Decentralized peer-to-peer lending, borrowing, and NFT rental — where counterparties set their own terms.

Vaipakam is a non-custodial DeFi protocol where lenders and borrowers negotiate directly instead of borrowing from a pooled money market. Each user's assets live in their own isolated vault, every position is a transferable NFT, and safety-critical actions (liquidation, default) are permissionless. The protocol supports ERC-20 lending against ERC-20 or NFT collateral, and true NFT rental — the renter receives usage rights while the NFT never leaves vault custody.

Status (July 2026): pre-live. Deployments are testnet/local only. A third-party security audit is required before any mainnet launch.

• Your terms, not the pool's curve — rate, duration, collateral requirements, and interest mode are negotiated per loan, so exotic and long-tail assets can be priced by the two parties who actually hold the risk.
• No shared-pool contagion — there is no commingled liquidity to drain; a bad loan affects its two parties, not every depositor.
• Positions are NFTs — lender-side and borrower-side rights follow on-chain position NFTs, so they are inspectable, and transferable where protocol rules allow.
• Illiquid assets are first-class — assets without deep oracle-verified liquidity can still be used with explicit dual consent and in-kind settlement, instead of being silently mispriced.
• Safety is permissionless — anyone may trigger liquidation or default once protocol conditions are met; user protection never depends on a privileged bot.

                        ┌──────────────────────────────┐
 users / keepers ──────▶│  VaipakamDiamond (EIP-2535)  │──▶ 60+ facets: offers, loans,
                        │  single entry, shared storage │    risk, liquidation, oracle,
                        └──────────────┬───────────────┘    rentals, VPFI, rewards…
                                       │
                 ┌─────────────────────┼──────────────────────┐
                 ▼                     ▼                      ▼
        per-user UUPS vaults    position NFTs         Chainlink price feeds
        (isolated custody)      (claim rights)        + CCIP cross-chain layer

• Contracts — Solidity 0.8.29, EIP-2535 Diamond, per-user UUPS vault proxies, Chainlink oracles, Chainlink CCIP for the cross-chain VPFI token and reward mesh. Built and tested with Foundry (unit + fuzz + invariant + deploy-sanity suites).
• Off-chain — three Cloudflare Workers (keeper, indexer, agent) for health-factor watching, event indexing, and notifications. The protocol functions without them; they add convenience, not authority.
• Frontends — a public website (docs, analytics, NFT verifier) and a wallet-connected app. The frontend is a safety layer, not a gatekeeper: everything it does can be done against the contracts directly.

• Technical Whitepaper — the canonical protocol specification, rendered at vaipakam.com
• Functional Specs — the code-independent intended-behaviour specification (the test oracle)
• Design docs & ADRs — architecture decisions and design exploration
• Release notes — the shipped-work narrative
• Project board — live tracker for in-flight and queued work

Contracts (from contracts/):

forge build                       # compile (Solidity 0.8.29, viaIR)
forge test --match-path test/RepayFacetTest.t.sol   # targeted tests
bash script/run-regression.sh     # full local regression

Frontends and Workers (pnpm workspace, from the repo root):

pnpm install
pnpm --filter @vaipakam/www dev       # public website
pnpm --filter @vaipakam/defi dev      # connected app

See CONTRIBUTING.md for conventions and AGENTS.md for the AI-assisted review workflow used on this repo.

Security-sensitive reports go through the private channels in SECURITY.md — never public GitHub issues. The protocol's incident procedures live in docs/ops/IncidentRunbook.md. Internal adversarial security reviews are recorded under docs/FindingsAndFixes/; a third-party audit precedes any mainnet deployment.

Business Source License 1.1 — free for non-production use; converts to MIT per the license's Change Date terms.