Mona: which anchor will hold?

What is Mona?

Anyone can claim a Stellar SEP-24 anchor is reliable. Mona measures it, on-chain, from evidence a wallet or user can't fake:

• Real mainnet reachability — does the anchor's live API actually answer a wallet today? Every live SEP-6/24 anchor on mainnet is discovered automatically and checked without moving funds.
• Real testnet behavior — does money actually move? A fresh wallet deposits with the anchor (SEP-24 or SEP-6) and, where the anchor offers SEP-6 withdrawals, withdraws back; every payment is checked on the ledger. Testnet anchors get the same read-only checks as mainnet ones first.
• Controlled reference anchors — a known-good and known-bad anchor, so the scoring math itself can be validated against ground truth.

Every mainnet anchor gets a score card computed from 30 days of those checks: four pillars (availability, speed, integrity, and, for anchors that issue their own fiat asset, how well it holds its peg), a separate confidence that says how much was measured, and hard gates that cap the score on an outage or a signing problem. The card is published on a Soroban contract with the SHA-256 of the inputs it was computed from, and the inputs are published, so anyone can recompute it. The method is in docs/SCORING.md. The contract publishes the verdict openly; it never slashes or moves anyone's stake. A live dashboard reads it from the chain.

Nothing here trades real assets. Mainnet is read-only. Testnet is where every write happens.

Who this is for

Who	The problem today	What Mona gives them
Wallets and payment apps routing a user's deposit or withdrawal	The anchor list in a wallet is hand-curated. When an anchor silently stops settling, the wallet finds out from its users	A machine-readable score per anchor, with the evidence behind it — so routing can prefer an anchor that is actually answering today
Users sending money home or cashing out	"Which anchor should I trust with my money?" is answered by hearsay	A public card per anchor: how available it was, how fast it settled, whether its peg held, and how much of that was actually measured
Anchor operators	Nothing distinguishes a well-run anchor from a dormant one that still publishes a stellar.toml	A neutral, reproducible record of uptime and settlement they can point at. No slashing: a measurement error never costs an operator money
SDF and ecosystem reviewers	Anchor health is assessed by hand, anchor by anchor	Continuous coverage of every live SEP-6/24 anchor on mainnet (103 on the day of writing, plus 2 testnet anchors and 4 controlled reference anchors), archived and recomputable

Why this scales. Mona does not need an anchor's permission or integration to measure it: everything it checks is public (stellar.toml, /info, SEP-10, deposit start). Discovery already found and tracks every live SEP-6/24 anchor on mainnet, so coverage grows with the ecosystem rather than with our sales effort. The score is a pure function of a published inputs bundle, so a wallet that does not trust us can recompute every card itself.

How it works

1. Three collectors independently observe anchor behavior and each emit a normalized { success, settlement_seconds, source_type } report.
2. aggregator dedupes those reports and calls PerformanceOracle.submit_report() on testnet, signed by a reporter key authorized for that source type.
3. PerformanceOracle keeps, per report, a weighted exponential moving average and an on-chain health record: a fast and a slow EMA whose gap gives the trend, a consecutive-failure counter, and a 20-report outcome window. After the reports, the aggregator computes each measured anchor's score card off-chain, on mainnet and on testnet alike, and publishes it with publish_score_card, together with the hash of its published inputs bundle; from then on the card is that anchor's headline and reports no longer overwrite it. The oracle flags an anchor at risk when 3 reports in a row fail, when fewer than half of the recent window succeeded, or when the headline reaches 55 (not judged while a card's confidence is under 40), and emits risk_status_changed on each transition.
4. AnchorRegistry is the source of truth for anchor identity, operator, staked collateral, and current score.
5. dashboard reads both contracts straight from Soroban RPC. Score history older than the public RPC's 7-day event window comes from history-archiver's durable archive, fetched server-side and merged in; without it the dashboard still renders, with a shorter chart.

Source type	Produced by	What "success" means
RealMainnet	services/mainnet-probe	The anchor's live stellar.toml, transfer server /info and SEP-10 challenge all answer, and a SEP-24 deposit can be started (then abandoned — no funds move). An anchor declining an anonymous wallet by policy still counts as reachable
RealTestnet	services/testnet-probe	The same read-only checks a mainnet anchor gets, then a real deposit (SEP-6 or SEP-24) and, where the anchor offers it over SEP-6, a real withdrawal, each payment verified on the ledger

以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗