Changelog

September 2026 — Tranched-waterfall protocol

The largest change to the protocol since launch: loans now fund across two investor tranches and repay through a strict, ordered waterfall, replacing the fixed split_ratio / single EMI-pool model. A cluster of related safeguards shipped in the same release, since several of them touch the same storage layouts and events.

Tranches and the waterfall

• Every vault now has a senior and a junior tranche. The pool manager's collateral anchors junior; junior must be locked (lock_junior) before senior can be funded, up to a leverage ratio that caps senior as a multiple of junior.

• Repayments and default recoveries flow through a six-bucket waterfall: reserve fee → senior interest → senior principal → junior interest → junior principal → residual (borrower cash pool). Underpaid buckets carry forward as arrears, cleared before new dues.

• Junior earns a governed spread taken from senior's interest; the protocol's own cut moved from a flat post-split fee to a reserve fee on interest, senior-most in the waterfall.

• Default recovery pays out strictly senior-first across principal and interest for both tranches before any residual reaches the manager or borrower.

• A NAV write-down (get_senior_nav / get_junior_nav) gives investors an early, reversible signal of distress before a loan is formally in default.

New safeguards

• Exposure caps — protocol-wide borrower and manager concentration limits, gated by a concentration floor so early loans aren't blocked.

• Loan-level covenants — a cash-pool lock while a borrower has a missed payment, and an optional reporting-cadence covenant.

• Compliance gate — an optional, protocol-wide is_allowed(who, action) check, with a first implementation in the new Compliance Allowlist contract.

• Related-party rule — a manager can never be their own borrower; a separate disclosure flag covers deals that are related without the addresses matching.

• Collateral asset policy — a dedicated collateral-asset whitelist, and a minimum pledge-to-principal ratio for borrower collateral.

• Configurable investor cap and minimum investment — replacing a hardcoded 100-investor limit, with pull-based, paginated refunds and TTL bumps so cost never scales with investor count.

• Two-party renegotiation — approving a renegotiation now requires both the manager and the borrower to authorize it, with bounds on how far a single round can cut the current rate.

• Upgrade-authority hardening — Globals can require the Timelock as the enforced admin for contract upgrades and admin transfers, not just a role convention.

Lifecycle

• New terminal Cancelled phase for a vault that misses its funding or approval deadline, with self-service claim_refund per investor rather than a single push-refund call.

• finalize() now closes FullyRepaid, Cancelled, and Defaulted vaults alike, once each one's own wind-down condition is met.

New contracts

• CollateralEscrow — generalised to per-pledge accounting (removing an earlier one-pledge-per-token griefing vector) and made Upgradeable.

• ComplianceAllowlist — the compliance-gate's first implementation.

Documentation and tooling

• A generated, versioned event schema (("trilo", name, schema_version) topics) across every contract, checked in CI.

• A shared common-types crate removing hand-mirrored cross-contract structs, and an "upgrade-path rule" adopted after a testnet Factory was bricked by exactly that kind of drift.

• A shorter TTL window for contract-instance storage (and the shared vault Wasm code entry it drags along), after a fee-cap incident on testnet.

See Testnet Deployment for the current sandbox addresses, and Payments & the Waterfall for the full worked example.

As of September 2026.