Skip to content

Assess Strata against Centrifuge, Mellow, and Lagoon on compliance, pause scope, oracle proof, and burn timing #173

Closed

Description

@pragalli

Priority

Medium — informs upcoming design decisions, not blocking

User story / Problem statement

A competitive comparison against Centrifuge, Mellow, and Lagoon surfaced four
points where Strata's design or documentation may diverge from what those
protocols do:

  1. Compliance without authority. Centrifuge, Mellow, and Lagoon give
    freeze and whitelist power to a human-held role. Strata's vault does not —
    real debt.
  2. Pause scope. Lagoon halts everything on pause; Mellow gates by queue.
    Strata's doc is reasonable, but the code pauses less than it says — align
    code to doc.
  3. Proof reference. No one verifies a proof reference on-chain. Drop it
    from the doc. Mellow and Lagoon do require a second confirmation for
    anomalous reports; that is worth more than a proof reference.
  4. Share burn timing. Centrifuge burns shares at pricing time, matching
    what Strata's doc says. Strata actually burns at claim time. All three
    also make redemption cancellation stricter than Strata does.

A first pass already surfaced that some of these are not open questions —
they are deliberate decisions already recorded elsewhere, or already tracked
by open issues. That pass is not authoritative; each point needs its own
verification before a call is made.

Expected outcome

Each of the four points above ends with an explicit, recorded classification:

  • Discard — the current behavior is intentional and the comparison does
    not change that; state why, citing the decision it rests on.
  • Correct — code or doc is factually wrong today; fix it directly.
  • Document — behavior is fine, only the doc needs to say it more
    precisely (or a stale concept needs to be dropped from it).
  • Build — a real, currently-untracked capability gap; open a follow-up
    issue with a rough effort estimate (S/M/L) instead of resolving it here.

Nothing gets silently changed or silently left alone — every point gets a
one-line rationale attached to its classification, even "discard."

Acceptance criteria

  • Each of the four points has an explicit classification (discard /
    correct / document / build) with a one-line rationale.
  • Where an existing issue already covers a point, the write-up
    cross-references it instead of duplicating it.
  • Where a point would mean reopening an already-closed design decision,
    the write-up says so explicitly — reversing one of those needs a
    deliberate call, not a quiet revert.
  • A new issue is opened for anything classified "build" that isn't
    already tracked, each with an effort estimate.
  • The reasoning for each point is written down somewhere durable (this
    issue's final comment, or a linked doc) so a future competitive sweep
    doesn't start from zero.

Source: pasted competitive note comparing Strata to Centrifuge, Mellow, and
Lagoon (2026-09-29).

Activity

  1. self-assigned this
    on Oct 1, 2026
  2. hpmaxi commented on Oct 23, 2026

    @hpmaxi
    Contributor

    Each point classified, with where it stands now.

    1. Compliance without authority: Correct (built). The compliance multisig holds the share token's compliance role, which freezes holders, and administers the identity verifier, which keeps the allowlist. Legal transfers and balance recovery need that role and governance's co-signature in one call (Move shares under a legal order only with a governance co-signature #319, in review). The vault itself holds none of these powers.
    2. Pause scope: Document (done). The narrower scope is deliberate. The guardian's pause stops deposit requests, pricing and applying upgrades, and freezes the timelock clock, but never blocks a redemption request, a payable claim or a move of cash to the custodian. The share token has its own transfer pause. The design doc's actors table and the kit spec state this. Halting everything, as Lagoon does, would reopen the decision that a pause never traps an exit.
    3. Proof reference: Build (Anchor a proof reference to every attestation #235), and keep it. It is a funded deliverable and cheap: the contract anchors the reference and does not verify it. Until Anchor a proof reference to every attestation #235 lands, the docs no longer promise it (docs: explain each contract's design choices #278). A separate second confirmation for anomalous reports: Discard. The attester is a multisig, so a second signer already confirms each report, and the per-report caps, the cooldown and the NAV pause bound what one report can do.
    4. Share burn timing: Correct (docs). Pricing records shares as owed. The token burns escrowed shares when each redemption claim runs and mints deposit shares when each deposit claim runs, which keeps each claim's cost bounded. The design doc said in places that pricing mints and burns; a33d704 on docs: explain each contract's design choices #278 fixes it. Stricter redemption cancellation: Discard. A request can be cancelled while its epoch's price cannot be read, and not after, so nobody cancels after seeing the price (Reopen cancellation while the vault is paused, and document the window #284). Making it stricter would reopen that decision.

    No point needs a new issue: #235 already tracks the only build item.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions