Funding

Three ways USDC enters a confidential balance: the testnet faucet, the CCTP bridge through an employer-owned vault, and a deposit of classic USDC you already hold.

Funding turns public USDC into a spendable confidential balance. Confiroll supports three routes, chosen by the loaded deployment and by where your USDC already sits. All three end with the employer’s balance ready to pay from, and all three are fee-sponsored, so you can fund a zero-XLM account.

The deposited total is public by design: deposit takes the amount as a public i128 argument, and the confidential token records it. What stays hidden is the per-recipient split and every ongoing balance once you start paying. Funding is confidentiality applied to the splits, not to the totals.

Testnet faucet

The always-runnable path for testnet. Confiroll mints its own testnet USDC and deposits it into the employer’s confidential balance:

1. Trustline

   The employer adds a trustline to the testnet USDC asset.

2. Issue

   The issuer pays test USDC to the employer.

3. Deposit

   The employer deposits it into the confidential token (fee-sponsored).

4. Merge

   A merge makes the deposited funds spendable.

The API reads the issuer secret from a sealed environment variable, falling back to the local stellar CLI keystore only for dev. That means the faucet runs in a stock container with no stellar CLI dependency, one of the custody-model consequences that made the API self-contained.

CCTP bridge

For bringing canonical USDC across chains, Confiroll uses Circle’s CCTP (on testnet, from Base Sepolia) into an on-chain vault:

1. Burn on the source chain

   The CCTP burn tool burns USDC on Base Sepolia.

2. Attestation

   Circle attests the burn.

3. Mint into the vault

   The attested message mints USDC into Confiroll’s CctpVault contract.

4. Fund into the confidential balance

   The vault’s fund deposits the USDC into the employer’s confidential balance in one call, then a merge makes it spendable.

The bridge moves through a fixed sequence of stages. You can surface these to a user as a progress indicator:

Stage	What is happening	Where
Enter amount	You choose how much USDC to bridge.	Client
Burn	The burn tool burns that USDC on Base Sepolia.	Base Sepolia
Attesting	Circle observes the burn and produces an attestation.	Circle
Minting	mint_and_forward mints the USDC into the CctpVault.	Stellar testnet
Depositing	The vault’s fund deposits the USDC into the confidential balance.	Stellar testnet
Done	A merge makes the deposited funds spendable.	Stellar testnet

Deposit classic USDC

If you already hold the underlying USDC in a classic account (a trustline and a balance), you skip both the faucet and the bridge and deposit it straight into the confidential token:

1. Deposit

   Call the confidential token’s deposit with the amount as a public i128. This moves public USDC into your confidential balance (fee-sponsored).

2. Merge

   A merge folds the deposited funds into your spendable balance.

This route needs no issuer and no cross-chain burn. The deposited amount is public (it is a plain i128 argument), exactly as with the other two routes; the per-recipient split you later pay out is what stays hidden.

Both deposit and merge are fee-sponsored: the sponsor fee-bumps them the same way it fee-bumps a confidential_transfer, so funding costs the employer 0 XLM. See fee sponsorship for the CAP-15 fee-bump and its guard-rails.

The vault

Two of the three routes deposit through CctpVault, an employer-owned Soroban contract.

The vault is employer-owned. CctpVault is custodial to its owner by construction, and that owner is the employer (per ADR-006), never a Confiroll key. The vault exists because a contract can hold USDC through the asset contract with no trustline and no XLM reserve, whereas minting straight to a classic account would revert without a pre-provisioned trustline. The vault owner signs the fund call. See Soroban contracts for the vault’s functions and its nested-auth design.

fund does the bridge from public to confidential in a single call: it deposits vault-held USDC into the employer’s confidential balance, pre-authorizing exactly the nested asset transfer that the token’s deposit performs and nothing broader. The vault holds value; it holds no secrets, and only its owner can call fund or sweep.

The CCTP route requires funds to have actually been bridged (a real Base-Sepolia burn plus attestation). The self-issued faucet is the reproducible path that always works on testnet, and depositing classic USDC works whenever you already hold the underlying asset.

FAQ

Is the amount I fund hidden?

No. The deposited total is public by design: deposit takes the amount as a public i128, and a CCTP mint records a public transfer into the vault. Confidentiality applies to the per-recipient splits you pay out and to ongoing balances, not to the funded total. The withdrawn amount is public too. Only the split and the running balances are hidden.

Which route should I use?

Use the testnet faucet when you just want self-issued test USDC and a path that always works. Use the CCTP bridge when you hold canonical USDC on another chain (Base Sepolia on testnet) and want it on Stellar. Deposit classic USDC when you already hold the underlying asset in a Stellar classic account. All three end in the same confidential balance.

Do I need XLM to fund?

No. deposit, fund, and merge are all fee-sponsored through the CAP-15 fee-bump, so a zero-XLM account can fund a confidential balance. The employer’s XLM delta stays 0 and the sponsor pays the network fee. For the employer walkthrough, see funding your account.