Signa · ETHOnline 2026 · Arc track

Coverage as a condition of capital, on Circle’s chain

A credit originator owes investors USDC while its loans repay in euros. The hedge protecting that gap sits at a bank; the capital sits in a vault that cannot see it. Signa puts the lender’s coverage covenant inside the transaction that releases money.

Chain
Arc Testnet
Chain ID
5042002
Gas
USDC
Finality
< 1s
Facility
USDC
Exposure
EURC

The machine

Four contracts on Arc. Two signers who do not answer to each other. One vault that will not move a dollar until both have been re-read.

OFFCHAIN ARC TESTNET · 5042002 Exposure issuer Servicer. Answers to the lender, not the borrower. Hedge issuer Verifier of the broker’s own confirmations. Facility admin The lender’s key. Writes policy, approves issuers. CredentialRegistry EIP-712, bound to chain 5042002. Sequence & revocation. FacilityRegistry Coverage floor, haircut, freshness, tolerance, reserve, approved issuers. CoverageEngine Is it current? Is it the latest? Is it unique? Haircut, cap at exposure, emit a reason code. ICoverageGate CovenantVault Holds the facility’s USDC. Reference host — the first of many. draw · repay · reserve cure · waive · restore Borrower Holds no key in the machine. ExposureCredential HedgeCredential policy facts rules verdict USDC, only if permitted re-asked inside every draw
Figure 1. Two independent signers assert facts offchain; the lender’s rules and the lender’s dollars both sit on Arc. The engine never holds money and the vault never decides — the gate is the only thing that connects them, which is why a second host can replace the vault without touching the ruling.

What happens inside a draw

This is the whole product claim, and it fits in one transaction. No cached verdict authorises capital — the operator asking for money is what triggers the re-reading of every credential.

draw(amount) operator calls re-read both credentials current · latest · unique? haircut, cap at exposure ratio vs floor + reserve test transfer USDC Drawn emitted with the inputs revert DrawNotAllowed(CURE) one transaction · one block · sub-second finality on Arc nothing between these steps can change, because there is no between
Figure 2. The gap this closes: operations reconciles coverage on a calendar, but capital leaves on demand. Anything that re-evaluates on a schedule can be right on Monday and wrong on Tuesday afternoon. Re-evaluating inside the draw is the difference between a covenant that describes and a covenant that governs.

Where Signa sits, and why spot-only FX is not a conflict

Arc ships an FX engine. StableFX is an RFQ venue with payment-versus-payment settlement, USDC and EURC today, expanding to regional stablecoins — and it is spot. No forwards, no NDFs, no swaps. That is not a problem for this design. It is the reason the design exists.

LAYER WHAT IT DOES STATUS ON ARC TODAY Execution StableFX · a bank’s FX desk RFQ, PvP settlement Moves the currency. Converts euros to dollars at a price, right now. Built. Circle ships it. Permissioned, spot only. Instrument Forward · NDF · swap Ebury, Santander, a broker Carries the risk over time. This is the thing a lender’s covenant is actually about. Exists — offchain, at a bank. No onchain equivalent yet. Control Signa coverage gate on Arc, beside the money Rules on whether an attested hedge is admissible under this lender’s policy, and gates the draw on it. Empty. This is us. Arc names onchain credit and FX perpetuals as target uses. Signa never creates, holds, or counterparties a hedge. It consumes a signed assertion about one — from a bank, a broker, or eventually an onchain venue.
Figure 3. Circle built the leg that moves currency and explicitly not the leg that makes coverage a condition of capital. Because the engine consumes a HedgeCredential rather than a position, the instrument underneath can be a bank forward today and an onchain perpetual later without the ruling logic changing. Signa does not compete with the people selling hedges. It makes what they sell financeable.

The hazard Arc introduces

Two decimal representations of the same dollar

native USDC (gas)18 decimalspays for the transaction USDC ERC-20 0x3600…00006 decimalsthe facility balance EURC 0x89B5…D72a6 decimalsthe exposure and the hedge

If an 18-decimal figure and a 6-decimal figure meet inside the coverage ratio, the result is not visibly broken. It reads as 100% when the truth is a millionth of a percent — and the vault, believing itself compliant, releases the capital. That is precisely the failure this product exists to prevent, caused by the chain chosen to prevent it on.

The rule that makes it safe is one line: the vault touches only the ERC-20 interface; native 18-decimal USDC pays gas and is never accounted. One normalisation boundary at the credential edge, pinned by a test written before anything is ported.

The demo

Four transactions on Arc Testnet. The same draw call, for the same amount, succeeding and then failing because the evidence underneath it changed.

  1. 01 Facility funded with USDC. Both credentials accepted from distinct issuers. Coverage reads 100%. DRAW PERMITTED
  2. 02 The hedge issuer posts a fresh credential with reduced notional — a partial settlement. syncCovenant moves the facility. CURE · 68%
  3. 03 The identical draw, unchanged in every parameter, is refused with a reason code rather than a colour. DrawNotAllowed
  4. 04 A fresh hedge credential restores cover. Restoration requires a new evaluation — time alone restores nothing. DRAW PERMITTED
Policy in force during the demo
ParameterValueWhat it governs
minCoverageBps10000Hedged notional must fully cover the exposure
defaultHaircutBps5005% discount applied to every hedge before it counts
credentialMaxAge24hEvidence older than this is not evidence
maturityTolerance7dHow early a hedge may mature against the exposure
reserveAmount10%USDC that no draw may consume
cure window5dTime to remedy before breach — not permission to draw
maxWaiverDuration3dHard ceiling on any admin waiver

What is deliberately not here

The hedge feed is a fixture shaped like a broker’s API, labelled as such on screen and in the repository. The conversion payload is shaped like StableFX and is a recorded mock — the live API is permissioned to vetted institutions. No bank has agreed to sign a credential. Nothing in this build executes a derivative, takes custody, originates a loan, liquidates a position, or issues a token.

The vault shipped here is the reference host, not the product. The product is the gate it calls. A second host — a pool, a tranche, a curator’s vault — calling assess before releasing its own draw is the milestone that follows, and it requires a lender, not more code.