How It Works

Every Rampper trade has two sides: a maker who supplies USDC liquidity, and a taker who pays fiat to buy it. A single shared Soroban escrow contract holds the funds in between and releases them only under the trade’s own rules.

The trade flow

Maker posts liquidity

A maker opens a vault, deposits USDC, and publishes a rate config — their price versus the live market (a ±5% spread) plus the fiat methods they accept.

Taker signals an intent

A taker picks a quote and calls signal_intent. This locks the maker’s USDC in escrow and snapshots the rate, fee, and the maker’s payment-details hash, so mid-trade changes can never alter an in-flight trade.

Taker pays fiat

The taker sends the exact fiat amount through the maker’s local rail (e.g. GCash), then calls mark_paid to signal that payment is on the way.

Maker releases

Once the maker confirms the fiat landed in their account, they call release. The escrow sends the taker amount − fee; the fee collector gets the fee. Settlement is seconds, not days.

Fund-movement invariant. Escrowed funds move toward the taker only with maker or arbiter authorization, and back to the vault only with taker authorization or after an unpaid intent expires. Neither side — and not Rampper — can move funds any other way.

The intent state machine

An intent walks a small, well-defined set of states. The happy path is Signaled → Paid → Released; everything else is an explicit, authorized exit.

Key rules baked into the contract:

mark_paid works even after expiry, as long as the maker hasn’t reclaimed yet — this protects the taker who paid at minute 29 and clicked at minute 31. The race resolves via dispute.
A Paid intent can never be reclaimed by the maker.
Pause blocks new exposure (vaults, deposits, intents) but never blocks exits.

On-ramp, off-ramp, and any token

Rampper is symmetric. The same escrow powers buying crypto with fiat and selling crypto for fiat — only the direction of the fiat leg changes. And because everything settles in USDC, asking for a different token just adds an automatic on-chain swap:

Disputes

If a trade stalls — fiat sent but not released, or marked paid but never received — either party can open_dispute. A platform arbiter reviews the evidence and resolves only disputed intents (ResolvedToTaker pays the taker; ResolvedToMaker returns funds to the vault). The arbiter has no power over any non-disputed trade. See Core Concepts for the full role model.