> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tplus.cx/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> The onchain contracts that custody funds and define the protocol's listed assets and trust root.

Tplus custodies funds in onchain contracts. The offchain system moves them only by producing quorum-signed, nonce-bound, expiring approvals that the contracts verify (see the [trust model](/security/trust-model)).

| Contract                                            | Role                                                                                                                              |
| --------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| [Deposit Vault](/contracts/deposit-vault)           | Custodies all user funds. The only contract that moves them: deposits, settlements, withdrawals. One deployment per chain.        |
| [Registry](/contracts/registry)                     | Onchain source of listed assets, per-asset risk parameters, withdrawal-delay parameters, and the fee account.                     |
| [Credential Manager](/contracts/credential-manager) | Root of trust. Registers vaults, binds operators to attested keys, pins approved TEE code measurements, and timelocks governance. |

## Addresses

Contract addresses are not hardcoded. Read live values from the Registry endpoints:

| Data                           | Endpoint                        |
| ------------------------------ | ------------------------------- |
| Vault address per chain        | `GET /registry/vaults`          |
| Listed assets and deposit caps | `GET /registry/assets`          |
| Risk parameters                | `GET /registry/risk-parameters` |
| Token decimals                 | `POST /registry/decimals`       |

Vaults are deployed per supported chain; see [supported chains](/funds/deposits#chains-and-confirmation-times).

## Approval signing

Settlement and withdrawal approvals share one custom keccak256 scheme. A domain hash binds the vault address, chain, and schema version; a type tag identifies the approval schema; the digest is built with `keccak256(bytes.concat(...))` over fixed-width encoded fields and signed with secp256k1 ECDSA. This is not standard EIP-712: there is no `\x19\x01` envelope and no EIP-712 struct hash. Vaults verify signatures against registered keys.

| Approval   | Type hash                           |
| ---------- | ----------------------------------- |
| Settlement | `keccak256("SettlementApprovalV2")` |
| Withdrawal | `keccak256("WithdrawalApprovalV1")` |

Details: [trust model](/security/trust-model#signing-and-replay-protection).

## Nonces

Nonces are independent sequences per user, per chain, and per action type; settlement nonces are additionally per sub-account. The vault tracks each onchain counter:

| Action     | Counter                           |
| ---------- | --------------------------------- |
| Deposit    | `depositCounts(user)`             |
| Withdrawal | `withdrawalCounts(user)`          |
| Settlement | `settlementCounts(user, account)` |