> ## Documentation Index
> Fetch the complete documentation index at: https://docs.confiroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Funding

> Three ways USDC enters a confidential balance: the testnet faucet, the CCTP bridge through an employer-owned vault, and a deposit of classic USDC you already hold.

Funding turns public USDC into a spendable **confidential** balance. Confiroll supports three
routes, chosen by the loaded deployment and by where your USDC already sits. All three end with
the employer's balance ready to pay from, and all three are fee-sponsored, so you can fund a
zero-XLM account.

<Info>
  The **deposited total is public by design**: `deposit` takes the amount as a public `i128`
  argument, and the confidential token records it. What stays hidden is the per-recipient split
  and every ongoing balance once you start paying. Funding is confidentiality applied to the
  splits, not to the totals.
</Info>

<Tabs>
  <Tab title="Testnet faucet">
    The always-runnable path for testnet. Confiroll mints its own testnet USDC and deposits it
    into the employer's confidential balance:

    <Steps>
      <Step title="Trustline">
        The employer adds a trustline to the testnet USDC asset.
      </Step>

      <Step title="Issue">
        The issuer pays test USDC to the employer.
      </Step>

      <Step title="Deposit">
        The employer deposits it into the confidential token (fee-sponsored).
      </Step>

      <Step title="Merge">
        A merge makes the deposited funds spendable.
      </Step>
    </Steps>

    The API reads the issuer secret from a sealed environment variable, falling back to the
    local `stellar` CLI keystore only for dev. That means the faucet runs in a stock container
    with **no `stellar` CLI dependency**, one of the custody-model consequences that made the
    API self-contained.
  </Tab>

  <Tab title="CCTP bridge">
    For bringing canonical USDC across chains, Confiroll uses Circle's **CCTP** (on testnet,
    from Base Sepolia) into an on-chain **vault**:

    ```mermaid theme={"system"}
    flowchart LR
        A[USDC on source chain<br/>Base Sepolia] -->|burn| B[Circle attestation]
        B -->|mint_and_forward| C[CctpVault<br/>C-address, employer-owned]
        C -->|fund then deposit| D[Employer confidential balance]
        D -->|merge| E[Spendable]
    ```

    <Steps>
      <Step title="Burn on the source chain">
        The CCTP burn tool burns USDC on Base Sepolia.
      </Step>

      <Step title="Attestation">
        Circle attests the burn.
      </Step>

      <Step title="Mint into the vault">
        The attested message mints USDC into Confiroll's `CctpVault` contract.
      </Step>

      <Step title="Fund into the confidential balance">
        The vault's <code>fund</code> deposits the USDC into the employer's confidential balance
        in one call, then a merge makes it spendable.
      </Step>
    </Steps>

    The bridge moves through a fixed sequence of stages. You can surface these to a user as a
    progress indicator:

    | Stage        | What is happening                                                   | Where           |
    | ------------ | ------------------------------------------------------------------- | --------------- |
    | Enter amount | You choose how much USDC to bridge.                                 | Client          |
    | Burn         | The burn tool burns that USDC on Base Sepolia.                      | Base Sepolia    |
    | Attesting    | Circle observes the burn and produces an attestation.               | Circle          |
    | Minting      | `mint_and_forward` mints the USDC into the `CctpVault`.             | Stellar testnet |
    | Depositing   | The vault's `fund` deposits the USDC into the confidential balance. | Stellar testnet |
    | Done         | A `merge` makes the deposited funds spendable.                      | Stellar testnet |
  </Tab>

  <Tab title="Deposit classic USDC">
    If you already hold the underlying USDC in a classic account (a trustline and a balance),
    you skip both the faucet and the bridge and deposit it straight into the confidential token:

    <Steps>
      <Step title="Deposit">
        Call the confidential token's <code>deposit</code> with the amount as a public `i128`.
        This moves public USDC into your confidential balance (fee-sponsored).
      </Step>

      <Step title="Merge">
        A merge folds the deposited funds into your spendable balance.
      </Step>
    </Steps>

    This route needs no issuer and no cross-chain burn. The deposited amount is public (it is a
    plain `i128` argument), exactly as with the other two routes; the per-recipient split you
    later pay out is what stays hidden.
  </Tab>
</Tabs>

<Note>
  Both `deposit` and `merge` are **fee-sponsored**: the sponsor fee-bumps them the same way it
  fee-bumps a `confidential_transfer`, so funding costs the employer **0 XLM**. See
  [fee sponsorship](/developers/fee-sponsorship) for the CAP-15 fee-bump and its guard-rails.
</Note>

## The vault

Two of the three routes deposit through `CctpVault`, an **employer-owned** Soroban contract.

<Info>
  **The vault is employer-owned.** `CctpVault` is custodial to its `owner` by construction,
  and that owner is the **employer** (per ADR-006), never a Confiroll key. The vault exists
  because a contract can hold USDC through the asset contract with no trustline and no XLM
  reserve, whereas minting straight to a classic account would revert without a pre-provisioned
  trustline. The vault owner signs the `fund` call. See
  [Soroban contracts](/developers/contracts) for the vault's functions and its nested-auth
  design.
</Info>

`fund` does the bridge from public to confidential in a single call: it deposits vault-held
USDC into the employer's confidential balance, pre-authorizing exactly the nested asset
transfer that the token's `deposit` performs and nothing broader. The vault holds value; it
holds **no secrets**, and only its owner can call `fund` or `sweep`.

<Warning>
  The CCTP route requires funds to have actually been bridged (a real Base-Sepolia burn plus
  attestation). The self-issued faucet is the reproducible path that always works on testnet,
  and depositing classic USDC works whenever you already hold the underlying asset.
</Warning>

## FAQ

<AccordionGroup>
  <Accordion title="Is the amount I fund hidden?">
    No. The deposited total is public by design: `deposit` takes the amount as a public `i128`,
    and a CCTP mint records a public transfer into the vault. Confidentiality applies to the
    per-recipient splits you pay out and to ongoing balances, not to the funded total. The
    withdrawn amount is public too. Only the split and the running balances are hidden.
  </Accordion>

  <Accordion title="Which route should I use?">
    Use the testnet faucet when you just want self-issued test USDC and a path that always
    works. Use the CCTP bridge when you hold canonical USDC on another chain (Base Sepolia on
    testnet) and want it on Stellar. Deposit classic USDC when you already hold the underlying
    asset in a Stellar classic account. All three end in the same confidential balance.
  </Accordion>

  <Accordion title="Do I need XLM to fund?">
    No. `deposit`, `fund`, and `merge` are all fee-sponsored through the CAP-15 fee-bump, so a
    zero-XLM account can fund a confidential balance. The employer's XLM delta stays `0` and the
    sponsor pays the network fee. For the employer walkthrough, see
    [funding your account](/guide/employer/funding).
  </Accordion>
</AccordionGroup>