Skip to main content
Wrapped tokens are an opt-in delivery mechanism for Stock Tokens — not a separate product. By default a spot buy delivers the real token; a wrapped token can only be delivered when the taker opts in to wrapped settlement (allowWrapped on the quote request, default false), and that choice is bound into the intent the taker signs. A wrapped token is an on-chain representation of a stock token — for example wTSLA stands in for TSLA. Once minted, it is held in your Arcus account and behaves like the underlying for display, but is non-transferable: it stays where it was delivered until the maker settles it to the real token, or until it is unwound and refunded if the maker misses the settlement deadline. This lets the exchange offer equity exposure without requiring the underlying asset to be on-chain at the moment of every trade.
This page describes the smart-contract architecture and trust model.

Factory and upgradeability

Each wrapped token is deployed by a WrappedTokenFactory as an upgradeable proxy. The proxy delegates to a shared upgrade beacon, which points at the current implementation (v1, v2, …). Upgrading the beacon migrates every wrapped token at once.
  • Upgrades are gated by a timelocked multisig — no single party can swap the implementation, and changes are visible during the timelock window.
  • Holders cannot transfer wrapped tokens: the token contract rejects transfers by holders, and only the escrow’s one-time delivery to the taker at mint moves them. This keeps wrapped tokens inside the exchange’s settlement perimeter (see Trading and product UX).

Minting: buying a stock

When a taker who has opted in to wrapped settlement buys a stock, a maker can supply the wrapped token, which is minted against the taker’s collateral. Both sides express the trade as a signed trade intent; an executor pairs them and hands the matched order to the Arcus Router. How each step works:
  • Executor receives both signed intents — the taker’s want-to-buy and the maker’s selling wTSLA — and forwards a matched order to the router.
  • Arcus Router executes an atomic swap, subject to satisfying both signed intents. It looks up the registered wrapped token for the underlying (TSLA → wTSLA) in the factory and accepts wTSLA as a substitute for TSLA. If no wrapped token applies, execution is delegated to downstream protocols (treated as a black box).
  • WrappedTokenEscrow verifies the maker (seller) is whitelisted to issue wrapped tokens, then mints the wrapped token and locks the token the taker sold in escrow — whatever that sell token was. Each mint is recorded as its own order with a settlement deadline.
Fungibility across makers. The escrow can support multiple makers, with wrapped tokens fungible regardless of which maker issued them. Each maker is trusted to settle its orders on time (see Settlement).

Trading and product UX

After minting, wrapped tokens give you the stock’s exposure inside the exchange — but stay within the settlement perimeter until the order is settled.
  • In the app, holding wTSLA looks like holding TSLA and shows the same exposure.
  • Wrapped tokens cannot be sold, transferred, or withdrawn while they await settlement — the token contract rejects holder transfers — so the app marks them as “awaiting settlement.” Once settled, you hold the real token and can trade it normally.

Settlement

Settlement is per order: each wrapped mint is settled individually before its settlement deadline.
  • To settle an order for, say, 400 wTSLA, the maker signs an authorization to deliver 400 real TSLA, and the maker or Arcus’s settlement operator submits it to the escrow.
  • The escrow pulls the TSLA from the maker, burns the taker’s 400 wTSLA, delivers 400 TSLA to the taker, and releases the locked sell token to the maker — no action is required from the wrapped-token holder.
Trust assumption. Makers may misbehave by not settling on time. If an order is still unsettled after its settlement deadline, the taker (or Arcus’s settlement operator) can unwind it: the wrapped tokens are burned and the locked sell token is refunded to the taker. The taker gets back what they paid but not the stock — so if the stock appreciated since the trade, the taker misses that gain. The design relies on whitelisted, trusted makers to settle on time.

Trust model at a glance