Skip to content
⬡
THORChain Wiki
\u2190 All Deep DivesEdit this page on GitHub \u2192
Deep DiveCurated

App Layer, CosmWasm, and Secured Assets

How THORChain App Layer contracts, secured assets, trade-account boundaries, and WASM halt controls fit together without overclaiming current availability.

About this article's sourcing
CuratedChecked 2026-07-14·
THORChain Application Layer docs
retrieval details
Source retrieved 2026-07-14Official high-level app-layer overview; economic examples are design framing, while current WASM, secured-asset, and trade-account availability still needs live controls.
+5 sources
THORChain CosmWasm docs
retrieval details
Source retrieved 2026-07-14Official permissioned-mainnet and sandbox-boundary reference; current contract execution still depends on live scoped controls.
THORChain Secured Assets docs
retrieval details
Source retrieved 2026-07-14Official high-level secured-asset overview, which says secured assets replace Trade Assets; compare the developer guide terminology and live controls before making module or availability claims.
THORChain secured assets developer docs
retrieval details
Source retrieved 2026-07-14Developer reference for secured-asset share mechanics, SECURE memo syntax, conversion exclusions, and a different "replace Trade Accounts" wording; syntax is not current action availability proof.
THORChain Network Halts
retrieval details
Source retrieved 2026-07-05Official halt-control reference; live Mimir and inbound-address reads still own current availability.
THORChain constants and Mimirs
retrieval details
Source retrieved 2026-07-05Official constants and Mimir reference; live Mimir reads still own current override state.

Use this article for: A source-boundary guide for app-layer contracts, secured assets, trade accounts, and live control checks.

Verify elsewhere before claiming: Current Mimir app-layer controls, contract/deployer/checksum state, secured/trade-asset enablement, source warnings, and dated product scope.

Network diagnosticsDeveloper integrationCurrent source mapWhy these checks

App Layer, CosmWasm, and Secured Assets

THORChain's App Layer is the smart-contract surface built around CosmWasm. It extends the base protocol from native cross-chain swaps into contract-driven applications, while keeping live availability, contract permissions, and asset movement behind explicit source checks.

App Layer Claim Checks

App Layer language gets risky when one sentence tries to cover contracts, secured assets, trade accounts, and wallets at the same time. Start by naming the claim type:

Contract or app availability

  • Use: Explain the CosmWasm model, permissioned deployers, code checksums, contract instances, and oracle dependencies.
  • Verify: Check live /network#network-diagnostics evidence for HaltWasmGlobal, scoped HaltWasm* controls, WasmPermissionless, oracle controls, signing, and the relevant chain.
  • Do not claim: A contract, deployer, checksum, or app is safe, executable, or unpaused from static docs alone.

Secured asset movement

  • Use: Explain that secured assets are THORChain-native assets minted from deposited L1 assets and can be used by accounts, IBC, and contracts.
  • Verify: Check live secured-asset controls, chain-scoped deposit and withdrawal flags, route availability, and official asset-notation docs.
  • Do not claim: Current capacity, redemption timing, liquidity, or safety margin without fresh protocol evidence.

Trade-account or arbitrage flow

  • Use: Separate older trade-account terminology from secured assets and contract-moved tokens.
  • Verify: Check TradeAccountsEnabled, TradeAccountsDepositEnabled, the exact HaltTradeDeposit-<CHAIN> and HaltTradeWithdraw-<CHAIN> families, pool state, quote output, and route-specific halts.
  • Do not claim: That an arbitrage bot, professional-trader path, or trade-account flow is available just because the design exists.

Interface or wallet support

  • Use: Treat ecosystem listings as places to inspect for support.
  • Verify: Check the interface implementation, quote recipient, memo, wallet permissions, source integrity, and live protocol state.
  • Do not claim: Wallet safety, download integrity, support quality, or transaction suitability from this article.

What This Page Can Prove

  • App Layer contracts run in the CosmWasm sandbox inside THORNode's Cosmos SDK environment.
  • Scoped controls govern availability; there is no single "contracts are live" switch.
  • Static docs explain design and notation, while current use needs route, source-freshness, and interface-specific evidence.

Evidence Ladder

Match the claim to its control family: contracts need current Network diagnostics plus deployer/checksum evidence; secured assets need global or chain-scoped deposit/withdraw halts; trade-account flows need TradeAccountsEnabled, TradeAccountsDepositEnabled, HaltTradeDeposit-<CHAIN>, and HaltTradeWithdraw-<CHAIN>; wallets and interfaces also need implementation review. Design docs alone do not prove that an action works now.

Common Misreadings

  • "No global WASM halt means every contract is usable." Scoped deployer, checksum, contract, oracle, signing, chain, and source-warning evidence can still limit a path.
  • "Secured assets are just pooled assets." They are native THORChain asset balances backed by deposited L1 assets, with their own controls and security-budget caveats.
  • "Trade assets, trade accounts, and secured assets are interchangeable." Older terminology appears in integrations and controls, but contract movement and secured-asset redemption need separate checks.
  • "The secured-asset docs prove exactly which older module was replaced." The high-level page says "Trade Assets," while the developer guide says "Trade Accounts." That is source terminology drift, not enough evidence to claim either module was removed or migrated.
  • "A documented SECURE+ or SECURE- memo is a current transaction instruction." Those examples explain integration syntax. Current chain, inbound-address, quote, halt, signing, interface, and asset evidence still own usability.
  • "A wallet or app listing is a safety review." Ecosystem listings and docs are starting points; they do not prove implementation quality, download integrity, memo construction, or current route availability.
  • "Absent halt keys prove health." Absence is only useful when the source is fresh, pinned, source-labeled, and the relevant scoped control family is known.

What Changed From The Base Layer

The base layer is still the part of THORChain that secures vaults, observes external chains, signs outbound transactions, and prices swaps through RUNE-paired liquidity pools.

The App Layer adds a contract environment on top of that foundation:

  • CosmWasm runs inside THORNode through the Cosmos SDK x/wasm module.
  • Contracts can build application behavior such as orderbooks, lending, perps, launchpads, liquidations, and other DeFi workflows.
  • Contracts can use THORChain liquidity and normal THORChain account capabilities, but they should not be described as having privileged access to vault logic.
  • Official CosmWasm docs explicitly place contracts in a sandbox that cannot touch vault logic. That limits authority; it does not audit contract code or guarantee safe outcomes.
  • Mainnet contract deployment is permissioned unless live Mimir says otherwise. Approved deployers, code checksums, and contract instances are the relevant control surfaces.

The practical reader takeaway: App Layer claims need two layers of evidence. Static docs explain the intended design. Live THORNode/Mimir evidence explains whether the relevant action, contract family, or asset flow is currently enabled.

CosmWasm Permission Model

CosmWasm contracts are WebAssembly contracts, commonly written in Rust. On THORChain, the important operational difference is permissioning and emergency control.

The source-backed control families to know are:

  • WasmPermissionless: whether permissionless contract deployment is enabled.
  • WasmMinGasPrice: minimum gas price for CosmWasm transactions.
  • HaltWasmGlobal: global App Layer contract execution halt.
  • HaltWasmDeployer-<address>: halt contracts deployed by a specific deployer.
  • HaltWasmCs-<checksum>: halt a contract code checksum.
  • HaltWasmContract-<suffix>: halt a specific contract by address suffix.
  • HaltOracle: halt oracle price feeds used by app-layer products.

Do not reduce those controls to a single "App Layer is up" claim. A global contract halt, a scoped deployer halt, a code-checksum halt, and a specific contract halt affect different scopes.

Secured Assets

Secured Assets are native THORChain assets minted from deposited L1 assets. They are designed for account transfers, IBC-compatible movement, and CosmWasm integration using normal Cosmos SDK messages.

They are not the same as pooled L1 assets, synthetic assets, or historical trade assets:

  • A user deposits an L1 asset and receives a secured-asset balance representing a share claim on that deposited asset.
  • Secured assets can be swapped, sent, used by smart contracts, and redeemed back out to the represented L1 asset.
  • The official source set is inconsistent about replacement terminology: the high-level secured-assets page says they replace Trade Assets, while the developer guide says they replace Trade Accounts for professional-trader and arbitrage flows. Preserve both statements as source wording; do not infer that either older module is absent from current code or controls.
  • RUNE, synthetics, and trade assets should not be described as convertible into secured assets.

The developer guide also documents SECURE+ and SECURE- memo forms. They are useful for understanding the designed deposit and withdrawal interface, but this wiki does not turn static memo examples into current user instructions. A usable action still needs a freshly fetched inbound address, current quote or interface construction, chain and secured-asset controls, signing health, and transaction-specific review.

The security caveat is important. Because secured assets are not simply the pool balance itself, official docs tie them to network security budget checks and the broader Layer1-asset-versus-bond framing. A wiki page should not infer current capacity, live limits, or safety margins without checking current protocol state.

Trade Accounts And Non-Contract Assets

Trade accounts remain a useful search term because older integrations and control names still mention them. They should not be blurred into CosmWasm contract tokens.

The clean distinction:

  • Trade assets/accounts are accounting and execution concepts for fast THORChain trading flows.
  • Secured assets are App Layer-compatible assets backed by L1 deposits.
  • CosmWasm docs explicitly warn that trade assets are not supported as contract-moved tokens.
  • Current trade-account enablement, chain-scoped deposit availability, and chain-scoped withdrawal availability are live-control questions, not static docs claims.

If a reader asks whether a bot, interface, or contract can use a specific asset today, send them to live network diagnostics and the current protocol source map before answering.

Operational Controls

The App Layer shares the wiki's current-only trust boundary. Source-backed controls include secured-asset halts, smart-contract halts, oracle halts, and trade-account enablement. For the full breakdown of Mimir halt controls, parameter families, and how to verify current state, see the Mimir and Halt Controls deep dive.

The App Layer-specific controls most relevant here are HaltWasmGlobal, HaltWasmDeployer-<address>, HaltWasmCs-<checksum>, HaltWasmContract-<suffix>, and HaltOracle. These can be malformed, stale, scheduled, or absent from a source snapshot. Absence is not the same as proof of health unless the dashboard has a fresh, pinned, source-labeled THORNode result.

Glossaryapp-layercosmwasmsecured-assetsmimir
Reader paths for this article

Use these paths to connect this explainer with the current-state checks needed before making live protocol claims.

View all paths
App Layer And Integrations

Readers trying to separate base-layer swaps, CosmWasm contracts, secured assets, trade accounts, and live halt controls.

Step 1 of 4

Verify Before Claiming

  • Current secured-asset, trade-account, oracle, WASM, signing, trading, and chain-specific Mimir state.
  • Whether source wording about replacing Trade Assets versus Trade Accounts describes a current module migration rather than terminology drift.
  • That a specific interface, contract, deployer, checksum, or asset flow is safe, supported, or currently available.

Continue This Path

Continue with Mimir And Halt Controls before treating this path as complete.

App Layer And Integrations step 1/4
Path startThis article opens the path.
Next in pathMimir And Halt Controls

Browse All Deep Dives

Article library order, separate from reader-path order.

Previous in libraryBifrost Bridge and Cross-Chain ObservabilityNext in libraryMimir And Halt Controls

Related Reading

Mimir And Halt ControlsHow to read Mimir halt keys, scoped controls, scheduled values, absent keys, and source warnings before making current availability claims.