Iora documentation
Iora is a non-custodial vault on Stellar. Your USDC earns interest on Blend while a limit order to buy XLM waits, and when the price reaches your limit the order is filled from the vault in a single transaction.
Iora runs on Stellar testnet only. Everything on this page uses test funds. The contracts have not been audited.
Overview
A normal limit order leaves your money idle until the price comes to you. That can take days or weeks. Iora keeps the money at work in the meantime: the USDC behind your order is supplied to a Blend lending pool and earns interest until the moment it is spent.
The name says it: Iora stands for Interest On Resting Assets.
Your own vault
Each user gets a separate smart contract. Only your wallet can deposit, withdraw, place or cancel orders.
Earning while waiting
Deposited USDC goes to Blend right away, including the part reserved for open orders.
One-step fills
Withdraw from Blend, swap on Soroswap and send XLM to you, all in one atomic transaction.
Who it is for
- People who want to buy XLM below today's price and don't want their cash idle while they wait.
- Savers who buy in steps (dollar-cost averaging) and want each step to keep earning until it fills.
- Wallets and DAOs on Stellar that want to offer yield-bearing limit orders without holding user funds.
Quick start
Getting set up on testnet takes about five minutes and costs nothing. The app shows the same checklist and ticks each step off for you.
- Install Freighter. Get the browser extension at freighter.app and create a wallet. Never share your recovery phrase with anyone, including us.
- Switch to Testnet. In Freighter settings, select the Testnet network.
- Connect. Open the testnet app and press Connect wallet. The app is closed while we prepare the public beta; join the beta and we will send you access.
- Get test XLM. On the app's Test funds page, press Get 10,000 test XLM.
- Get test USDC. On the same page press Add USDC trustline, then swap some XLM for USDC on the Swap page.
- Open your vault. Press Open my vault and sign. This deploys your personal vault contract.
- Deposit. Enter an amount and press Deposit. Your USDC starts earning on Blend immediately.
- Place an order. Fill in the order form or type a sentence such as “buy 10 USDC of XLM if it drops to 0.15”, review and sign.
How Iora compares
Yield on waiting orders is not a new idea. On EVM chains, Mangrove's “reactive liquidity” lets offers source funds from lending markets such as Aave until they are taken, mainly for market makers. Iora brings the same principle to Stellar in a simple form for everyday buyers.
| Stellar order book | DEX limit orders e.g. CoW Swap | Reactive liquidity Mangrove, EVM | Iora | |
|---|---|---|---|---|
| Funds earn while waiting | No | No, funds stay idle in your wallet | Yes, through strategies such as Kandel-AAVE | Yes, on Blend |
| Who holds the funds | Your account | Your wallet | A strategy contract you control | Your own vault contract |
| Every order fully funded | Yes | No, one balance can back several orders | Depends on strategy | Yes, each order reserves its amount |
| Partial fills | Yes | Yes | Yes | Yes, with a minimum fill size you choose |
| Built for | Traders | Traders | Market makers and builders | Everyday buyers and savers |
| Network | Stellar | Ethereum and L2s | EVM chains | Stellar (Soroban) |
Vaults
A vault is a smart contract deployed for one owner by the Iora factory. Its address is derived from your wallet address, so each wallet has exactly one vault and it can always be found again. The USDC you deposit is supplied to Blend in the vault's name. Iora never pools user funds in a contract of its own, but every vault supplies to the same Blend pool (see Risks).
- Balance on Blend
- Your principal plus interest earned, read live from Blend.
- Reserved for orders
- The sum of what is still unfilled in your open orders. It keeps earning until it is spent.
- Available
- Balance minus reserved. This is what you can withdraw or use for a new order. While any order is open, 0.00001 USDC is held back as a rounding buffer for Blend.
- Interest earned
- Balance + withdrawn + spent on orders − deposited, over the life of the vault.
Depositing and withdrawing
Deposits move USDC from your wallet to Blend through the vault. Withdrawals move USDC from Blend back to your wallet and are limited to the available balance, so they can never take money that an open order needs. Leave the amount empty to withdraw everything available, interest included. To withdraw reserved money, cancel the order first.
Limit orders
Iora currently supports one order type: buy XLM with USDC at or below a price you set.
- Amount
- The USDC set aside for the order. It is reserved from your available balance when you place the order.
- Limit
- The most USDC you are willing to pay for 1 XLM. The order fills at this price or better, never worse.
- Minimum fill
- The smallest piece the order may be filled in. Only the final remainder can be smaller. Left empty, the app uses a quarter of the amount.
- Max price impact
- How far a single fill may move the Soroswap pool price. If the pool is thin, a large order is filled in smaller pieces instead. Default 3%.
- Duration
- After this time the order can no longer be filled. Default 7 days.
Price improvement
The contract computes the minimum XLM you must receive from your limit, and checks it again after the swap. If the market is better than your limit when the order fills, you receive all of the extra XLM. Iora takes no cut of it.
Partial fills
An order can fill in several pieces, for example when the pool cannot absorb the whole amount within your price impact limit. Each piece is a separate transaction and each one meets your limit on its own. The My orders table shows how much has filled and your average price.
Order lifecycle
- Open
- Waiting for the price. The reserved USDC is earning on Blend.
- Partially filled
- Still open; part of the amount has been spent and XLM sent to you.
- Filled
- The whole amount has been spent.
- Cancelled
- You cancelled it. The unfilled part returns to your available balance immediately.
- Expired
- The duration passed before it filled completely. The unfilled part stays reserved, and keeps earning, until you press Cancel to release it.
Where the yield comes from
Iora does not create yield. Your vault lends USDC on Blend, and Blend borrowers pay interest on what they borrow. Lenders share that interest: the supply rate is roughly the borrow rate multiplied by the pool's utilization, so it rises when borrowing demand is high and falls when it is low. Interest is added to your balance continuously and paid out when you withdraw or when an order spends it.
- The rate changes all the time; past rates are not a promise.
- Iora does not currently claim BLND token emissions that some Blend pools pay to lenders.
- The landing page simulation is sped up for illustration and does not show real rates.
Keepers
Orders are filled by a keeper, a bot that watches the price. Filling is permissionless: the execute
function can be called by anyone, so anyone can run a keeper. The caller only chooses which order to fill and how
much. The recipient, limit and minimum output are fixed by the contract.
- The Iora keeper scans all vaults every 30 seconds and quotes each open order on Soroswap.
- When your limit is met, it tries the full remaining amount. If the price impact is too high, it halves the piece, down to your minimum fill.
- The keeper pays the network fee for fills. There is no keeper fee on testnet.
- If the keeper is offline, orders simply wait. Your funds are unaffected and you can cancel and withdraw at any time.
Lend & Borrow
The app also has a Lend & Borrow page for using Blend directly, without a limit order. These positions are opened from your own wallet on the same Blend pool; Iora's vault contracts are not involved, and your vault and its orders are not affected.
- Supply
- Deposits an asset as collateral. It earns the supply rate and raises your borrowing power.
- Withdraw
- Takes collateral back, as long as what remains still covers your debt.
- Borrow
- Sends the asset to your wallet. Interest is added to your debt over time.
- Repay
- Pays debt back. Paying more than you owe is safe; Blend returns the extra in the same transaction.
- Health factor
- Your collateral times each asset's collateral factor, divided by your debt divided by each asset's liability factor, all valued with the pool's oracle prices. Below 1, part of your collateral can be liquidated.
Borrowing carries liquidation risk. Keep your health factor well above 1, especially when borrowing an asset whose price moves differently from your collateral.
Chat commands
The chat box in the app turns a sentence into an order form. It never signs anything; you always review and sign in your wallet. English and Turkish both work.
| buy 10 USDC of XLM if it drops to 0.15 | Prepares an order |
| buy XLM below 0.2 with 25 USDC for 3 days | Order with a duration |
| buy 5 USDC of XLM at 0.1, 2% max impact | Order with a price impact limit |
| how much do I earn lending 100 USDC for 30 days | Estimate from Blend's current supply rate |
| what does borrowing 500 XLM for 1 year cost | Estimate from Blend's current borrow rate |
| cancel #2 | Opens cancellation for order 2 |
| status | Open orders and available balance |
| interest | Total interest earned |
| price | Current XLM price on Soroswap |
Withdrawals, transfers and address changes are deliberately not possible through chat.
What the contract guarantees
- Deposits, withdrawals, orders and cancellations require the vault owner's signature.
- There is no admin key and no upgrade function. Nobody can change a deployed vault's code.
- XLM from a fill always goes to the vault owner. A keeper cannot redirect it.
- The minimum XLM output is computed on-chain from your limit and checked again after the swap. If it is not met, the whole transaction reverts and your USDC stays on Blend.
- The same balance cannot back two orders, or an order and a withdrawal.
- Swaps have a five-minute deadline, so a delayed transaction cannot execute at a stale price.
Risks
Using Iora means trusting its contracts and the protocols it is built on. Please read these before depositing.
- Blend pool risk
- All vaults supply to the same Blend pool. If a borrower's debt exceeds their collateral, for example after an oracle failure, the loss is covered first by Blend's backstop. If the backstop cannot cover it, the remaining bad debt is spread across lenders, which lowers the value of every deposit in that pool, including your vault's.
- Liquidity risk
- When most of the pool is borrowed, there may not be enough cash to withdraw or fill right away. High utilization pushes rates up, which usually brings cash back quickly.
- Smart contract risk
- All vaults run the same code, so a bug could affect every vault. The contracts have not yet been independently audited.
- Swap and price risk
- Fills use the Soroswap USDC/XLM pool. Your limit protects the price you pay, but a thin or manipulated pool can delay fills.
- Keeper risk
- If no keeper is running, orders do not fill. This never puts funds at risk.
- Phishing
- Always check the address bar and read what Freighter asks you to sign. Iora will never ask for your recovery phrase.
Emergency pause
The factory has a guardian address that can pause the system. Pausing stops new vaults and new orders only. Withdrawals, cancellations and fills of existing orders keep working, and the guardian has no way to move user funds.
Audits
The contracts have not been audited yet. They are covered by 31 automated tests, and a written threat model is kept in the repository. Iora will not launch on mainnet before an independent security audit is complete, and the report will be published here.
Contracts
Testnet deployments:
| Vault factory | CCCLYQPG2MSNUPAHL7J264UMXQDYUNR5QZWK23VWNOUCHZ32CFSPZUCN |
| Blend pool | CCEBVDYM32YNYCVNRXQKDFFPISJJCV557CDZEIRBEE4NCV4KHPQ44HGF |
| Soroswap router | CCJUD55AG6W5HAI5LRVNKAE5WDP5XGZBUDS5WNTIVDU7O264UZZE7BRD |
Factory
create_vault(owner) | Deploys a vault for owner; one per address |
vault_of(owner) | The owner's vault address, if any |
vault_count(), vaults(start, limit) | Enumerate vaults (used by keepers) |
is_paused() | Whether new vaults and orders are paused |
set_paused(bool), set_guardian(addr) | Guardian only |
Vault interface
deposit(amount) | Owner: supplies USDC to Blend |
withdraw(amount) | Owner: withdraws up to the available balance |
place_order(amount_in, limit_price, min_fill, max_impact_bps, expiry) → id | Owner: creates a buy order |
cancel_order(id) | Owner: cancels and releases the unfilled amount |
execute(id, fill_amount) → xlm_out | Anyone: fills an order or part of it |
balance, free_balance, reserved, deposited, stats, get_order, order_count, get_config | Read-only |
Units
- All amounts use 7 decimals (1 USDC = 10,000,000).
limit_priceis the maximum USDC per 1 XLM, also with 7 decimals: 0.20 USDC = 2,000,000.- Minimum output:
ceil(fill_amount × 10⁷ / limit_price)XLM. max_impact_bpsis 1 to 10,000; 10,000 disables the impact check.expiryis a Unix timestamp in seconds and must be in the future.
Events
deposited | amount |
withdrawn | amount |
order_placed (topic: id) | amount_in, limit_price |
order_cancelled (topic: id) | remaining |
order_filled (topic: id) | amount_in, amount_out |
Error codes
| 1 | InvalidAmount | Amount is zero or negative, or minimum fill is larger than the amount |
| 2 | InsufficientFree | Not enough available balance |
| 3 | OrderNotFound | No order with this id |
| 4 | OrderNotOpen | Order is already filled or cancelled |
| 5 | OrderExpired | Order duration has passed |
| 6 | FillTooSmall | Fill is below the minimum fill and is not the final remainder |
| 7 | FillTooLarge | Fill is larger than the unfilled amount |
| 8 | LimitNotMet | Swap returned less XLM than the limit requires |
| 9 | InvalidPrice | Limit price is zero or negative |
| 10 | PoolShortfall | Blend returned less USDC than requested |
| 11 | InvalidExpiry | Expiry is not in the future |
| 12 | BlendFormat | Unexpected data format from Blend |
| 13 | ImpactTooHigh | Fill would move the pool price more than allowed |
| 14 | InvalidImpact | Price impact limit is outside 1–10,000 bps |
| 15 | Paused | New orders are paused |
Integrating Iora
Iora is designed to be embedded. A wallet or DAO interface can create vaults through the factory and call the vault functions above directly; users sign in their own wallet and Iora never holds keys. Keepers are interchangeable, so an integrator can run its own. If you are interested in an integration, contact us through the beta form on the home page.
Fees
Iora charges no fee of its own at this stage. You pay only Stellar network fees. Measured on testnet:
| Open a vault | 0.043 XLM |
| First deposit | 0.055 XLM |
| Later deposits | 0.002 XLM |
| Place an order | 0.018 XLM |
| Cancel an order | 0.001 XLM |
| Fill an order | Paid by the keeper |
A small keeper fee may be introduced on mainnet. Any fee will be announced here before it applies.
FAQ
Does Iora hold my funds?
No. Your funds are in your own vault contract and, through it, on Blend. Neither Iora nor the keeper can withdraw them.
Why not use Stellar's built-in order book?
An order on the Stellar order book keeps your funds idle until it fills. With Iora, the amount waiting for your price earns interest on Blend.
Why hasn't my order filled?
The price may not have reached your limit, the order may have expired, or the pool may be too thin to fill within your price impact limit. The My orders table shows the status.
Can I lose money?
Yes. Blend bad debt, a contract bug or a phishing site could cause losses. See Risks. On testnet only test funds are used.
How much interest will I earn?
It depends on how much of the Blend pool is borrowed, and changes constantly. The Summary panel shows what you have earned.
What happens to an expired order?
It can no longer fill. Its unfilled amount stays reserved and keeps earning until you cancel it.
When will Iora launch on mainnet?
Not before an independent security audit is complete.
Glossary
- Blend
- A lending protocol on Stellar. Iora supplies your USDC to it to earn interest.
- Backstop
- Blend's insurance layer that absorbs bad debt before lenders do.
- Fill
- Spending part or all of an order's amount to buy XLM.
- Friendbot
- A testnet service that sends free test XLM.
- Guardian
- The address that can pause new vaults and orders. It cannot move funds.
- Keeper
- A bot that watches prices and calls
executewhen an order can fill. - Limit price
- The most USDC you will pay for 1 XLM.
- Price impact
- How much a trade moves a pool's price; larger trades in smaller pools move it more.
- Soroswap
- A decentralized exchange on Stellar used for the USDC to XLM swap.
- Trustline
- A one-time Stellar setting that lets your account hold an asset such as USDC.
- Utilization
- The share of a Blend pool that is currently borrowed.
Roadmap
- Testnet prototypeVaults, limit orders, keeper, app and docs. Built and tested.
- Testnet betaFirst 50 testers, keeper running on a server, feedback round.
- Independent auditSecurity review of the vault and factory contracts; report published.
- MainnetOnly after the audit is complete.
- Cross-chainKeep your money on Stellar and place orders to buy coins on other networks.
- PlannedSell orders and more pairs, chat assistant that prepares orders (you still sign), wallet and DAO integrations.
Sources for protocol behaviour: Blend lending docs, Blend bad debt management.