CRX Contracts

What is the contract set?

A singleton core, an upgradeable NDF beacon with one clone per bilateral relationship, a cascade engine the core delegates to, plus the oracle and collateral contracts the core reads. Funds never leave the core vault.

What are the contracts?

Contract	Source	Role
CRX core	CRX.sol	singleton factory, registry, fund vault, role system, oracle registry; holds the hot paths
Cascade engine	CRXCascade.sol	the rare paths — liquidation cascade, VM cycle, force-close, governance setters, onboarding; runs in the core's storage by delegatecall
Shared storage	CRXStorage.sol	the single storage layout both CRX.sol and CRXCascade.sol inherit
NDF implementation	instruments/NDFInstrument.sol	the instrument logic the beacon points at
Master Agreement clone	beacon proxy of NDFInstrument	one per bilateral relationship; its own address and legal identity
Credit Support Annex	CreditSupportAnnex.sol	values a collateral basket — eligibility, per-token haircut, concentration limit
Guarantee fund	GuaranteeFund.sol	the backstop the default waterfall draws on last
Oracles	oracle/*.sol	per-pair FX rate and per-token collateral price feeds
Collateral tokens	mocks/*.sol (testnet)	USDC and sUSDS

How do the pieces relate?

• The core is the only place funds live. Collateral sits in the core vault keyed by relationship; the clones hold identity and position state, not money.
• Each Master Agreement is a beacon-proxy clone of NDFInstrument (~50k gas to deploy). The beacon makes every clone upgradeable at once. The payoff math runs inline in the core on the heavy paths — the core never cross-calls a clone in a loop.
• The core and the cascade engine share one storage layout. CRX.sol carries the hot paths natively; the rare paths forward to CRXCascade.sol by delegatecall, so the engine's code executes in the core's storage. The split exists to fit the 24 KB EIP-170 deploy limit, not to split responsibility.
• The CSA owns only the haircut. It reads the collateral price from the core's global oracle — one price per token, identical everywhere. The bilateral term is the haircut alone.
• No on-chain lists. The core never iterates a stored array. Callers pass position, agreement, and token sets as calldata, validated by membership and count.

For the full model, see How CRX works and the Concepts (~3 min) series.

Where do the core entry points live?

On the core contract. The per-function reference is on the next page.

Next: CRX (~4 min) — the core contract's storage and entry points, function by function.