Topology & money map

Who touches what, where funds actually sit, and the invariant that keeps the fee account away from escrow.

Actors

Maker

Holds MAKER_ROLE. Escrows at creation, is paid directly on every fill, may cancel any time.

Taker

Names the output they want and a ceiling on what they will pay for it. Open to anyone by default; integrations can confirm current access with canTake(account).

Sweeper

Anyone. Calls expireOrders to sweep timed-out orders. The refund goes to the maker — there is nothing here to farm, which is why it needs no permission. No role required, and none exists for it.

Where funds sit

Only the sell side is ever held by the contract. The buy side is pulled from the taker and forwarded to the maker in the same call — it never rests anywhere.

maker ──escrow at creation──▶ contract
                                 │
                    fillOrder    │  sellToken: (sellAmountOut − fee) ──▶ taker
                                 │  fee stays as accruedFees
taker ──buyToken: amountIn───────┴─────────────────────────────────────▶ maker

The solvency invariant

token.balanceOf(this) ≥ Σ sellRemaining of Open orders with sellToken == token
                        + accruedFees[token]

Protocol fee accounting is capped by accruedFees[token] and remains separate from escrowed maker funds. The balance can be checked externally with lens.totalEscrowed.

Per-market contract stack

Each pair is an independent proxy with its own escrow, pause state, order ids, oracle and lens. The UI market selector changes which instance it reads and writes; liquidity is never shared between JPYC, IDRX and IDRP books. See Markets.

Capability	What it brings
Pause control	Stops trading without touching anyone’s ability to exit
Reentrancy protection	Prevents a token callback from re-entering settlement

Token facts worth knowing

Rondo verifies the received balance for every token pull. Tokens that deduct an amount during transfer are rejected instead of creating an order or fill with mismatched accounting. Token transfers must succeed for the associated action to complete.