> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calibri.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Smart Contracts
> The on-chain contracts behind non-custodial trading — USDC, ConditionalTokens (CTF), the CTF Exchange, CalibriResolver, your per-member Gnosis Safe, and the bridge that brings USDC in from other networks — and how to verify the live addresses.
Trading on Calibri runs on a **Conditional Token Framework (CTF)** deployment on
**Polygon**. Every contract is public and verifiable — you never have to trust
that funds are where we say they are, because you can check on-chain. This page
explains each contract's role in plain language; the
[deployed addresses](/smart-contracts/deployed-addresses) page has the live
values and how to verify them.
Every trade on Calibri settles against these contracts — see [Self-custody](/non-custodial/overview) for how a signed order becomes an on-chain position.
## The contracts and what they do
| Contract | Plain-English role |
| - | - |
| **USDC (collateral)** | The stablecoin that backs every position. Deposits, stakes, fees, winnings, and rewards are all in USDC (6 decimals). |
| **ConditionalTokens (CTF)** | Gnosis' audited framework. It **holds the collateral** and mints the **YES / NO outcome tokens** for each market. At resolution, winning tokens **redeem for USDC directly from the CTF** — funds live here, not with the operator. |
| **CTF Exchange** | Where signed non-custodial orders are matched and executed on-chain. Its name is baked into the EIP-712 signing domain, so your wallet signs against Calibri's own exchange and nowhere else. |
| **CalibriResolver** | The **oracle** that reports each market's outcome to the CTF. It can **only report** outcomes — it **cannot take or freeze funds** — and it has trustless fallbacks (see below). |
| **AutoRedeemer** | Used only if you turn on [auto-redeem](/non-custodial/redeeming-winnings#auto-redeem). With your approval it redeems your **resolved** positions and returns the **whole payout to your own Safe** in the same transaction. No owner, no upgrade path, and it cannot send funds anywhere else. |
| **Your Gnosis Safe** | Your own smart-contract wallet — the **funds source and order maker**. Owned solely by your own key(s) — your wallet or your passkey's signer contract, plus any [signing key](/non-custodial/signing-keys) you add; the operator only **deploys it and relays your signed actions**, paying gas. You always sign. |
## What "non-custodial" actually guarantees
* **You hold the funds** — Your USDC sits in **your own Safe**. Only a key you own can authorize a move. The operator is never an owner and can never move funds without your signature. The one thing that moves without it is the [bridge module](#cross-network-deposits), and all it can do is carry USDC sent to your address on another network to **your own Safe on Polygon**.
* **The operator can only report** — CalibriResolver reports outcomes; it can't seize collateral. Redemption of winnings happens **directly from the CTF**, so your winnings are never custodied by the operator between resolution and redeem.
* **You sign, the operator pays gas** — Deploying your Safe, approvals, order settlement, and redemption are all **relayed** by the operator. You sign; you never need to hold gas. The one exception you can opt in to is auto-redeem, where a single approval lets winnings be redeemed back into your Safe without signing each one.
* **Funds are always recoverable** — A permissionless escalation ladder (operator → UMA → deadman void) guarantees every market settles or refunds. See [Market resolution](/non-custodial/resolution).
## Cross-network deposits
Four contracts let USDC sent to your Safe address on **Ethereum, Base, Arbitrum or
Optimism** reach the same Safe on Polygon without you signing anything. Each is deployed at
**the same address on every supported network**, which is what gives your Safe the same
address everywhere. See [Deposits from other networks](/non-custodial/deposits-from-other-networks)
for the member-facing flow.
| Contract | Plain-English role |
| - | - |
| **CalibriSafeFactoryV2** | Creates member Safes. Same address formula as before, but every Safe it creates has the bridge module enabled **in the same transaction** — a Safe never exists without it. **Permissionless**: `createProxyFor(owner)` makes a Safe owned solely by `owner`, whoever calls it. |
| **SafeModuleSetup** | A stateless helper the Safe runs during its own setup to switch the module on. It holds nothing and does nothing if called directly. |
| **CctpBridgeModule** | The module on every Safe. Two entry points: `bridge(safe, amount, fee, maxCctpFee)` for the standard capped fee, and `bridgeWithConsent(consent, sig)` for a higher fee a member accepted in the app. Both move that network's USDC through **Circle's CCTP** to **the same Safe address on Polygon**. The destination is fixed in code, never a parameter. No owner, no upgrade path; its only storage is the one-time-use record for accepted fees. On Polygon itself it is inert. |
| **BridgeFeeConfig** | Holds three addresses: the **relayer** allowed to charge the bridge fee, the **treasury** the fee is paid to, and the dedicated **consent signer** that countersigns a fee a member accepted above the cap. Its admin can change those three and nothing else. |
### What the module can and cannot do
The module can act on a Safe without owner signatures — that is what a Safe module is — so
its limits are enforced by its own immutable code:
* **One token:** the network's native USDC, as linked by Circle's own contracts. Never a
token the caller names; never ETH.
* **One destination:** a CCTP burn whose recipient is the Safe's own address on Polygon.
* **One kind of call:** plain calls to USDC and to Circle's messenger. It never
delegatecalls.
* **One capped fee:** only when the configured relayer calls it, only on a bridge of the
Safe's **whole** balance, at most **10 USDC** and at most **20%** of that balance, paid
to the configured treasury.
* **Above the cap, only a fee the member accepted:** `bridgeWithConsent` charges exactly
the fee in an acceptance countersigned by the consent signer — for one Safe, once, before
its deadline, and only if the Safe has not been bridged since. See
[When Ethereum gas is high](/non-custodial/deposits-from-other-networks#when-ethereum-gas-is-high).
* **Open to anyone at zero fee:** so a member can always move stranded USDC to their
Polygon Safe, with or without Calibri.
Changing any of those limits would take a new module at a new address, and therefore a new
factory and different Safe addresses.
### Trust model
| Who | Can | Cannot |
| - | - | - |
| **Anyone** | Call `bridge` with `fee = 0` for any Safe; create any member's Safe with `createProxyFor` | Send funds anywhere but the Safe's own address on Polygon; take a fee; move any token but USDC; send ETH; delegatecall |
| **Relayer** (set in BridgeFeeConfig) | Everything anyone can, plus one fee per whole-balance bridge, at most `min(10 USDC, 20%)`, paid to the treasury; and submit an accepted fee the consent signer countersigned | Take a fee on part of the balance; exceed the caps without a countersigned acceptance; redirect the burn or the fee |
| **Consent signer** (set in BridgeFeeConfig, a dedicated key) | Countersign a member's accepted fee: with the relayer, charge that fee — up to the Safe's balance — once | Submit anything itself; redirect the burn or the fee |
| **Fee-config admin** | Change the relayer, the treasury and the consent signer; hand the admin role over (two-step) | Change the fee caps, destination, token or Circle's messenger — all fixed in the module; renounce the role |
| **Safe owner — your wallet** | Everything a Safe owner can, on every network, including switching the module off | — |
| **Safe owner — a passkey** | Everything, on Polygon | Anything on another network: the passkey's signer contract exists only on Polygon, so the module cannot be switched off there and is the only way USDC leaves |
| **Circle (CCTP)** | Burn on the source network and mint to the recipient on Polygon; decide which token is USDC on each network; set its own transfer fee, which is zero for Standard transfers today | — |
On other networks, **anything other than USDC** sent to a passkey member's Safe cannot be moved today — it needs an owner signature that cannot be produced there. The module never moves it.
### Withdrawals to other networks
The outbound direction uses **none of the contracts above**. A withdrawal from your Safe on
Polygon to Ethereum, Base, Arbitrum or Optimism is a Safe transaction you sign, which calls
**Circle's messenger directly from the Safe** — no module. It is batched through Safe's own
**MultiSendCallOnly** contract, which can make only plain calls, and the batch is exactly
three of them: USDC to Calibri's treasury for the fee, a USDC approval to Circle's
TokenMessengerV2, and `depositForBurn` naming the destination network and **your address**
as the mint recipient. Circle mints only to that address; delivery on the destination
network is open to anyone. See
[Withdrawals to other networks](/non-custodial/withdrawals-to-other-networks).
## Verifying and interacting on-chain
As a non-custodial user you can independently verify every contract and, if you
want, interact with them directly:
* **Read the code and balances** on the network's block explorer.
* **Check your Safe** holds the USDC you deposited.
* **Redeem winnings** yourself by signing a Safe transaction that the operator
relays — see [Redeeming winnings](/non-custodial/redeeming-winnings).
## Where the live addresses come from
The **canonical source** for every address you need is the CTF-config API — the
same one the app itself reads:
* **`GET /api/v2/atlas/account/wallet`** — your member-level
funding config: `exchange_address`, `conditional_tokens_address`,
`usdc_address`, `chain_id`, `blockchain_key`, `domain_name` (the exchange's
EIP-712 domain), your `proxy_address` (your Safe), `owner_address` (the owning
wallet), and `signature_type`.
* **`GET /api/v2/atlas/account/wallet/markets/:id`** — everything
above **plus** the market-specific `condition_id`, `yes_token_id`, and
`no_token_id`.
These endpoints are the source of truth. The [Deployed
addresses](/smart-contracts/deployed-addresses) page lists the live mainnet
values and walks through verifying each one on the explorer.
## Related
Deploy, fund, and make your Safe trade-ready.
Per-network address table and explorer link patterns.
The EIP-712 domain and order struct you sign.
Operator → UMA → deadman void.
How the bridge module moves USDC to your Safe on Polygon.
How a withdrawal leaves your Safe through Circle, with no module.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.