Skip to main content
ControllerFacade resolves a controller for an external target, calls its capability check, and verifies permitted input tokens. Unknown targets return a denied result with empty token lists. can_call uses a typed action; can_call_fn uses a function symbol. Each returns (allowed, tokens_in, tokens_out). validate_tokens_in checks a supplied list against Registry. Admin can change Registry and upgrade WASM. The facade remains available as a policy interface. AccountManager’s current exec implementation optimizes the transaction budget by reading Registry.get_exec_gate and calling the controller directly, so an architecture diagram must not require the facade in every execution.

Function signatures

These signatures are copied from the reviewed Rust implementation. env is supplied by Soroban and is not a transaction argument. Result errors and panics must be handled by the caller; simulation does not guarantee later execution. Public methods include privileged and internal-contract callbacks, not just user entrypoints.

__constructor

can_call

can_call_fn

validate_tokens_in

get_registry

set_registry

upgrade

Source reference

  • Protocol_V1_Soroban_testnet/contracts/ControllerFacadeContract/src/facade.rs