Protocol API &Intelligence Layer

Read-only REST API exposing real-time protocol state, vault positions, oracle state, pillar verdicts, and cryptographically hashed audit packages. Served from Arbitrum Sepolia. No authentication. No rate limiting beyond standard Vercel edge caching.

NetworkArbitrum Sepolia
AuthNone
AccessRead-only
CacheEdge · stale-while-revalidate

What this surface represents

This API exposes three distinct layers of protocol intelligence. Each layer has a different source of truth, a different trust model, and is suited to a different class of integration.

LAYER 1 · LIVE
Observable State
GET /api/status

Real-time protocol state fetched from Arbitrum Sepolia on each cache miss. Block height, ETH/USD price, collateral ratio, oracle state, pillar verdicts, and the aggregated overall verdict.

Source of truth: live RPC call to deployed contracts.
Freshness: 30s cache · stale-while-revalidate 60s.
Use for: dashboards, monitors, alerting, keeper gating.

LAYER 2 · DERIVED
Derived Metrics
GET /api/vaults

Per-vault collateral ratio and liquidation status computed server-side from raw chain data. Avoids oracle revert by not calling isLiquidatable() directly. Status classification is deterministic.

Source of truth: on-chain multicall + server-side computation.
Freshness: 30s cache · stale-while-revalidate 60s.
Use for: liquidation keepers, risk dashboards, position monitoring.

LAYER 3 · IMMUTABLE
Canonical Evidence
GET /api/receipts

AUD_001 audit packages generated hourly by the NEXUS-120 Engine. Each package contains a complete protocol state snapshot, pillar verdicts, and a SHA-256 hash committed to a public GitHub repository.

Source of truth: NEXUS-120 Engine → public GitHub repo.
Freshness: 60s cache · packages generated hourly.
Use for: audit verification, compliance, historical analysis.

Reading overall_verdict

Every endpoint returns overall_verdict. Treat it as an operational signal with specific behavioral implications, not a simple health indicator. WARN is degraded — it is not insolvent. FAIL requires action. For full operational interpretation, see the Protocol Intelligence Layer →

PASS
Normal Operation

All solvency conditions met. SOV_001 and SOV_003 passing. Oracle live. Protocol within defined safety parameters.

Integrations may proceed. No conditions require inspection.

WARN
Degraded — Not Insolvent

SOV_001 passing. SOV_003 failing. Causes: oracle stale, CR approaching threshold, or testnet environment constraints. Protocol is not insolvent.

Inspect sov_003_fail_count to distinguish economic from environmental failures before restricting behavior.

FAIL
Unsafe — Halt Integrations

SOV_001 failing. Primary solvency invariant breached — CR below 100%, vault paused under distress, or structural failure.

Integrations that depend on protocol solvency must halt or restrict behavior until PASS is restored.

SOVEREIGNTY PILLARS — QUICK REFERENCE

The verdict is deterministically derived from three pillars. Aggregation: SOV_001 FAIL → FAIL · SOV_003 FAIL (SOV_001 passing) → WARN · all passing → PASS. SOV_005 does not affect overall_verdict.

SOV_001Economic ConstitutionHard solvency gate. CR must be above 100% and vault must not be paused under distress. A SOV_001 failure is a protocol emergency.
SOV_003Capital Adequacy LawCapital buffer check. CR must be above 130% and oracle must be live. Failures are classified as economic, structural, or testnet_env — only economic failures carry real risk significance.
SOV_005Risk Lattice5-year stress simulation across 5,000+ market scenarios. Result available in AUD_001 packages via /api/receipts.

Three read surfaces

All routes are served from the NEXUS site Vercel edge. Responses include standard Cache-Control headers — inspect the Age and Date headers to determine actual data freshness. Fetch server-side to avoid stale browser caches.

GET /api/status
PurposeFull protocol state snapshot computed from Arbitrum Sepolia on each cache miss. Returns block-level chain state, ETH/USD price, protocol-wide collateral ratio, individual pillar verdicts, and the aggregated overall_verdict.
Caches-maxage=30, stale-while-revalidate=60
AuthNone
Error503 { "error": "RPC unavailable" } — Arbitrum Sepolia RPC unreachable
WHEN TO USE
  • Live dashboards displaying protocol health to users or operators.
  • Monitoring systems that need a single endpoint for overall protocol state.
  • Health check probes — poll overall_verdict and alert on FAIL.
  • Any integration that must gate behavior on solvency state — check SOV_001 pass directly.
TRUST NOTES
  • oracle_stale: true means OracleModule.getPrice() reverted. Price is sourced from OracleModule.feed() via latestRoundData(). oracle_feed_address identifies the exact contract. CR is still valid — the fallback price is on-chain — but on-chain operations that call OracleModule will revert.
  • price_source is "oracle" or "chainlink_fallback". When fallback is active, the underlying feed (oracle_feed_address) may itself return a stale price if it is not being updated — this is a deployment condition, not a code bug.
  • Overall verdict WARN on testnet is driven by SOV_003 environmental failure. It does not mean the system is at economic risk unless sov_003_fail_count.economic > 0.
  • vault_paused: true means user-facing operations are halted. This is a protocol-level pause, not an API error.
RESPONSE FIELDS
block_numbernumberBlock height at time of RPC fetch
eth_price_usdnumberETH/USD from OracleModule or its canonical feed fallback (see price_source)
price_sourcestring"oracle" | "chainlink_fallback"
oracle_feed_addressstringAddress of OracleModule.feed() — the contract that produced eth_price_usd when oracle_stale is true
oracle_stalebooleantrue when OracleModule.getPrice() reverted — OracleModule.feed() fallback active
total_collateral_ethnumberWETH balance held by VaultManager
total_collateral_usdnumberCollateral value at current ETH price
total_debt_nxusdnumberNXUSD totalSupply — total outstanding protocol debt
collateral_rationumberProtocol-wide CR as decimal (1.5 = 150%)
collateral_ratio_pctnumberSame as collateral_ratio × 100
min_collateral_ratio_bpsnumberVaultManager.minCollateralRatioBps() — 15000 = 150%
liquidation_ratio_bpsnumberVaultManager.liquidationRatioBps() — 13000 = 130%
vault_pausedbooleanVaultManager.paused() — true halts deposits, withdrawals, minting
liquidation_engine_pausedbooleanLiquidationEngine.paused()
pillars.SOV_001.passbooleanEconomic Constitution — primary solvency invariant
pillars.SOV_003.passbooleanCapital Adequacy — expected false on testnet (environmental)
pillars.SOV_005.passbooleanRisk Lattice — 5-year stress simulation result from engine
overall_verdictstring"PASS" | "WARN" | "FAIL" — simplified runtime health check. Uses two-condition SOV_003 proxy (CR ≥ 130% AND oracle live). NOT equivalent to the canonical engine verdict in /api/receipts.
verdict_reasonstringHuman-readable explanation of non-PASS verdicts
verdict_sourcestringAlways "simplified_runtime" — signals this verdict is a fast health check, not the full capital adequacy audit. Canonical verdict: /api/receipts overall_verdict.
timestampstringISO 8601 UTC timestamp of the fetch
EXAMPLE RESPONSE
{
  "block_number":              251388029,
  "eth_price_usd":             1200.0,
  "price_source":              "chainlink_fallback",
  "oracle_feed_address":       "0x<OracleModule.feed() return value>",
  "oracle_stale":              true,
  "total_collateral_eth":      8.125,
  "total_collateral_usd":      9750.0,
  "total_debt_nxusd":          8000.0,
  "collateral_ratio":          1.21875,
  "collateral_ratio_pct":      121.9,
  "min_collateral_ratio_bps":  15000,
  "liquidation_ratio_bps":     13000,
  "vault_paused":              false,
  "liquidation_engine_paused": false,
  "pillars": {
    "SOV_001": { "pass": true,  "note": "Economic Constitution — solvency gate" },
    "SOV_003": { "pass": false, "note": "Capital Adequacy — testnet_env failure, zero economic" },
    "SOV_005": { "pass": true,  "note": "Risk Lattice — stress simulation" }
  },
  "overall_verdict":  "WARN",
  "verdict_reason":   "SOV_003 FAIL: oracle stale (testnet environment). Zero economic failures.",
  "verdict_source":   "simplified_runtime",
  "timestamp":        "2026-03-20T12:00:00.000Z"
}
FETCH USAGE
// Minimal integration — live protocol state
const res  = await fetch('https://nexus-finance.org/api/status')
const data = await res.json()

// Primary observability fields
console.log(data.overall_verdict)       // "PASS" | "WARN" | "FAIL"
console.log(data.collateral_ratio_pct)  // e.g. 121.9
console.log(data.oracle_stale)          // bool — affects price reliability
console.log(data.pillars.SOV_001.pass)  // false → halt integrations

// Check data freshness via response header
// Cache-Control: public, s-maxage=30, must-revalidate
// Note: overall_verdict is a simplified runtime check — see verdict_source field.
// For canonical audit verdict, use /api/receipts overall_verdict.
GET /api/vaults
PurposeEnumerates all active vault positions. Owner addresses are derived from on-chain Deposit event logs. Per-vault collateral and debt are batch-read via multicall. Collateral ratio and liquidation status are computed server-side — the contract's isLiquidatable() is intentionally not called to avoid oracle revert.
Caches-maxage=30, stale-while-revalidate=60
AuthNone
Log scanDeposit events from block 251,000,000 to latest. Positions with zero collateral and zero debt are excluded from results.
Sort orderliquidatable → active → oracle_stale → safe
Error503 — Arbitrum Sepolia RPC unreachable
STATUS VALUES
"liquidatable"CR < liquidationRatioBps / 10000 (i.e. < 130%). Eligible for on-chain liquidation. Requires KEEPER_ROLE to execute.
"active"CR is between liquidation threshold (130%) and min collateral ratio (150%). At risk but not yet eligible for liquidation.
"safe"CR ≥ minCollateralRatioBps / 10000 (i.e. ≥ 150%). Position is within healthy operating range.
"oracle_stale"OracleModule reverted — CR is computed from Chainlink fallback. On-chain liquidation eligibility is unconfirmed. Do not rely on this status for keeper execution.
WHEN TO USE
  • Liquidation keepers — poll this endpoint to find liquidatable positions without direct RPC calls.
  • Risk dashboards — display per-vault CR distribution and system exposure.
  • Monitoring — alert when summary.liquidatable > 0 and oracle_stale = false.
  • Analytics — track vault count, aggregate CR, and debt distribution over time.
TRUST NOTES
  • When oracle_stale is true, all vault status values are computed from Chainlink fallback. A vault classified as "liquidatable" in this state may not be executable on-chain because the contract itself will revert on oracle check.
  • collateral_ratio and collateral_ratio_pct are null for vaults with zero debt. This represents an infinite CR — not an error or missing data.
  • isLiquidatable() is not called. Status is derived purely from CR thresholds and protocol parameters. Discrepancy with on-chain state is possible if parameters changed after the last cache miss.
  • Log scan starts at block 251,000,000. Depositors before this block will not appear if they have not re-deposited.
RESPONSE FIELDS
block_numbernumberBlock height at time of fetch
eth_price_usdnumberETH/USD used for CR computation (see price_source)
oracle_stalebooleantrue when OracleModule reverted — all status values based on fallback price
price_sourcestring"oracle" | "chainlink_fallback"
protocol.min_collateral_ratio_bpsnumberVaultManager.minCollateralRatioBps()
protocol.liquidation_ratio_bpsnumberVaultManager.liquidationRatioBps()
vaults[].addressstringVault owner address (checksummed)
vaults[].collateral_ethnumberWETH deposited — collateralOf(address) / 1e18
vaults[].debt_nxusdnumberNXUSD minted — debtOf(address) / 1e18
vaults[].collateral_value_usdnumbercollateral_eth × eth_price_usd
vaults[].collateral_rationumber?collateral_value_usd / debt_nxusd — null if debt is zero
vaults[].collateral_ratio_pctnumber?collateral_ratio × 100 — null if debt is zero
vaults[].statusstring"safe" | "active" | "liquidatable" | "oracle_stale"
summary.totalnumberTotal active vaults returned
summary.safenumberVault count per status
summary.activenumberVault count per status
summary.liquidatablenumberVault count per status
summary.oracle_stalenumberVault count per status
EXAMPLE RESPONSE
{
  "block_number":  251388029,
  "eth_price_usd": 1200.0,
  "oracle_stale":  true,
  "price_source":  "chainlink_fallback",
  "protocol": {
    "min_collateral_ratio_bps": 15000,
    "liquidation_ratio_bps":    13000
  },
  "vaults": [
    {
      "address":              "0xabc...111",
      "collateral_eth":       8.125,
      "debt_nxusd":           8000.0,
      "collateral_value_usd": 9750.0,
      "collateral_ratio":     1.21875,
      "collateral_ratio_pct": 121.9,
      "status":               "oracle_stale"
    }
  ],
  "summary": {
    "total":        2,
    "safe":         0,
    "active":       0,
    "liquidatable": 1,
    "oracle_stale": 1
  },
  "timestamp": "2026-03-20T12:00:00.000Z"
}
FETCH USAGE
// Liquidation keeper — find eligible positions
const res  = await fetch('https://nexus-finance.org/api/vaults')
const data = await res.json()

// Filter by status — note: oracle_stale means CR is computed off fallback
const liquidatable = data.vaults.filter(v => v.status === 'liquidatable')
const atRisk       = data.vaults.filter(v => v.status === 'active')

// Prefer to act only when oracle is reliable
if (!data.oracle_stale && liquidatable.length > 0) {
  // Proceed to on-chain liquidation via KEEPER_ROLE
}

// Protocol thresholds (BPS → decimal)
const liqCr = data.protocol.liquidation_ratio_bps / 10000  // 1.30
const minCr = data.protocol.min_collateral_ratio_bps / 10000  // 1.50
CANONICAL AUDIT EVIDENCE SURFACE · LAYER 3 · IMMUTABLE · SHA-256 VERIFIED
GET /api/receipts
PurposeReturns the most recent AUD_001 audit packages from the public nexus-receipts repository. Each package is a complete point-in-time snapshot generated by the NEXUS-120 Engine via GitHub Actions on an hourly schedule. Includes pillar verdicts, chain state, fail classification breakdown, and a SHA-256 hash of the canonical package JSON.
Caches-maxage=60, stale-while-revalidate=120
SourceGitHub API → NEXUS120-Official/nexus-receipts/packages/
ReturnsArray of all available packages, newest first
AuthNone — GitHub public repository
Error503 — GitHub API unreachable or unauthenticated rate limit reached (60 req/hr at CDN miss boundary, not per-client)
WHEN TO USE
  • Audit systems that need to verify protocol state over a historical window.
  • Verification tooling — re-derive the SHA-256 hash from the raw field and compare against package_hash.
  • Trend analysis — track collateral_ratio_pct and sov_003_fail_count over time.
  • Risk engines that need engine-generated snapshots rather than live RPC data.
  • Compliance workflows requiring immutable, timestamped protocol state records.
TRUST NOTES
  • Packages are generated by an automated engine, not the smart contracts directly. The engine reads chain state, runs pillar logic, and commits results to GitHub. The chain state inside each package is a snapshot, not a real-time value.
  • The raw field contains the original AUD_001 JSON exactly as committed to the repository. package_hash is a SHA-256 over this canonical JSON.
  • sov_003_fail_count.economic is the critical signal. A value of 0 means no economic failure occurred — testnet_env failures are expected and carry no risk significance.
  • Package frequency is hourly (GitHub Actions schedule). Gaps in the receipt timeline indicate engine downtime, not protocol failure.
RESPONSE FIELDS (PER ITEM)
filenamestringAUD_001_PACKAGE_{timestamp}.json — canonical filename from nexus-receipts
download_urlstringDirect URL to raw JSON file on GitHub (stable, no auth required)
timestamp_utcstringISO 8601 UTC timestamp of engine run
block_numbernumberArbitrum Sepolia block at snapshot time
eth_price_usdnumberETH/USD at time of package generation
price_sourcestring"oracle" | "chainlink_fallback" — identifies which price contract produced eth_price_usd
collateral_ratio_pctnumberProtocol CR% at snapshot time
total_collateral_ethnumberTotal WETH collateral at snapshot
total_debt_nxusdnumberTotal NXUSD debt at snapshot
oracle_stalebooleanOracle state at time of engine run
sov_001_verdictstring"PASS" | "FAIL"
sov_003_verdictstring"PASS" | "FAIL" — expected FAIL on testnet for environmental reasons
sov_003_modestring"NORMAL" | "RECOVERY" — engine operating mode at run time
sov_003_fail_count.economicnumberFailures caused by real economic conditions — the key risk signal
sov_003_fail_count.structuralnumberFailures caused by parameter or configuration issues
sov_003_fail_count.testnet_envnumberFailures caused by testnet environment (oracle staleness, etc.) — expected non-zero
sov_003_fail_count.totalnumberSum of all fail categories
sov_005_verdictstring"PASS" | "FAIL" — 5-year stress lattice result
overall_verdictstring"PASS" | "WARN" | "FAIL"
verdict_rationalestringEngine-generated explanation of the verdict
package_hashstringSHA-256 of canonical package JSON — use for integrity verification
rawobjectFull AUD_001 package JSON as-is from nexus-receipts repository
EXAMPLE RESPONSE (TRUNCATED)
[
  {
    "filename":             "AUD_001_PACKAGE_20260320T120000Z.json",
    "download_url":         "https://raw.githubusercontent.com/NEXUS120-Official/nexus-receipts/main/packages/...",
    "timestamp_utc":        "2026-03-20T12:00:00Z",
    "block_number":         251388029,
    "eth_price_usd":        1200.0,
    "price_source":         "chainlink_fallback",
    "collateral_ratio_pct": 121.9,
    "total_collateral_eth": 8.125,
    "total_debt_nxusd":     8000.0,
    "oracle_stale":         true,
    "sov_001_verdict":      "PASS",
    "sov_003_verdict":      "FAIL",
    "sov_003_mode":         "RECOVERY",
    "sov_003_fail_count": {
      "economic":    0,
      "structural":  0,
      "testnet_env": 6,
      "total":       6
    },
    "sov_005_verdict":   "PASS",
    "overall_verdict":   "WARN",
    "verdict_rationale": "SOV_003 FAIL — testnet_env only. Zero economic or structural failures.",
    "package_hash":      "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "raw": { "...": "full AUD_001 JSON from nexus-receipts repo" }
  }
]
FETCH USAGE
// Audit verification — read and verify recent packages
const res      = await fetch('https://nexus-finance.org/api/receipts')
const packages = await res.json()  // array, newest first — all available packages

const latest = packages[0]

// Verify integrity — recompute hash server-side against raw field
console.log(latest.package_hash)                   // "sha256:..."
console.log(latest.overall_verdict)                // "PASS" | "WARN" | "FAIL"

// Distinguish fail categories — economic=0 means no real risk event
console.log(latest.sov_003_fail_count.economic)    // 0 on healthy testnet
console.log(latest.sov_003_fail_count.testnet_env) // non-zero is expected

Oracle & price source behavior

The protocol uses a two-layer price stack. All three REST endpoints implement the same fallback logic and expose oracle_stale and price_source so consumers can evaluate data reliability independently.

Price Source Architecture
PrimaryOracleModule.getPrice() — protocol-managed oracle with a freshness window enforced by maxDelay(). Returns price, updatedAt, and decimals. Reverts if the feed has not been updated within maxDelay seconds.
FallbackAggregatorV3Interface.latestRoundData() directly on the Chainlink ETH/USD feed at 0xd30e2101a97dcbAeBCBC04F14C3f624E67A35165. Used when OracleModule reverts. No freshness enforcement is applied to the fallback.
DetectionFallback activation is detected via try/catch on the OracleModule call. Any revert — regardless of reason — sets oracle_stale: true in the response.
OPERATIONAL STATES
NORMALOracleModule live · oracle_stale: false

OracleModule is returning a valid price within its freshness window. CR computations on all endpoints use this price. On-chain operations — including isLiquidatable() and getPrice() — will not revert.

Integrations may rely on vault status values. Liquidation keeper execution is safe.

DEGRADEDChainlink fallback active · oracle_stale: true

OracleModule has reverted. All API endpoints fall back to OracleModule.feed() via latestRoundData(). CR computations use the fallback price. Vault statuses are computed from this fallback and may not match what the smart contract would return. Any on-chain call that internally invokes OracleModule — such as isLiquidatable() — will revert.

This is the normal state on Arbitrum Sepolia testnet. API data is still valid for monitoring and analytics. Liquidation keeper execution requires caution.

CRITICALNo reliable price source · oracle_stale: true + eth_price_usd: 0

Both OracleModule and the Chainlink fallback have failed or returned zero. CR computation is not possible. All vault statuses will be classified as oracle_stale. The API will return the best available data but eth_price_usd will be 0 or absent.

Do not use vault status or CR data for any decision-making. Alert and halt integrations until a reliable price source is restored.

Caching & revalidation

All endpoints use Vercel edge caching with stale-while-revalidate semantics. A response may be served from cache up to the stale window while a background revalidation is in flight. For latency-sensitive integrations, include a Cache-Control: no-store header on your request, or append a unique query string to bypass the CDN layer.

Endpoints-maxagestale-while-revalidateMaximum age seen by clientNotes
/api/status30s60s~90sLive chain data — at most 2 Arbitrum Sepolia block epochs stale
/api/vaults30s60s~90sLog scan + multicall — expensive; do not bypass cache in hot loops
/api/receipts60s120s~180sSource is hourly GitHub commits — higher cache TTL is appropriate
Freshness Headers
AgeSeconds since the response was generated. Age: 0 means freshly computed from chain.
DateUTC timestamp of the original response. Use to compute actual data age regardless of edge caching.
Cache-ControlReturned on every response. Inspect to confirm the active cache policy matches what you expect.

Integration use cases

The following patterns represent the primary ways external systems are expected to integrate with this API. Each pattern identifies the primary endpoint, the key field to act on, and the behavioral constraint to observe.

Keeper
Liquidation Bot
GET /api/vaults

Poll /api/vaults at the cache boundary (every 30s). Filter vaults where status === 'liquidatable'. Proceed to on-chain execution only when oracle_stale === false.

Key signal: summary.liquidatable > 0 AND oracle_stale === false
Dashboard
Protocol Health Display
GET /api/status

Fetch /api/status every 30s. Display overall_verdict, collateral_ratio_pct, and per-pillar pass/fail. Surface oracle_stale prominently when true — it affects all downstream data.

Key signal: overall_verdict + pillars.SOV_001.pass
Risk Engine
External Risk Integration
GET /api/status · /api/receipts

Use /api/status for live signals and /api/receipts for engine-verified historical snapshots. Combine collateral_ratio trend from receipts with live oracle_stale state to build a composite risk score.

Key signal: sov_003_fail_count.economic trend across packages
Monitoring
Alert & Pager System
GET /api/status

Subscribe to overall_verdict transitions. Alert on WARN → FAIL or any state where pillars.SOV_001.pass === false. Suppress alerts for persistent WARN on testnet — it is environmental, not economic.

Key signal: overall_verdict === 'FAIL' OR SOV_001.pass === false
Audit
Compliance & Verification
GET /api/receipts

Fetch the latest packages and recompute SHA-256 from the raw field. Compare against package_hash. Inspect verdict_rationale and fail classification breakdown. Cross-reference with the public GitHub repo directly.

Key signal: package_hash integrity + economic: 0
Analytics
Historical Protocol Analysis
GET /api/receipts · /api/vaults

Aggregate /api/receipts over time for CR trend and verdict history. Combine with /api/vaults snapshots for vault-level distribution analysis. All timestamps are ISO 8601 UTC and suitable for time-series storage.

Key field: timestamp_utc + collateral_ratio_pct

Contract read surfaces

All four contracts are deployed on Arbitrum Sepolia and callable directly via eth_call — no wallet or auth required. The REST API endpoints are built on top of these same read surfaces. Full ABIs and verified source are on the Contracts page →

VaultManager
Address0xF09AAD220C6c4d805cF6cE5561B546f51ADFBb03
collateralOf(address)WETH deposited (wei) — divide by 1e18 for ETH
debtOf(address)NXUSD debt (wei) — divide by 1e18 for NXUSD
minCollateralRatioBps()Minimum safe CR in BPS — 15000 = 150%
liquidationRatioBps()Liquidation threshold in BPS — 13000 = 130%
paused()Vault operations halted if true
WRITEliquidate() requires KEEPER_ROLE — not callable by arbitrary accounts. 5% collateral bonus on successful liquidation.
NXUSDToken
Address0x515844Dd91956C749e33521B4f171dac4e04FE07
totalSupply()Total NXUSD in circulation — equals total protocol debt
balanceOf(address)NXUSD balance of any wallet
decimals()Returns 18
OracleModule
Address0xa1BD5AF1174140caB018e46eBCFEf1d005c3df84
getPrice()Returns (price, updatedAt, decimals) — reverts when feed is outside maxDelay window
maxDelay()Maximum allowed oracle data age in seconds
NOTEConsistently reverts on Arbitrum Sepolia testnet — the Chainlink testnet feed does not update at the frequency OracleModule requires. Use the Chainlink feed directly for any price read outside the protocol.
LiquidationEngine
Address0xF333d9ae2D70305758E714ecBeA938e9377a9f9D
closeFactorBps()Maximum debt repayable per liquidation call, in BPS
paused()Liquidation engine halted if true
WRITEexecuteLiquidation() requires KEEPER_ROLE. Position must have CR < liquidationRatioBps.

Integration policy

These rules define the expected behavior of any system integrating with this API. They are not advisory — they reflect the protocol's safety model and the trust constraints of each data surface.

IP-001Halt on SOV_001 failure

If pillars.SOV_001.pass === false, halt or restrict all protocol-dependent operations immediately. SOV_001 is the Economic Constitution — its failure indicates the primary solvency invariant has been breached. Do not wait for overall_verdict to confirm.

IP-002WARN is degraded, not insolvent

overall_verdict === "WARN" means SOV_003 is failing while SOV_001 is passing. The protocol is not insolvent. Persistent WARN on testnet is environment-driven (oracle stale). Inspect sov_003_fail_count.economic — if 0, no real risk event has occurred.

IP-003Gate keeper logic on oracle state

Do not execute on-chain liquidation logic when oracle_stale === true. When OracleModule is stale, isLiquidatable() will revert on-chain. Vault statuses in /api/vaults are computed from Chainlink fallback — they may not match contract-level eligibility. Wait for oracle_stale: false before submitting keeper transactions.

IP-004Inspect freshness headers; prefer server-side fetches

Check the Age and Date headers on every response. A response served from CDN cache may be up to 90s old. For latency-sensitive integrations, fetch server-side — not client-side — to avoid layered stale caches. If you need guaranteed freshness, append a unique query string or include Cache-Control: no-store.

IP-005Treat sov_003_fail_count.economic: 0 as no real risk

When inspecting /api/receipts packages, the sov_003_fail_count breakdown is the primary risk signal. testnet_env failures are expected and carry no risk significance. economic: 0 across a historical window means the protocol has had no real economic stress events, even when overall_verdict is WARN.

IP-006Do not hot-loop /api/vaults

/api/vaults performs a log scan and multicall against Arbitrum Sepolia on each cache miss. Do not bypass the cache or loop at sub-30s intervals. For real-time monitoring of overall protocol state, use /api/status instead.

Testnet behavior & known limitations

This API operates against Arbitrum Sepolia testnet. Several system behaviors are environment-driven and should not be interpreted as protocol failures. The following annotations are provided so integrations can correctly classify data they receive.

Testnet-Specific Behavior
oracle_stale: trueOracleModule enforces a freshness window that the underlying feed contract does not currently satisfy. This is a testnet infrastructure condition, not a protocol design fault. All REST endpoints fall back to OracleModule.feed() via latestRoundData() automatically. The fallback price is reliable for CR computation but not for on-chain protocol operations.
SOV_003: FAIL (expected)Capital Adequacy fails on testnet for environmental reasons: oracle stale, low surplus buffers, and testnet Chainlink feed behavior. The sov_003_fail_count breakdown differentiates between economic (real risk), structural (parameter issue), and testnet_env (environmental) failures. On healthy testnet, economic count remains 0. This normalizes on mainnet with a live oracle.
overall_verdict: WARNDriven entirely by the SOV_003 testnet environment failure. This is the expected steady state on Arbitrum Sepolia and does not indicate economic risk. Integrations should treat persistent WARN with economic:0 as operationally equivalent to PASS for testnet evaluation purposes.
Collateral ratio anomaliesTestnet positions may be opened with unusual parameters for testing purposes. A very high CR (e.g. 500%+) or a low debt amount (e.g. < 10 NXUSD) is normal test behavior. Do not treat these as protocol anomalies in test analysis.
API Behavior & Constraints
/api/receipts rate limitProxies the GitHub API for the public nexus-receipts repository. Subject to GitHub's 60 req/hr unauthenticated rate limit — applied at the CDN miss boundary, not per client request. Under normal cache behavior (60s TTL) this is not a concern. If you need higher frequency, query the GitHub API directly with a personal access token.
/api/vaults log scanScans Deposit events from block 251,000,000 to latest. If VaultManager was deployed before this block, early depositors who have not re-deposited will not appear. The exact deployment block will be set as the canonical scan origin once confirmed. Current behavior is conservative — no positions are missed that have interacted with the protocol in the active deployment.
isLiquidatable() not calledThe /api/vaults endpoint does not call isLiquidatable() on-chain. This function internally calls OracleModule.getPrice() and reverts when the oracle is stale. Instead, CR is computed deterministically from raw collateral, debt, and OracleModule.feed() fallback price. Discrepancy with on-chain results is possible if protocol parameters changed after the last cache miss.
collateral_ratio: nullA vault with collateral deposited but zero debt minted returns null for collateral_ratio and collateral_ratio_pct. This represents an infinite CR — the position has no debt obligation. It is not an error, missing data, or a sign of a malformed position.
Verify protocol state directly

All contract source is verified on Arbiscan. All audit packages are SHA-256 hashed and immutably committed to the public nexus-receipts repository. Both are independent of this API.

Contracts →Audit Evidence Layer →Vault Positions →