> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rondo.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Topology & money map

> Who touches what, where funds actually sit, and the invariant that keeps the fee account away from escrow.

## Actors

<CardGroup cols={2}>
  <Card title="Maker" icon="user-tie">
    Holds `MAKER_ROLE`. Escrows at creation, is paid directly on every fill, may cancel any time.
  </Card>

  <Card title="Taker" icon="user">
    Names the **output** they want and a ceiling on what they will pay for it. Open to anyone by
    default; integrations can confirm current access with `canTake(account)`.
  </Card>

  <Card title="Sweeper" icon="broom">
    Anyone. Calls `expireOrders` to sweep timed-out orders. The refund goes to the maker — there is
    nothing here to farm, which is why it needs no permission. No role required, and none exists
    for it.
  </Card>
</CardGroup>

## Where funds sit

Only the **sell side** is ever held by the contract. The buy side is pulled from the taker and
forwarded to the maker in the same call — it never rests anywhere.

```
maker ──escrow at creation──▶ contract
                                 │
                    fillOrder    │  sellToken: (sellAmountOut − fee) ──▶ taker
                                 │  fee stays as accruedFees
taker ──buyToken: amountIn───────┴─────────────────────────────────────▶ maker
```

### The solvency invariant

```
token.balanceOf(this) ≥ Σ sellRemaining of Open orders with sellToken == token
                        + accruedFees[token]
```

Protocol fee accounting is capped by `accruedFees[token]` and remains separate from escrowed maker
funds. The balance can be checked externally with
[`lens.totalEscrowed`](/reference/lens#totalescrowed-—-the-solvency-check).

## Per-market contract stack

Each pair is an independent proxy with its own escrow, pause state, order ids, oracle and
lens. The UI market selector changes which instance it reads and writes; liquidity is never shared
between JPYC, IDRX and IDRP books. See [Markets](/protocol/markets).

| Capability            | What it brings                                          |
| --------------------- | ------------------------------------------------------- |
| Pause control         | Stops trading without touching anyone's ability to exit |
| Reentrancy protection | Prevents a token callback from re-entering settlement   |

## Token facts worth knowing

Rondo verifies the received balance for every token pull. Tokens that deduct an amount during
transfer are rejected instead of creating an order or fill with mismatched accounting. Token
transfers must succeed for the associated action to complete.