Contract addresses

Nothing is deployed yet. Every address on this page reads TBD at deployment, and it will stay that way until the deployment transaction has run and its report has been published. Treat any address you find elsewhere claiming to be Fyber as fraudulent until it appears here.

Chain details

Notes that matter when you integrate:

• The sequencer orders transactions first-come, first-served. Whether a public mempool exists, and whether transactions can be reordered, determines if a liquidator or a CollateralSale buyer needs protection against value extraction. Verify this yourself before you assume either way.
• Time is block.timestamp everywhere in Fyber. block.number is used only for the same-block guard and the offset guard. The sequencer may shift timestamps by minutes, and every threshold in the protocol carries at least ten minutes of margin (Rule R-3.0.2).
• Gas costs change when the launch subsidy expires. Every keeper mechanism assumes marginal cost.

Core contracts

Per-branch contracts

Twenty branches are deployed at genesis. SPY and QQQ are active from day zero; the other eighteen are dormant and activate on their own criteria. The four broad-market and gold branches are listed below.

Registry slots six through ten are the zero address, permanently.

External addresses each branch depends on

Every one of these is immutable in the contract that reads it, and none of them can ever be repointed.

How to verify an address

When the addresses are published, do not take them on trust. The deployment produces a report, published in the repository, that asserts contract by contract (Rule R-16.5.1):

1. No owner(), no AccessControl role and no TimelockController anywhere in the address graph.
2. No ABI entry whose name begins with set, add, remove, update — other than updateMintFreeze — grant, revoke, upgrade, transferOwnership or pause.
3. No storage variable holding a risk constant; all of them are immutable or constant.
4. fyUSD.isMinter true for exactly the twenty branches and the PSM, and nothing else.
5. BranchRegistry.allBranches() returning five distinct addresses on five distinct tokens, with slots six to ten zero.
6. Closer.safe equal to the published Safe, and Closer.expiresAt equal to DEPLOY_TS + 365 days.
7. Each Branch.adapter.token equal to that branch's own token, and every cross-address non-zero.
8. Every constructor relation from the parameter assertions verified by reading.
9. The deployed bytecode of each module equal to the compiled bytecode of the frozen specification.
10. No source group weighs more than half the composite, for every branch, read from each OracleAdapter.

You can re-run all ten checks yourself against the deployed addresses. That is the point of publishing them.

Contract verification

Source will be verified on Blockscout for both networks at deployment, with the compiler pinned to Solidity 0.8.26 and the exact optimiser settings published alongside. If a contract at one of these addresses is not verified, do not integrate it.

Deployment shape

The whole system is deployed by one atomic script. It deploys the nineteen modules, resolves the circular address references using precomputed CREATE2 addresses, activates SPY and QQQ, seeds the Probe contracts with 1e6 wei each, and asserts the final state before finishing (Rule R-3.0.3).

The deployer address holds no residual power afterwards, and there is nothing for it to renounce, because no module ever grants it anything.

Last reviewed: 2026-09-07 · Spec v0.4