{
  "markdown": "# FlashBank\n\nNon-custodial, on-chain lending where **your funds stay in your wallet until the moment they're used**.\nFlashBank is two complementary products that share that principle:\n\n| Product | What it is | Contract | Page |\n| --- | --- | --- | --- |\n| **Flash Loans** | Atomic, same-transaction liquidity for arbitrage, liquidations and MEV. Lenders approve and commit WETH from their own wallet — no deposits — and earn a fee on every loan. | [`flashloans/`](flashloans) · [`FlashBankRouter.sol`](flashloans/contracts/FlashBankRouter.sol) | [`/`](https://flashbank.net) |\n| **P2P Term Loans** | Fixed-term, collateral-backed loans agreed directly between two people. One flat fee instead of interest, settled purely on time — no pools, no price oracle, no liquidations to watch. | [`loans/`](loans) · [`FlashBankP2PLoan.sol`](loans/contracts/FlashBankP2PLoan.sol) | [`/p2p`](https://flashbank.net/p2p) |\n\n> **Branding rule:** \"flashbank\" is only ever used as a **verb** (you *flashbank* a loan). FlashBank is\n> not a bank, does not hold deposits and takes no custody as a financial institution.\n\nWebsite: **[flashbank.net](https://flashbank.net)** · Source: **[github.com/Rotwang9000/flashbank-net](https://github.com/Rotwang9000/flashbank-net)**\n\n---\n\n## Flash Loans (the Router)\n\n`FlashBankRouter` is a multi-provider flash-loan pool where liquidity providers keep custody:\n\n- **No deposits.** Providers approve the router and call `setCommitment(token, limit, expiry, paused)`. WETH stays in their wallet and is only pulled for the microseconds of a flash loan.\n- **Atomic or nothing.** The borrower implements `IL2FlashLoan` and must repay `principal + fee` in the same transaction, or the whole thing reverts.\n- **Configurable, bounded fees.** Per-token `feeBps` (1–100 bps) with a separate owner cut (`ownerFeeBps`) and a per-tx max-borrow share of the pool (`maxBorrowBps`).\n- **Dual-control admin.** Sensitive changes (token config, ownership, profit withdrawal) use a propose-then-execute flow split between the `owner` and a separate `admin`. See [docs/security/DUAL_CONTROL.md](docs/security/DUAL_CONTROL.md).\n\nProvider flow (WETH):\n\n```js\nawait weth.deposit({ value: ethers.parseEther(\"5\") });        // wrap ETH (stays in your wallet)\nawait weth.approve(routerAddress, ethers.MaxUint256);         // approve once\nawait router.setCommitment(wethAddress, ethers.parseEther(\"3\"), 0, false); // lend up to 3 WETH\n// pause/resume any time — just flip the paused flag or drop the limit to 0\n```\n\nBorrower flow (MEV / arbitrage bots):\n\n```js\nawait router.flashLoan(\n  wethAddress,\n  ethers.parseEther(\"100\"),\n  true,            // receive native ETH (router unwraps WETH for you)\n  strategyCalldata // forwarded to IL2FlashLoan.executeFlashLoan\n);\n```\n\nLives in [`flashloans/`](flashloans). Deploy with `cd flashloans && npx hardhat run scripts/deploy-router.js --network <network>`\n(set `ADMIN_ADDRESS` / `TESTNET_ADMIN_ADDRESS` in the repository-root `.env`). Per-network addresses are read\nfrom `NEXT_PUBLIC_*` env vars by the website.\n\n---\n\n## P2P Term Loans\n\n`FlashBankP2PLoan` is a neutral escrow that lets two parties flashbank a fixed-term, collateral-backed loan:\n\n- **Time-only settlement.** Repay `principal + a flat fee` before `maturity + grace`, or the lender claims the collateral. Nothing is priced on-chain, so **no oracle is needed**.\n- **Optional surplus return (no oracle).** An offer can set an **agreed rate** (stored as `settlementValue` — how much principal the whole collateral is taken to be worth, frozen at origination); on default the borrower then recovers any collateral beyond `principal + fee`. Leave it `0` for a pure pledge/forfeit. This honours [Lorrow](https://whysideas.github.io/lorrow/)'s surplus-return guardrail without an oracle — see [`docs/design/LORROW_COMPATIBILITY.md`](docs/design/LORROW_COMPATIBILITY.md).\n- **Editable offers, front-running-safe.** While an offer is open the creator can re-price or amend its non-escrow terms in place (`updateOffer`) and top up featured placement (`boostOffer`) without forfeiting the existing boost. Each edit bumps a `version`; a taker can call `takeChecked(id, version)` to pin the exact terms they reviewed.\n- **Flat fee, not interest.** A single fixed fee rather than time-accruing interest — more compatible with faith-based finance that avoids *riba* (this is **not** a Sharia-certification claim).\n- **Three optional, default-off fees:**\n  - an opt-in **interface fee** (lender-paid, only on offers posted through flashbank; **0% introductory**),\n  - an optional **boost** that buys featured marketplace placement ranked by spend (an advert, not interest — non-refundable),\n  - a per-offer **service fee** to any address (insurance / third party).\n  Go direct on the contract and it is **zero commission**.\n- **Tokens are just ERC-20s.** On mainnet/L2 the escrow uses real assets (WETH, USDC, …). On the testnet playground, `fpETH`/`fpUSD` are free faucet tokens with no value.\n\nLives in [`loans/`](loans). Full design: [docs/design/P2P_LENDING_DESIGN.md](docs/design/P2P_LENDING_DESIGN.md).\n\n### Live on mainnet (Ethereum + Base)\n\n`FlashBankP2PLoan` is deployed and **verified** on mainnet — judged solid by the [self-audit](https://flashbank.net/audit)\nand shipped while ETH gas was cheap. Same bytecode on each chain; `Ownable`, fee recipient = Vultisig vault,\n**0 bps introductory** (a listing fee only ever applies to offers that opt in via `listed`, hard-capped on-chain at 1%).\n**No external audit — use real assets at your own risk.**\n\n| Chain | `FlashBankP2PLoan` (verified) |\n| --- | --- |\n| Ethereum | [`0x131C…18A0`](https://etherscan.io/address/0x131C8545b28bca9063B364380956Df33A70018A0#code) |\n| Base | [`0x86Fb…FcbB`](https://basescan.org/address/0x86FbF8e03f8A6f3eF52062E3f81627F64aa5FcbB#code) |\n\nThe mainnet UI uses real WETH/USDC. (Arbitrum pending — deployer balance too thin to deploy yet; add later\nwith `MAX_FEE_GWEI` pinned low.) Per-chain records in `loans/deployments/*-p2p.json`.\n\n**Mainnet interface is restricted to ETH and USDC for now** — custom-token entry is testnet-only — so the\nfront end never invites an unknown/fake token (the contract itself stays permissionless for anyone calling\nit directly).\n\n**v2 — live on the Sepolia playground.** [`FlashBankP2PLoanV2`](loans/contracts/FlashBankP2PLoanV2.sol)\nadds on-chain token sanity-validation, a **graduated cooling-off rebate** (the flat fee vests from a 10%\nfloor so a near-instant return is cheap — killing fake-token fee-farming — while consuming a listing is\nnever free, and a same-block guard stops free flash loans), and **pull-payout fallbacks** so a\nblocklisted recipient can never brick the other party's repayment or default claim. Adversarially\nreviewed, unit-tested (22 cases) and **deployed to Sepolia** (verified, seeded) where it has passed a\nlive two-agent lifecycle drill; mainnets stay on v1 until it graduates. Full pitfall analysis in\n[docs/design/P2P_V2_COOLING_OFF.md](docs/design/P2P_V2_COOLING_OFF.md).\n\n### Live on Sepolia (playground — testnet only, no real value)\n\nA self-serve playground is deployed on **Sepolia** so anyone can try the whole flow end-to-end — it\nruns the **v2 escrow**, so the cooling-off rebate and pull-payouts are live there first. All source\nis **verified on Etherscan**; only key material stays in the untracked `.env`. **Unaudited demo —\nnever send real assets.**\n\n| Contract | Address (verified) |\n| --- | --- |\n| `FlashBankP2PLoanV2` (cooling-off rebate + token checks + pull-payouts) | [`0x536f…1E76`](https://sepolia.etherscan.io/address/0x536f4C17C18854943a45841Fef4b3054ED281E76#code) |\n| `PlaygroundToken` fpUSD (6d) | [`0x4aBb…760c`](https://sepolia.etherscan.io/address/0x4aBb056aA5aB39b55039ACAf795Ff9403Fa9760c#code) |\n| `PlaygroundToken` fpETH (18d) | [`0xB9CC…96F5`](https://sepolia.etherscan.io/address/0xB9CCa9CfE38e583CF1cf456F03946ac6376396F5#code) |\n\nTry it: open [`/p2p`](https://flashbank.net/p2p) (defaults to Ethereum mainnet), switch to Sepolia, hit the\nfaucet to mint test tokens, then post or take an offer (a few offers are pre-seeded, including boosted\nones to show ranking and one with a creator-set 2-day cooling window). Redeploy with\n`cd loans && npx hardhat run scripts/deploy-playground-v2.js --network sepolia`\n(addresses recorded in `loans/deployments/sepolia-playground-v2.json`; the retired v1 playground\n`0x3Ce4…1017` stays on-chain).\n\n---\n\n## For AI agents (MCP)\n\n[![npm](https://img.shields.io/npm/v/%40flashbank%2Fmcp?label=%40flashbank%2Fmcp)](https://www.npmjs.com/package/@flashbank/mcp)\n[![MCP Registry](https://img.shields.io/badge/MCP_Registry-io.github.Rotwang9000%2Fflashbank-8A2BE2)](https://registry.modelcontextprotocol.io/v0/servers?search=flashbank)\n[![Listed on Glama](https://img.shields.io/badge/Glama-flashbank-blue)](https://glama.ai/mcp/servers/Rotwang9000/flashbank-net)\n\n```bash\nnpx -y @flashbank/mcp     # zero-config read-only MCP server, any MCP client\n```\n\nThe repo ships a self-contained **Model Context Protocol server** ([`mcp/`](mcp), published as\n[`@flashbank/mcp`](https://www.npmjs.com/package/@flashbank/mcp), listed in the [official MCP\nRegistry](https://registry.modelcontextprotocol.io/v0/servers?search=flashbank) and on\n[Glama](https://glama.ai/mcp/servers/Rotwang9000/flashbank-net)) so agents can\nflashbank too: browse open P2P offers, get quotes, check flash-loan liquidity and fees — and, with\nan explicitly configured throwaway key, post/take/repay loans and use the Sepolia faucet. Reads need\nno configuration; **mainnet writes are double-gated** behind `FLASHBANK_MCP_PRIVATE_KEY` *and*\n`FLASHBANK_MCP_ALLOW_MAINNET=true`. Takes always pin the exact reviewed terms on-chain, and on v2\nchains the tools quote vested fees and report cooling-off rebates. The whole lifecycle is proven by\na **live two-agent drill** (`npm run drill`) that walks faucet → create → take → early repay (rebate\nverified) → cancel through two real MCP server instances on Sepolia. Details and the tool catalogue:\n[`mcp/README.md`](mcp/README.md).\n\n---\n\n## Repository layout\n\nEach feature is a **self-contained Hardhat project**. The two never import each other's Solidity,\nso you can fork this repo, delete the feature you don't want, and the other still compiles, tests\nand deploys.\n\n```\nflashloans/           Flash-loan router feature — own contracts/, test/, scripts/, test-scripts/, hardhat.config.js\nloans/                P2P term-loan feature — own contracts/, test/, scripts/, deployments/, hardhat.config.js\ncommon/               Shared toolchain (hardhat.base.js) inherited by both features — do not delete\nwebsite/              Next.js front end (static export, deployed to flashbank.net) — showcases both features\nmcp/                  Model Context Protocol server so AI agents can browse/quote/transact (see mcp/README.md)\ndocs/                 Documentation (see docs/README.md) — architecture, security, deployment, design\npackage.json          Thin root: installs the shared dependencies and runs both features' scripts\n```\n\n**Want only one feature?** Delete the other top-level directory:\n\n```bash\nrm -rf flashloans   # keep just the P2P term loans\n# ...or...\nrm -rf loans        # keep just the flash-loan router\n```\n\n`common/` is shared by both and must stay. The `website/` is a combined shopfront; if you drop a\nfeature, also remove its page (`website/src/pages/index.tsx` for flash loans,\n`website/src/pages/p2p.tsx` for P2P) and its link in `website/src/components/Nav.tsx`.\n\n> A previous deposit-based design, `FlashBankRevolutionary`, predates the no-deposit Router. Its\n> contracts and notes live under `flashloans/` for historical context; the Router and P2P escrow are\n> the current products.\n\n---\n\n## Quick start\n\n```bash\nnpm install            # installs the shared toolchain both features build against\nnpm run compile        # compile both features\nnpm test               # run both features' test suites\n\n# work inside a single feature\ncd flashloans && npx hardhat test\ncd loans && npx hardhat test\n\n# website\nnpm run website:dev    # local dev server on http://localhost:3000\nnpm run website:build  # static export\n```\n\nDependencies are installed once at the repository root; each feature resolves Hardhat, the plugins\nand OpenZeppelin from there, so there is no per-feature `npm install`.\n\n### Tests\n\nThe Solidity suites cover the router (flash-loan flow, owner-fee accrual, dual control, validation) and\nthe P2P escrow (lifecycle, time-based default, the three-tier fee model and boost, reentrancy, plus a\nrandomised fund-conservation fuzz test).\n\n```bash\nnpm test                            # both features\nnpm run test:flashloans             # router suite only\nnpm run test:loans                  # P2P suite only\n```\n\n---\n\n## Documentation\n\nBrowse [`docs/`](docs/README.md) for the full set:\n\n- **Architecture** — [overview](docs/architecture/ARCHITECTURE.md), [pool mechanics](docs/architecture/POOL_MECHANICS.md), [gas analysis](docs/architecture/GAS_ANALYSIS.md)\n- **P2P design** — [P2P_LENDING_DESIGN.md](docs/design/P2P_LENDING_DESIGN.md), [Lorrow compatibility](docs/design/LORROW_COMPATIBILITY.md)\n- **Security** — the live [honest audit page](https://flashbank.net/audit) (both features, candid: trust assumptions, what's tested, known limits), plus [router audit notes](docs/security/SECURITY_AUDIT.md), [reentrancy analysis](docs/security/REENTRANCY_ANALYSIS.md), [dual-control runbook](docs/security/DUAL_CONTROL.md)\n- **Deployment** — [guide](docs/deployment/DEPLOYMENT.md), [website](docs/deployment/WEBSITE_DEPLOYMENT.md), [live networks](docs/deployment/LIVE_NETWORKS.md)\n\nVulnerability disclosure: [SECURITY.md](SECURITY.md) · Contributing: [CONTRIBUTING.md](CONTRIBUTING.md) ·\nChanges: [CHANGELOG.md](CHANGELOG.md)\n\n---\n\n## Disclaimers\n\nExperimental, unaudited DeFi software. Smart contracts can have bugs; collateral values can move during a\nloan term; flash-loan profitability depends on market opportunities. Use at your own risk and do your own\nresearch.\n\n## License\n\n[MIT](LICENSE).\n",
  "bytes": 14048,
  "sha": "e521d86fd8b73fe0470ba64953cc47ec4c25230836588c59a13f2c95a8b5e2a0",
  "repo_slug": "rotwang9000/flashbank-net",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_rotwang9000_flashbank_124f4fa6/readme"
}