Mutav Pulse

Mutav is an institutional guarantor (fiador institucional) for Brazilian rentals: instead of a personal co-signer or a multi-month deposit, Mutav backs your lease itself — provably, from a tokenized USDC reserve on Stellar whose solvency anyone can verify onchain.

PULSO Hackathon submission (Brazil track) · Stellar / Soroban · live on testnet Built by the mutav team — Draau (CEO) & Julia (CTO). Org: mutav-finance.

---

TL;DR for judges

• What: an onchain rental guarantor (institutional rental guarantor) for Brazil — a PoC of MUTAV, a decentralized rental-guarantee system.
• The Stellar integration is the product: every core operation (deposit, fee, default payout, yield allocation) is a Soroban contract call across a modular vault / policy / registry / strategy design. Frontend holds no keys.
• The hard technical thing: an onchain solvency invariant (stable_assets ≥ coverage_required) enforced re-entrancy-safely — the policy reduces coverage before the vault disburses, dodging a Soroban re-entrancy trap.
• Live on testnet: three reserves (MUSD · MTESOURO · MBRL) deployed + seeded; 135 contract unit tests + 28 frontend tests green. Contract addresses + verify links below.
• Yield: the adapter-defindex is live and load-bearing on the MUSD reserve — idle reserve capital flows into a real DeFindex vault (created via their testnet factory) and back, proven on-chain (proof of operation). That mock-asset vault holds cUSD idle (no Blend pool exists for it), so no external yield accrues yet, and the other two reserves still run a mock — wiring the real USDC Blend vault is the next step (see Roadmap).
• Customer discovery: real-estate agencies interviewed; four investor interviews completed.
• ▶️ Demo video: YouTube walkthrough · 🌐 Live demo: pulse.mutav.finance · 📊 Pitch deck: pulse.mutav.finance/deck

---

The problem

In Brazil, you cannot sign a lease without a rental guarantee (garantia locatícia) — it is mandatory by law. Every lease must be backed by one of a few legally-recognized forms: a personal guarantor (fiador), a deposit of up to three months' rent, seguro-fiança (guarantee insurance), or a título de capitalização (a capitalization bond). This locks up tenant capital, excludes the many renters with no wealthy guarantor to offer, and still leaves landlords exposed when a tenant defaults. And every one of these options is opaque: a landlord has no way to verify that the guarantee behind their lease is actually solvent.

Mutav is a fiador institucional — an institutional guarantor. Instead of forcing a tenant to find a personal fiador or lock up a multi-month deposit, Mutav provides the fiança itself: it stands as guarantor on the lease and pays the landlord if the tenant defaults. Fiança is one of the legally-recognized forms and the lightest to launch — unlike SUSEP-regulated seguro-fiança insurance, it needs no insurance license. It's the entry point; the model can expand into adjacent guarantee products later. The twist: Mutav's fiança is backed by an onchain, solvency-verifiable reserve — a landlord can confirm in real time that the guarantor behind their lease is solvent, which no personal fiador or opaque insurer can offer.

Mutav Pulse is a proof of concept of that decentralized guarantee system. It implements MUTAV's financial core on Stellar testnet: the tokenized reserve that backs the fiança, makes its solvency verifiable onchain, and pays out defaults — proving the guarantee can run transparently and trust-minimized, instead of on an opaque institutional balance sheet. Two surfaces sit on top: the MUTAV Reserve investor app and the MUTAV Protocol operator cockpit.

The solution

A reserve of USDC on Stellar — held by the vault contract — that is provably always able to cover the fianças Mutav has written:

• Tenants get a fiança from Mutav and pay a monthly fee — no personal guarantor, no large deposit. Real-estate agencies (imobiliárias) are the distribution channel that onboards them.
• Investors fund the reserve: they deposit USDC and receive MUSD vault shares (a tokenized position — each reserve mints a per-currency share; MUSD is the USD reserve). Their capital is what backs the fianças, and it earns yield.
• Mutav pays the landlord on a tenant default (cover_default) — one month of rent at a time, and stops paying out the moment a fiança falls behind on fees.
• The whole thing is solvency-gated: the invariant stable_assets ≥ coverage_required is enforced onchain on every payout and every redemption. Only surplus capital (free_capital = stable_assets − coverage_required) can ever leave the reserve — an onchain anti-bank-run guarantee.
• Idle reserve capital is allocated into a real DeFindex vault through a pluggable strategy allocator — live on the MUSD reserve today, with Soroswap / Blend designed against the same interface.

The proof is public. The /earn/transparency dashboard shows a live solvency chip, coverage metrics, and the full guarantee registry — and every number on screen links back to its onchain source. Nothing to take on trust.

Why "Pulse": the reserve runs on a constant pulse of liquidity — fees in, default payouts out, redemptions clearing from surplus — metered beat by beat through the redemption queue.

---

Stellar integration (where the protocol lives)

The integration is the product — every core operation is a Soroban contract call; the frontend holds no keys and signs nothing server-side.

Soroban smart contracts (contracts/, Rust)

A modular, single-responsibility design — custody, data, and the underwriting model are split by how often each is expected to change, so the monetary model can evolve without ever touching the contract that holds the money. Contracts are wired by setters at deploy time (bootstrap.sh), never constructor-baked, and every contract is upgradeable (admin-gated upgrade(wasm_hash)).

Contract	Responsibility
vault	Custody — USDC funds, tokenized per-currency shares (MUSD for the USD reserve; OpenZeppelin fungible token, virtual-offset anti-inflation), NAV, surplus-gated redemption queue, strategy allocator. SEP-0056 (Tokenized Vault Standard) surface — note withdraw/redeem are intentionally disabled in favor of the async redemption queue (a conformant "withdrawals-gated" configuration).
policy	Underwriting brain — fee model, coverage math, cover_default. Swappable without moving funds.
registry	Writer-gated typed store of guarantee records.
strategy (trait) + adapter-defindex	Yield venues. adapter-defindex integrates DeFindex, a Stellar DeFi yield protocol — invest deposits idle reserve into a DeFindex vault, balance values the position in real time, divest withdraws. Live and load-bearing on the MUSD reserve against a real DeFindex vault, with the full deposit→withdraw round-trip proven on-chain.
interfaces	Shared cross-contract client traits + the Guarantee type.

The safety spine (three onchain authority rules):

1. Money moves only through vault — disburse / collect_fee callable only by the registered policy.
2. Guarantee data is written only by policy — registry mutators are writer-gated.
3. Solvency is enforced at the vault — stable_assets ≥ coverage_required on every disburse and every redemption.

Technical depth worth noting:

• Re-entrancy-safe solvency — the policy reduces coverage in the registry before calling vault.disburse, so the vault never has to call back into a policy already on the stack (a Soroban re-entrancy trap). Exercised by the full-default-path test in contracts/policy/src/test_system.rs.
• Fees mint no shares — they accrue to NAV instead (test: contracts/vault/src/test.rs).
• Virtual-offset share token — an anti-inflation (donation-attack) defense on the MUSD share token, with a dedicated test.

Full protocol documentation — concepts, contract reference, the security model, and guides — lives in docs/. The build-evolution history is preserved in the git log.

Why this matters for Stellar: Mutav Pulse is a reusable, solvency-gated RWA vault primitive on Soroban — the first onchain fiança for Brazil's mandatory-guarantee rental market. It brings a real LATAM cash-flow use case onchain and contributes a SEP-0056-aligned, strategy-pluggable vault pattern other builders can fork.

Building blocks used (from the Stellar Integration List)

• Soroban smart contracts — the entire protocol.
• OpenZeppelin Stellar contracts — audited fungible-token base for the share token.
• Stellar Wallets Kit — wallet connection in the frontend (no injected keys).
• DeFindex — adapter-defindex live and load-bearing on the MUSD reserve against a real DeFindex vault (created via their testnet factory), with a deposit→withdraw round-trip proven on-chain. The mock-cUSD vault holds funds idle (no Blend pool), so real yield + the other two reserves are the next step (see Roadmap).

Frontend (frontend/, Next.js 16)

The MUTAV Reserve investor app (/earn deposit·redeem, /earn/transparency proof dashboard — which now also hosts the yield-venue directory) + the admin-gated MUTAV Protocol operator cockpit (/protocol). Stellar Wallets Kit for signing; typed bindings generated directly from the deployed contracts. See frontend/README.md.

---

Live on testnet

Deployed and wired on Stellar testnet (RPC https://soroban-testnet.stellar.org) — three reserves live: MUSD (USD · cUSD), MTESOURO (Brazilian treasury · cTSR), and MBRL (BRL-native · cBRL). Each is its own contract set (vault + policy + registry) and carries a synthetic demo state (for demonstration, not real traction); the primary MUSD reserve holds ~$305k with ~$144k coverage reserved behind its guarantee book.

Primary reserve (MUSD) below; the full address set for all three reserves + their assets is in docs/reference/deployments.md.

Contract	Address	Verify
vault	CA26WJGO5MINAT47DCGMU54HYW5A3RQ7VSE4ANPCYYA4TGXTJZQJ5EZQ	stellar.expert
policy	CBC2IJHH3FQMIQETFYDIEQG7OFJXTRKKLJDDONQ6N47AB3HLWWEIZQVO	stellar.expert
registry	CDJYJLUJL55SFD5YPSEKH6IZN3XRPLOCSFG33LDXOHEI2JY2ILITUSZ4	stellar.expert

The MUSD vault settles in the cUSD SAC CAWAVKYQ5AFSM3PVEZ4COPMBCOQDRCNB4LVGDOZ6GWX5ZK6OQJZTEDAH. The three deposit tokens (cUSD / cTSR / cBRL) are mock testnet assets issued by GA6LJT75ZRW3GWJ3NUQFBIL7CL66ITLT5BS35ZA7E7G35IOMGTSFJRIO.

Proof of operation — verify the protocol actually runs onchain, not just deployed.

1. The guarantee lifecycle (the protocol itself) — underwrite a fiança → collect the premium → pay out both coverage legs to a real landlord, live on the MBRL (cBRL) pilot reserve. Landlord GAEILCIV…R2LB received 3,000 cBRL across the two payouts:

Operation	What it proves	Transaction
sign_guarantee	underwrite a fiança (solvency-gated)	ff173e3c
pay_fee	premium collected → accrues to NAV	05bddeb1
cover_exit	property-recovery payout — 1,000 cBRL → landlord	18cfe2d0
cover_default	rent-arrears payout — 2,000 cBRL → landlord	5aa4b5bc

2. The yield integration (DeFindex) — the MUSD reserve routes idle capital through our audited adapter-defindex into a real DeFindex vault (created via DeFindex's testnet factory over our cUSD) and back:

Operation	What it proves	Transaction
create_defindex_vault	DeFindex factory creates our cUSD vault	66d249ad
rebalance	~454k cUSD allocated INTO the DeFindex vault	9402013f
process_redemptions	~95k cUSD divested back OUT of DeFindex	7fa65a91

Full operation list (deploy, wiring, async redemption, governance) and contract addresses: docs/reference/proof-of-operation.md.

🌐 Live demo: pulse.mutav.finance

---

Customer discovery

MUTAV is built directly against the two sides of the Brazilian rental market it serves:

• Real-estate agencies (imobiliárias) — across seven interviews, the complaint was consistent: today's guarantee providers are slow and opaque to claim against (payouts stretching to 60–90 days, line items contested to pay less, some exonerating themselves at any time, even going bankrupt). Because the agency sold the guarantee, the loss lands on it — almost all advance the rent to the owner and wait months for a reimbursement that rarely arrives in full. This is the gap MUTAV closes: a guarantor whose solvency is verifiable onchain, with transparent, rules-based payouts, instead of an opaque counterparty that delays, underpays, or walks away.
• Investors (DeFi / yield) — across four interviews the signal is clear: for real-world-backed yield, trust hinges on transparency of the backing and the team, not on the APY. The recurring frustration with RWAs is never being able to confirm whether the "real" is actually real. Investors judge a protocol by what they can check themselves (TVL, a doxxed team, and verified contracts), expect yield to stay realistic (three of four anchor it to risk/realism, treating an unexplained double-digit APY on a stablecoin as a red flag), and accept a lockup when the rationale is clear. This validates MUTAV's bet on onchain-verifiable solvency, makes the solvency gate and contract addresses something to surface rather than bury, and frames the surplus-gated redemption queue as solvency protection.

Full write-ups, methodology, and the investor interview guide are in docs/resources/customer-discovery.md.

---

Run it locally

# Contracts — test + build (use the Stellar CLI, NOT `cargo build --release`;
# soroban-sdk 26.1 spec-shaking needs the CLI)
cargo test            # 135 unit tests
stellar contract build

# Frontend
cd frontend
cp .env.example .env.local   # pre-filled with the live testnet contract IDs above
bun install
bun dev                       # → http://localhost:3000/earn

Redeploy + reseed from scratch: bootstrap.sh deploys + wires every contract; seed.sh restores the demo state. See the Quickstart and Deploying & wiring guides for detail.

Documentation

Full protocol docs are in docs/:

• Overview · Concepts (solvency, coverage, vault, yield) · Economic model
• Guides — quickstart, running locally, deploying & wiring
• Contract reference · Deployments · Errors
• Security model · Threat model · Testing & audits

Repository layout

contracts/        Soroban smart contracts (Rust workspace)
  vault/  policy/  registry/  interfaces/  strategy/
  adapter-defindex/   mock-strategy/  mock-policy/  mock-defindex/
frontend/         Next.js 16 investor app + /protocol operator cockpit
docs/             protocol documentation (overview, concepts, guides, reference, security)
model/            economic model (mutav_model.py) backing the docs economic-model page
PRODUCT.md        product brief: users, purpose, design principles

Stack

Soroban (soroban-sdk 26.1) · Rust · OpenZeppelin Stellar contracts · DeFindex · Stellar Wallets Kit · Next.js 16 · TypeScript · Bun · Tailwind v4 · Stellar CLI.

Team

• Draau — CEO · @draaujpeg
• Julia — CTO · @jubscodes · protocol, contracts, frontend

PULSO Hackathon · Brazil track · team of 2 (both based in Brazil 🇧🇷).

Roadmap & extensibility

The strategy allocator is a trait, so new yield venues plug in without touching custody:

• DeFindex (real yield) — adapter-defindex is already live and load-bearing on the MUSD reserve against a real DeFindex vault (proof), but that vault holds cUSD idle because no Blend pool exists for a mock asset. Next: stand up a reserve over real testnet USDC wired to DeFindex's USDC Blend vault so real yield flows into NAV, and extend the live adapter to the MTESOURO / MBRL reserves (which still run mocks).
• Soroswap / Blend — additional adapters against the same Strategy trait (listed as Planned in the venue directory on /earn/transparency); add a max_volatile_bps cap when the first volatile venue lands.
• Mainnet path — characterize and tune the DeFindex adapter's slippage floor (a conservative 0.5% default via max_slippage_bps): the live idle-vault round-trip cleared it, but fee/rounding behavior on a real yield-bearing Blend vault is not yet characterized, and an authorize_as_current_contract deposit-auth fix (surfaced only against the live vault) should be locked in with a no-mock-auth regression test before any mainnet deploy.

License

MIT © 2026 Mutav (mutav-finance).

---

Mutav Pulse is a hackathon proof of concept of MUTAV's decentralized guarantee system, on Stellar testnet — not coupled to mutav's audited production mutav-stellar Fund. Built to demonstrate the integration and the trust-minimized guarantee model.