Venue Permissioning Gate

The venue permissioning gate controls which venues, markets, and counterparties an account can interact with. It is a Soroban smart contract stack that enforces restricted-asset access at the venue boundary.

Architecture

Three packages form the gate:

Account
   │
   ▼
┌─────────────────────┐      ┌──────────────────────┐
│   venue-market      │      │   Blend v2 pool      │
│   (facade)          │─────▶│  (unmodified)        │
└─────────┬───────────┘      └──────────────────────┘
          │ wraps
          ▼
┌─────────────────────┐
│   venue-wrapper     │◀─── Restricted classic asset
│   (transfer gate)   │      (AUTH_REQUIRED +
└─────────────────────┘       AUTH_REVOCABLE +
                              AUTH_CLAWBACK_ENABLED)

venue-wrapper

Holds a restricted Stellar classic asset (with AUTH_REQUIRED, AUTH_REVOCABLE, and AUTH_CLAWBACK_ENABLED flags set) and issues a wrapped token 1:1. The wrapped token is eligible to be listed as a reserve in an unmodified Blend v2 pool.

The permissioning lives in the wrapper's transfer gate — only accounts with appropriate privileges can initiate a wrap, transfer, or unwrap.

venue-market

A facade between the venue-wrapper and a Blend v2 pool. A single Soroban InvokeHostFunction cannot atomically wrap an asset and then supply it to a Blend pool in one transaction — the two steps require distinct contract calls. The venue-market coordinates the two-step flow.

The facade itself enforces nothing durable. All durable permissioning is in the venue-wrapper transfer gate.

Why a restricted asset wrapper?

Stellar classic assets with AUTH_REQUIRED set issue authorization flags per account. The venue-wrapper leverages this to create a permissioned token: only the wrapper itself can authorize new holders, and it does so only when the transfer gate conditions are satisfied.

Live demo

A browser demo running on Stellar testnet is available in apps/venue-demo-web. It drives the full venue gate flow (wrap → supply → redeem → unwrap) against a Blend v2 pool, with Freighter as the wallet.

Packages

Package	Description
packages/venue-wrapper	Boundary wrapper + transfer gate
packages/venue-market	Venue-market facade + Blend v2 integration
apps/venue-demo-web	Browser UI (testnet, Freighter)
packages/test-blend-pool	Test stub for Blend-shaped submit (testnet-only, not deployed to mainnet)

Relationship to account permissioning

The venue permissioning gate and the OZ account permissioning layer are independent controls:

• The OZ Policy Builder governs what operations a smart account is authorized to perform (which contracts it can call, spending limits, thresholds).
• The venue gate governs which venue contracts an account's wrapped tokens can reach.

An account must satisfy both: a valid OZ policy AND the venue wrapper's transfer gate conditions.

Current state

The venue permissioning stack is implemented and demonstrated on Stellar testnet. It is not yet deployed to mainnet.