You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Assess Strata against Centrifuge, Mellow, and Lagoon on compliance, pause scope, oracle proof, and burn timing #173
Medium — informs upcoming design decisions, not blocking
User story / Problem statement
A competitive comparison against Centrifuge, Mellow, and Lagoon surfaced four
points where Strata's design or documentation may diverge from what those
protocols do:
Compliance without authority. Centrifuge, Mellow, and Lagoon give
freeze and whitelist power to a human-held role. Strata's vault does not —
real debt.
Pause scope. Lagoon halts everything on pause; Mellow gates by queue.
Strata's doc is reasonable, but the code pauses less than it says — align
code to doc.
Proof reference. No one verifies a proof reference on-chain. Drop it
from the doc. Mellow and Lagoon do require a second confirmation for
anomalous reports; that is worth more than a proof reference.
Share burn timing. Centrifuge burns shares at pricing time, matching
what Strata's doc says. Strata actually burns at claim time. All three
also make redemption cancellation stricter than Strata does.
A first pass already surfaced that some of these are not open questions —
they are deliberate decisions already recorded elsewhere, or already tracked
by open issues. That pass is not authoritative; each point needs its own
verification before a call is made.
Expected outcome
Each of the four points above ends with an explicit, recorded classification:
Discard — the current behavior is intentional and the comparison does
not change that; state why, citing the decision it rests on.
Correct — code or doc is factually wrong today; fix it directly.
Document — behavior is fine, only the doc needs to say it more
precisely (or a stale concept needs to be dropped from it).
Build — a real, currently-untracked capability gap; open a follow-up
issue with a rough effort estimate (S/M/L) instead of resolving it here.
Nothing gets silently changed or silently left alone — every point gets a
one-line rationale attached to its classification, even "discard."
Acceptance criteria
Each of the four points has an explicit classification (discard /
correct / document / build) with a one-line rationale.
Where an existing issue already covers a point, the write-up
cross-references it instead of duplicating it.
Where a point would mean reopening an already-closed design decision,
the write-up says so explicitly — reversing one of those needs a
deliberate call, not a quiet revert.
A new issue is opened for anything classified "build" that isn't
already tracked, each with an effort estimate.
The reasoning for each point is written down somewhere durable (this
issue's final comment, or a linked doc) so a future competitive sweep
doesn't start from zero.
Source: pasted competitive note comparing Strata to Centrifuge, Mellow, and
Lagoon (2026-09-29).
Compliance without authority: Correct (built). The compliance multisig holds the share token's compliance role, which freezes holders, and administers the identity verifier, which keeps the allowlist. Legal transfers and balance recovery need that role and governance's co-signature in one call (Move shares under a legal order only with a governance co-signature #319, in review). The vault itself holds none of these powers.
Pause scope: Document (done). The narrower scope is deliberate. The guardian's pause stops deposit requests, pricing and applying upgrades, and freezes the timelock clock, but never blocks a redemption request, a payable claim or a move of cash to the custodian. The share token has its own transfer pause. The design doc's actors table and the kit spec state this. Halting everything, as Lagoon does, would reopen the decision that a pause never traps an exit.
Share burn timing: Correct (docs). Pricing records shares as owed. The token burns escrowed shares when each redemption claim runs and mints deposit shares when each deposit claim runs, which keeps each claim's cost bounded. The design doc said in places that pricing mints and burns; a33d704 on docs: explain each contract's design choices #278 fixes it. Stricter redemption cancellation: Discard. A request can be cancelled while its epoch's price cannot be read, and not after, so nobody cancels after seeing the price (Reopen cancellation while the vault is paused, and document the window #284). Making it stricter would reopen that decision.
No point needs a new issue: #235 already tracks the only build item.
Activity
hpmaxi commentedon Oct 23, 2026
Each point classified, with where it stands now.
compliancerole, which freezes holders, and administers the identity verifier, which keeps the allowlist. Legal transfers and balance recovery need that role and governance's co-signature in one call (Move shares under a legal order only with a governance co-signature #319, in review). The vault itself holds none of these powers.No point needs a new issue: #235 already tracks the only build item.