FCAP - Flare Collateralized Attestation Protocol

FCAP is a one-way cross-chain swap prototype for Flare. A taker pays native XRP or DOGE on the source chain, then a permissionless submitter provides an FDC proof on Flare. If the proof matches the swap, SwapEscrow releases the LP's Flare-side ERC-20 asset from that LP's isolated LPVault.

The design adapts Coinweb PACT concepts but deliberately removes the LP-default adjudication path: the LP delivery asset is already held in a vault and released by contract logic, so no LP delivery sentinel or penalty adjudicator is needed.

Contracts

• SwapEscrow: swap state machine, FDC proof validation, FTSO-based pricing, fee-deposit handling, completion, and expiry.
• LPVault: one LP per asset vault, isolated from other LPs. It tracks deposited, ring-fenced, and available balances.
• VaultFactory: deploys LP vaults and forwards per-chain address registration to SwapEscrow.

Mechanism

1. LP deploys a vault for a delivery ERC-20 and registers source-chain receive addresses through FDC AddressValidity proofs.
2. A swap is created with a source-chain amount in native base units: XRP drops or DOGE satoshis.
3. SwapEscrow prices the owed delivery amount with FTSO source and delivery feeds, using max source price over the local lookback buffer and source/token base-unit conversion.
4. The vault ring-fences the delivery amount plus the LP's overcollateralization buffer.
5. Anyone can submit an FDC attestation request and later complete the swap with a valid proof.

Proof submission is permissionless. Invalid proofs revert regardless of caller; a valid proof from any caller completes the swap.

PACT Mapping

• PACT Chain Transaction Sentinels are replaced by FDC XRPPayment and Payment attestations.
• PACT's LP-default penalty adjudicator is structurally eliminated because delivery is contract-enforced from the LP vault.
• PACT's shared collateral concept is replaced with per-LP, per-asset vaults.

Collateral And Pricing

Vaults default to 1.2x overcollateralization, configurable by the LP from 1.1x to 2.0x. This buffer is for market movement during the source-chain payment window and FDC attestation latency, not for LP-default punishment.

The source asset uses a max-price lookback over samples recorded on swap creation. This prevents sizing the ring fence from a temporary source-price dip. Delivery asset pricing uses current spot in this implementation.

Scope

Implemented source chains are XRP and DOGE, including testnet sourceId values testXRP and testDOGE. BTC, order books, bidirectional swaps, and confidential compute are intentionally out of scope.

If a taker pays externally but no valid proof is submitted before the swap deadline, the swap expires and the external-chain payment cannot be reversed on-chain. The mitigation is a sufficiently long window and permissionless self-service proof submission.