Private credit for tokenized assets, explained.

Overview

Bezalt is a private credit layer. A borrower proves that a tokenized asset is owned, valued, eligible and unencumbered; the protocol then opens a USDG credit line against it. The asset is held in the protocol's escrow for the life of the line and returned in full on close, the loan carries a fixed one-time fee rather than a running interest rate, and the proof that made the loan possible can be reused across draws and venues.

How it works

A credit line moves through five states. Each transition is recorded on-chain as an attestation; the underlying holdings are never published.

1. Verify

   The borrower connects a wallet or custodial account. Bezalt runs four private checks: ownership of the tokenized asset, its current valuation from an accepted oracle, its eligibility under protocol parameters, and any existing liabilities against it.

2. Issue a passport

   Passing checks produce a collateral passport: a signed, time-bounded proof that a position is eligible for a stated borrowing capacity. The passport contains eligibility signals only.

3. Draw

   The borrower opens a credit line and draws USDG up to the passport's capacity. The origination fee is deducted at draw time. No further charges accrue.

4. Maintain

   Valuation and liability checks refresh on a schedule. If collateral falls below the maintenance threshold, the position becomes eligible for liquidation by the stability pool.

5. Repay and release

   Repaying the drawn USDG releases the pledge. The passport remains valid until it expires and can back a new line without repeating full verification.

Eligible collateral

Bezalt accepts tokenized assets whose issuer, transfer rules and price feeds satisfy the protocol's eligibility parameters. Collateral classes are configured with a maximum loan-to-value ratio, a maintenance threshold and an origination fee.

Loan-to-value is applied to the accepted value, which may be haircut from market value for thinly traded assets. Each class lists the oracles and attestation providers it accepts. To see these parameters applied to a position, open the terminal.

Fixed fees

Bezalt does not charge interest. A credit line costs a fixed origination fee, quoted as a percentage of the amount drawn and settled once, at draw time. Fees are set per collateral class and published before the borrower commits.

Because nothing accrues, the cost of a position does not depend on how long it stays open. Borrowers who need short-term liquidity pay the same fee as those who hold a line for a year. Fee revenue flows to the stability pool and to the protocol treasury according to the published split.

Fee routing and the BEZALT buyback

Every origination fee is split in the transaction that charges it. CreditLine.draw computes fee = amount × originationFeeBps / 10 000, retains fee × poolFeeShareBps / 10 000 in the stability pool as depositor income and transfers the remainder to treasury. There is no intermediate balance, no claim step and no discretion over the split at run time; both parameters are set by the risk admin through the 48 h timelock.

The treasury's share funds a programmatic buyback of BEZALT (ticker $BEZALT), the protocol token. The buyback is a separate, non-upgradeable contract, BuybackRouter, whose only inputs are the USDG it receives from the treasury and a set of bounded parameters:

What the buyback does not do. It never touches the stability pool's share of the fee, it holds no BEZALT between executions, it cannot sell, and it has no admin path that moves USDG anywhere except the allow-listed venue. Pool depositors' income is unaffected by whether a buyback runs.

Stability pool

The stability pool is the protocol's source of liquidity and its liquidation backstop. Participants deposit USDG and receive a proportional claim on pool outcomes. Returns are outcome-based rather than time-based: the pool earns when something happens, not while time passes.

Deposits can be withdrawn subject to the pool's liquidity schedule, which is designed so that a withdrawal never leaves an open liquidation unfunded. Participants take on the risk that liquidated collateral is worth less than the debt repaid; the discount and maintenance thresholds exist to keep that outcome rare.

Private verification

Bezalt separates what must be true from what must be seen. A lending venue needs to know that a position is eligible for a stated capacity. It does not need the position's contents. The verification layer produces the first without revealing the second.

Checks are performed against signed data from issuers, custodians and oracles, and the verifier discards inputs once the attestation is produced. The published attestation carries an expiry so that stale proofs cannot be reused indefinitely.

Collateral passport

A passport is the portable form of a verification result. It binds an eligibility outcome and a capacity bound to a borrower key, with an expiry and the identifiers of the checks that produced it. Any integrated venue can verify a passport without contacting the original verifier and without learning what was checked.

• Reusable. One passport can back lines at several venues until it expires, as long as total draws stay within capacity.
• Cross-chain. Attestations are chain-agnostic; a passport issued against assets on one network can be presented on another.
• Revocable. A failed refresh check revokes the passport, and every venue that relies on it sees the revocation.
• Minimal. The passport holds eligibility signals and a capacity bound. It never holds holdings.

Contracts

Six non-upgradeable contracts, Solidity 0.8.28 on OpenZeppelin 5.4. Source, tests and deployment scripts live in contracts/ of the repository.

CreditLine

Events: PositionOpened, CollateralAdded, CollateralWithdrawn, Drawn(id, amount, fee, passportId), Repaid, PositionClosed, Liquidated(id, liquidator, debt, seized, toPool, toKeeper, returned).

StabilityPool (ERC-4626)

Registries and oracles

Roles & governance

Administration is split into narrow roles held by different keys. The default admin of every contract is a TimelockController (48-hour minimum delay enforced by the deployment script on mainnet); the governor multisig proposes through it and directly holds the risk-parameter role. The deployer renounces its admin role at the end of deployment, and the dry run asserts it on-chain.

Integration guide

Verify a passport off-chain

A passport is EIP-712 typed data under the domain { name: "Bezalt Passport", version: "1", chainId, verifyingContract: PassportRegistry }. Any library that implements signTypedData / verifyTypedData can check one; the on-chain verify adds the role, window and revocation checks.

Open a line from a front-end

Run a keeper

Index PositionOpened / Drawn / Repaid to maintain the set of open positions; poll isLiquidatable(id) (or compute from ltvBps and the class maintenance); call previewLiquidation(id) to size the keeper fee against gas; send liquidate(id). Liquidations revert when the oracle is stale or when the guardian has paused them; check liquidationsPaused() first.

Units

• Prices and values: USD with 18 decimals (1e18 = $1).
• Debt and pool amounts: the debt asset's decimals (USDG: 6).
• Collateral: the token's own decimals (read at listing).
• Ratios: basis points out of 10 000.

Security

• Reentrancy guards on every state-changing entry point; events emitted before external calls.
• All arithmetic via Math.mulDiv; LTV checks cross-multiplied; rounding favours the protocol.
• Parameter bounds enforced on-chain, including (1 + bonus)(1 − keeper) ≥ 1.
• Fee-on-transfer tokens rejected; no delegatecall, no proxies, no selfdestruct.
• ERC-4626 virtual-share offset (6 decimals) against inflation attacks.
• Signature malleability rejected; EIP-712 domains separated per contract.

Ecosystem

Bezalt is built to sit underneath other financial surfaces. The same verification and credit primitives are exposed to three kinds of integrator.

The logos shown on the home page illustrate the categories of venue Bezalt is designed to work with. They do not indicate partnerships or endorsements. For common questions from each audience see the FAQ.

Glossary

Accepted value

Oracle value of collateral after any class haircut; the base for LTV. Reported in USD with 18 decimals.

Attester

The key (role) that signs collateral passports after private verification.

Capacity

The maximum outstanding debt a passport authorises, cumulative across draws and positions.

Collateral passport

EIP-712 attestation of eligibility and capacity for a borrower–asset pair, with an expiry and a commitment to the checks performed.

Keeper

Any account that triggers a liquidation; paid a share of the seized collateral.

LTV

Loan-to-value: debt divided by accepted collateral value, in basis points.

Maintenance

The LTV at or above which a position may be liquidated.

Origination fee

The one-time fee charged on each draw; the only cost of a credit line.

Reserve

The fraction of pool assets kept unlent so withdrawals can be served.

Seized collateral

Collateral the pool received in a liquidation, marked at oracle value and sold at a discount.

Stability pool

The ERC-4626 vault that lends principal and absorbs liquidations.

Timelock

The contract that holds admin rights and delays every governance action by at least 48 hours on mainnet.

Disclosures

This documentation describes protocol mechanics for informational purposes. Numeric parameters shown on this page are examples used to explain the mechanism; live values are published per collateral class by the protocol. Nothing here is financial, legal or tax advice. Borrowing against volatile collateral carries the risk of liquidation, and stability-pool deposits carry the risk of receiving collateral worth less than the debt it repays. The contracts have not been audited by a third party. Third-party names and logos identify categories of compatible venue and do not imply partnership or endorsement.