Architecture

The Safe and the module

MakinaX is a single MakinaXModule installed on an existing Safe multisig. The Safe remains in the hands of its signers throughout. Installing the module grants it module-execution rights on the Safe, and nothing more.

• The Safe is the owner and custodian. It holds the tokens, sets every configuration and risk parameter, and can pause or disable the module. Module-execution rights are what let the module act for the Safe.
• The module is a constrained automation layer. It carries no funds in steady state. It pulls inputs from the Safe, performs an action, and returns the outputs to the Safe within the same transaction. Weiroll scripts run directly inside the Safe's own context by delegatecall.

A module operates on a single chain. Cross-chain movement is outbound bridging only: the module can send tokens to another chain, but it does not track, value, or reconcile assets on other chains. There is no cross-chain accounting.

What the module composes

MakinaXModule is the single concrete contract. It inherits a set of abstract components, each owning one responsibility:

Flash loans are handled by a separate shared contract, the FlashLoanModule, used only inside flash-loan-assisted position management. See Flash-loan-assisted management.

Shared infrastructure

Some contracts are deployed once for a whole MakinaX deployment and shared by every module.

• The MakinaXRegistry is the single source of truth for shared addresses: the factory, the module implementation used for cloning, the fee collector that receives swap fees, the FlashLoanModule, and the bridge encoders (indexed by bridge ID).
• The ModuleFactory deploys new modules as ERC-1167 minimal clones, through a permissioned path for authorized deployers and, when enabled, a permissionless path open to anyone. See Module deployment.
• The Bridge Encoders (AcrossV4BridgeEncoder, CctpV2BridgeEncoder, LayerZeroV2BridgeEncoder) are singletons that build the bridge-specific calldata and hold per-bridge route and registration data.

These infrastructure contracts are upgradeable and use OpenZeppelin AccessManager for authorization, a separate trust domain from the per-Safe module roles. See Permissions & Governance.

Fund custody: the single chokepoint

The most important architectural fact in MakinaX is that the module does not hold funds.

Every value-moving operation follows the same shape:

1. Pull the input token from the Safe (or run a Weiroll script directly in the Safe).
2. Act (swap, bridge, manage a position, repay a flash loan).
3. Return the output to the Safe within the same transaction.

All token movement out of the Safe through the module passes through a single internal pull function, or runs as a delegatecall inside the Safe. The module is meant to hold nothing between operations, but a few things can still land on it, such as dust from an integration or the small native-gas buffers some bridge transfers need (LayerZero, for example). Safe-only sweep functions let the Safe recover whatever does, whether an ERC-20, ERC-721, or ERC-6909 token or native balance.

Glossary