request struct stored, SubscriptionRequested event

Multisig (later, within 48h SLA) → approveSubscription(id, price ≤ maxPrice)
  ↓ ARU: minted to AP via aru.mint(...)
  ↓ USDC: ARUSubscriptionManager → treasury
  ↓ SubscriptionApproved event

Or: AP → cancelSubscription(id) [anytime before approval]
  ↓ USDC: ARUSubscriptionManager → AP
  ↓ SubscriptionCancelled event (byExpiry=false)

Or: anyone → cancelExpiredSubscription(id) [after TTL]
  ↓ USDC: ARUSubscriptionManager → AP
  ↓ SubscriptionCancelled event (byExpiry=true)

#Redemption

AP → requestRedemption(aruAmount, minPrice)
  ↓ ARU: AP → ARUSubscriptionManager (escrow, not burned)
  ↓ Request struct stored, RedemptionRequested event

Multisig (later, within 48h SLA) → approveRedemption(id, price ≥ minPrice)
  ↓ USDC: treasury → AP via safeTransferFrom
  ↓ ARU: burned by contract (aru.burn)
  ↓ RedemptionApproved event

Or: AP → cancelRedemption(id) [anytime before approval]
  ↓ ARU: ARUSubscriptionManager → AP (intact, not burned)
  ↓ RedemptionCancelled event

Or: anyone → cancelExpiredRedemption(id) [after TTL]
  ↓ ARU: ARUSubscriptionManager → AP
  ↓ RedemptionCancelled event (byExpiry=true)

#Off-chain infrastructure

Three off-chain components support the on-chain contracts:

#AutoSigner

One of the five MANAGER_ADMIN signers. Evaluates proposed approval transactions against NAV tolerance and refuses signatures outside policy. See Auto-Signer.

#Redstone relayer

Pushes NAV updates to ARUPriceOracle.setPrice. Subject to:

• maxPriceChangeBps (default 300 bps) — rate-of-change guard
• minUpdateInterval (default 1h) — frequency floor
• Heartbeat requirement: must update at least every stalenessThreshold / 2

#Subgraph + monitoring

Indexes all contract events for the frontend dashboard and oncall alerts. Computes:

• Pending request counts and totals per AP
• Treasury coverage ratio
• Inter-source NAV divergence
• Admin operation history

No subgraph contract dependency — all state is derivable from events + standard ERC-20 views.

#Invariants

The protocol maintains these invariants at all times:

1. aru.totalSupply() × NAV == treasury_value + escrowed_ARU × NAV (100% backing)
2. usdc.balanceOf(subscription_manager) == sum(unfulfilled_subscriptions[*].amount)
3. IERC20(aru).balanceOf(subscription_manager) == sum(unfulfilled_redemptions[*].amount)
4. A fulfilled request never reverts to unfulfilled
5. Per-AP open requests never exceed MAX_OPEN_REQUESTS_PER_AP (50)

Observable on-chain; covered by Foundry invariant tests. See Invariant Tests.

#Security base

All contracts inherit from well-audited OpenZeppelin primitives:

• AccessControlEnumerable — role management with enumeration
• ReentrancyGuard — on all state-mutating externals
• SafeERC20 — defensive ERC-20 transfers
• ERC20 + ERC20Burnable + ERC20Permit — token base

No custom base libraries. No proxy patterns. No delegatecall. Minimal external dependency surface.

#What to read next

• Per-Request Flows — v2 contract design in detail
• Auto-Signer — off-chain signer pattern
• Threat Model — explicit threat analysis
• Deployment Ceremony — production deployment runbook
• Invariant Tests — Foundry fuzz harness design
• CI Hardening — pipeline + release gates
• Oracle — price feed design and strict-variant rationale
• Audit History — v1 findings and resolutions