DeFa By InvoiceMate

Demo

About

Payment service providers pay merchants out today and get paid by the corridor three to seven days later. Someone has to fund that gap on every transaction, and working capital — not demand — is what caps how much volume they can process. Today that gap is filled by bank credit: weeks to underwrite, priced against a balance sheet rather than the receivables actually securing it. DeFa is that facility rebuilt so the credit process is enforced by the contract instead of reported after the fact. A credit committee still underwrites — relationship manager, credit analysis, then risk — and the terms they approve become the pool's on-chain parameters. After that the borrower draws and repays on their own, inside a line that cannot be exceeded, at a finance charge the contract computes per second rather than per statement. Repaid principal revolves back into the available line until the facility matures. This is undercollateralised institutional credit, which is the part DeFi normally cannot do. The collateral is the receivable and the underwriting, not 150% of the loan in volatile tokens. What makes it safe is that every constraint the committee agreed to is checked on-chain at the moment money moves: the borrower wallet is fixed at facility creation and immutable, the payout receiver must be pre-authorised, the draw must fit inside the committed line, and a repayment waterfall pays principal before protocol fees before lender yield. Lenders deposit USDC into risk-tiered facilities, earn yield accrued on dollar-seconds held rather than on a balance snapshot, and claim principal and yield separately. Everything is live on Arc testnet today: contracts, subgraph, risk agent and both portals.

How it's made

Contracts are Foundry/Solidity on Arc testnet (chain 5042002). A PoolFactory deploys one EIP-1167 clone per facility, so each credit line is its own contract with its own terms, borrower and balance. Settlement is in native USDC — on Arc, USDC is the gas token, so a facility is funded, drawn, repaid and priced in the same unit the borrower already settles in, with no bridge and no second token to hold. The backend is Node/Express/Mongoose. It never custodies funds and never signs a user transaction: the API returns calldata and the browser wallet signs it. The one privileged action the server performs is executing drawdowns under AGENT2_ROLE, and even there the contract constrains it — the receiver must already be authorised and the amount must fit availableToDd. The Graph is the read layer. A Subgraph indexes both factories and, by template, every pool clone they deploy — deposits and withdrawals in the ERC-4626 event shape, drawdowns, repayments with their finance charge, and lender claims. The schema is built on the ERC-4626 standard rather than a bespoke shape, so a credit facility is legible to any tool that already reads vaults. On top of it sits a risk agent that reasons over live facility state and flags what a human should look at: drawdowns past grace accruing uncapped penalties, facilities approaching finality with debt outstanding, single-borrower concentration. It has no RPC client and no database — if the Subgraph is down it has nothing to reason about. Cross-facility questions cost one RPC call per pool per field, enough to trip the node's rate limiter, which is exactly what pushed us to make The Graph load-bearing rather than decorative. Privy holds the agent signing key. It was a private key in an environment variable — anything that could read the environment could move lender capital. It is now a Privy server wallet whose key lives in their enclave, governed by a policy that denies any transaction carrying native value. On Arc that is precise rather than cosmetic: USDC is the native token, so value is money leaving the wallet, while every legitimate agent action is a zero-value contract call. Arc is not in Privy's supported-chain list, so we sign with eth_signTransaction (which accepts an arbitrary chain id) and broadcast through our own Arc RPC. Notably hacky: we run a second, byte-identical factory built with SECONDS_PER_DAY = 60, so a 30-day facility completes in half an hour. It made a lifecycle that takes a month testable in a sitting — and the Subgraph indexes both, because indexing only the production factory produced an index that was correct and completely empty.