Smart contracts

InVeil is a stack of audited contracts on Arbitrum, not a backend with a database. There's no admin server holding balances, no off-chain matching engine, no "InVeil account" that exists outside the chain. Everything that matters — your USDT, your trades, your dispute history, your reputation — lives in code that anyone can read.

The suite is built to do two things:

• Keep your funds safe. Money sits in vaults that have no admin-drain function and no privileged transfer path. It can only move along the settlement rules the contract enforces.
• Give every wallet a public trading history. Every order, settlement, dispute, and ruling is an on-chain event tied to the wallet that performed it. Reputation isn't a star rating someone can fake — it's a derived view of what your address has actually done.

At a glance

The suite splits cleanly into two layers — logic contracts that hold rules and emit events, and storage contracts that hold balances and state. Logic can be upgraded without touching storage; storage survives every upgrade.

Every arrow above is gated by access control inside the storage contract — only the protocol's logic contracts can write, and only along the protocol's accounting rules. There is no admin-write function on any of them.

The vaults — where the money and state live

The vault contracts hold balances and the protocol's per-trade and per-dispute state. They are the slowest-moving, most conservative part of the system. We deploy them once and don't redeploy when application logic changes — your balance, your active trades, and your dispute history all survive every upgrade because the storage lives here, not in the logic contracts.

• TradingVault. The protocol's escrow custody contract. Holds the USDT that's actively locked into a trade — seller-posted principal, buyer security stakes, in-flight refunds. Every escrow movement (locking principal, posting a security stake, refunds, releases, commission) happens as a controlled transfer inside this vault, gated by access control so only the protocol's logic contracts can call it. Dispute filing fees live in ArbitrationFeeVault, not here. There is no admin-withdraw and no emergency-drain. The idle (unlocked) portion of your Trading balance does not live in this vault — it lives in your own smart account as aUSDT, supplied to Aave V3 directly by the account itself, and earns 100% of the Aave yield with no platform cut. See the FAQ for the full story.
• ArbitrationFeeVault. The dispute escrow. In v1 it holds the 300 USDT of filing fees pooled from both parties for an active dispute; when a case settles, the winner's 150 USDT is refunded in full and the loser's 150 USDT flows entirely to the protocol treasury. Committee members are not paid per case — service is its own reward. Funds can only move along the protocol-defined paths. (Earlier deploys called this contract JurorStakeVault and additionally tracked per-user staked balances for a multi-tier juror pool. In v1 the multi-tier pool is gone — the committee panel is drawn from the fixed CommitteeRoster, so there's nothing to stake against.)
• OrderStore. Holds the per-order state for every trade — status, principal, security stake, fee terms, settlement and cancellation timestamps, the buyer/seller addresses. Because trade state lives here rather than insideEscrowLogic, the trade engine can be upgraded without touching any in-flight order: a logic redeploy rotates the rules; your offers and active trades stay exactly where they are.
• DisputeStore. Holds the per-case state for every dispute — evidence pointers, phase transitions, panel votes. Same property asOrderStore: the arbitration engine can be upgraded without disturbing an active case. A dispute that's mid-deliberation survives anArbitrationCommitteeredeploy.

The logic contracts — the rules of the game

Logic contracts don't hold money. They sit in front of the vaults and tell them when to move funds, gated by the protocol rules. Splitting logic from storage means we can fix a bug or ship a new feature without ever touching where your balance lives.

• EscrowLogic. The trade engine. Owns the order lifecycle from creation through settlement: locking the seller's principal, holding the buyer's security stake, releasing on confirmation, refunding on cancellation or timeout. Every transition emits a public event, which is how the activity feed and your trade history get built.
• ArbitrationCommittee. The dispute resolver. In v1 it runs a single-tier flow against the fixed CommitteeRoster: 48-hour evidence period, 18-hour deliberation, tally settled by anyone calling settleCommittee. A ruling here is what tellsEscrowLogicto release the disputed funds — there's no manual override. The multi-tier L1–L3 ladder is part of the Inveil v2 scaffolding (see Arbitration) and not part of v1's reachable code path.

Reputation — the public record

ReputationRegistry. A persistent on-chain record per wallet: completed trades, dispute count and outcome, cumulative volume, first-active timestamp. It's stored separately from the trade engine so reputation history survives every logic upgrade — when we redeployEscrowLogic, your win-rate and trade history don't reset.

OnlyEscrowLogiccan write to it, and only along the protocol's accounting rules — there is no "edit reputation" function for anyone, including us. When you look at a counterparty's profile, you're reading a derived view of what their address has actually done on-chain. They can't pad it with fake reviews and we can't quietly remove a bad outcome.

Identity and encryption

EncPubkeyRegistry. A directory mapping each wallet to its encryption public key. Sensitive fields — payment instructions, dispute evidence, in-trade chat — are encrypted before they touch the chain, using keys derived from this registry so only the counterparty (and, for disputes, the assigned arbitrators) can decrypt them. "On-chain" does not mean "publicly readable" for anything that would identify you.

Verifiability

The whole point of putting this on-chain is that you don't have to trust us about any of it. The contracts are deployed on Arbitrum and verified, which means the source code on the explorer is provably the source code that's running. Every claim on this page — no admin-drain, capped commission, withdraw is always callable, reputation can only be written byEscrowLogic— is something you can check yourself in the bytecode rather than something you have to take our word for.

InVeil is live on Arbitrum One — mainnet since 1 June 2026. Every contract is deployed and verified on Arbiscan, so the source you read on the explorer is provably the source that's running. Here are the verified links for each contract above — check any claim on this page for yourself: