Source & Dependencies
Canonical repositories, tested revisions, licenses, and external trust assumptions.
Repositories
| Repository | Purpose |
|---|---|
| deepstate-protocol | Token, vault, governor, rewarder, deployment, and integration tests |
| deepstate-contracts | DeepstateV1 matching engine and hook interface |
| deepstate-webapp | Official interface, Ponder indexer, Prisma data layer, and Anvil environment |
| docs | Protocol documentation |
Tested contract source set
| Dependency | Tested revision | Use |
|---|---|---|
| deepstate-protocol | 65b5252 | Latest merged protocol master audited for this documentation pass |
| deepstate-contracts | 1bc59dc0ab6be8a53f47bb5f4b3877628e46272c | Matching engine with sold-token hooks and topOrder validation |
| OpenZeppelin Contracts | 5fd1781b1454fd1ef8e722282f86f9293cacf256 | ERC-20, ERC-4626, ERC20Votes, Governor, AccessControl, and safety utilities |
| Solady | ab96a830e705de13e0f58cfaefadab4ac8257655 | Ownership, transfers, and fixed-point math |
| Forge Standard Library | 620536fa5277db4e3fd46772d5cbc1ea0696fb43 | Tests and deployment scripting |
The latest protocol source no longer imports Euler Fee Flow or Ethereum Vault Connector. Fee conversion is implemented directly by DeepstateVault.buyFees.
These revisions identify the source set used for the latest contract audit in these docs. The production deployment manifest must record the full tagged protocol commit, compiler settings, bytecode, constructor arguments, and audit artifacts actually deployed.
Verification evidence
The latest merged protocol checkout passes 112 Forge tests across vault, rewarder, token, governor, deployment, and invariant suites. Test success is evidence for one source revision, not proof of deployed bytecode or economic safety.
External trust
Deepstate cannot control:
- Robinhood Chain sequencing, timestamp policy, finality, or outages;
- upgrades or policy changes in canonical NVDA or USDG contracts;
- NVDA corporate-action multipliers;
- user interfaces, aggregators, RPC providers, or indexers; or
- unsupported tokens placed in permissionless pools.
The official interface should maintain a conservative token list even though the matching engine allows arbitrary compatible pairs.
Licenses
Each imported repository retains its own license. The release process must satisfy all applicable dependency terms. This page is not legal advice.