Treasury buybacks
Fund a bounded purchase, collect two administrator approvals and verify an actual token burn.
In this chapter
A separate, funded budget
Only the configured funding authority can add spendable cash through fund. Direct transfers are visible holdings but do not increase this budget. Funding creates no depositor shares, repayment right or token-holder earnings. Revenue must first be collected and classified separately from principal, backing and other obligations.
The module uses one reviewed funding asset and one buyback token. No percentage, recurring schedule or operating amount is selected by the implementation. Long/PONS liquidity and creator fees do not automatically arrive here.
Two approvals for each purchase
The first administrator approves exact calldata at the current governance nonce. The second executes the same order ID, adapter, input amount, minimum token output and deadline. A successful order ID cannot be reused. Either administrator can pause or disable an adapter; admission, upgrades and recovery use the shared approval policy.
Only an admitted adapter with the recorded runtime hash can execute. That hash alone cannot freeze an adapter proxy or its downstream venues. Production admission needs verified implementation and downstream behavior. No real execution venue is configured.
Spend and supply destruction
The module grants only the input amount to the adapter and clears that allowance after execution. It verifies the exact cash decrease and measures actual token output against the chosen minimum. It calls the token’s self-burn method and checks that total supply fell by precisely the received quantity, preserving any tokens already held.
A fake burn, dead-address transfer, unexpected supply change or unsupported transfer reverts the entire purchase, budget debit, order record and approval consumption. Local adversarial tests exercise these paths. Token-specific deployment behavior remains subject to review. A successful burn does not guarantee a higher market price.
Incident handling
Recovery freezes normal funding and purchases. Both administrators can approve removal of held assets. Recorded budget and cumulative counters remain reference accounting after recovery, even if the backing has moved. This is neither insurance nor immutable custody.