App Layer, CosmWasm, and Secured Assets

THORChain's App Layer is the smart-contract surface built around CosmWasm. It extends the base protocol from native cross-chain swaps into contract-driven applications, while keeping live availability, contract permissions, and asset movement behind explicit source checks.

App Layer Claim Checks

App Layer language gets risky when one sentence tries to cover contracts, secured assets, trade accounts, and wallets at the same time. Start by naming the claim type:

Contract or app availability

• Use: Explain the CosmWasm model, permissioned deployers, code checksums, contract instances, and oracle dependencies.
• Verify: Check live /network#network-diagnostics evidence for HaltWasmGlobal, scoped HaltWasm* controls, WasmPermissionless, oracle controls, signing, and the relevant chain.
• Do not claim: A contract, deployer, checksum, or app is safe, executable, or unpaused from static docs alone.

Secured asset movement

• Use: Explain that secured assets are THORChain-native assets minted from deposited L1 assets and can be used by accounts, IBC, and contracts.
• Verify: Check live secured-asset controls, chain-scoped deposit and withdrawal flags, route availability, and official asset-notation docs.
• Do not claim: Current capacity, redemption timing, liquidity, or safety margin without fresh protocol evidence.

Trade-account or arbitrage flow

• Use: Separate older trade-account terminology from secured assets and contract-moved tokens.
• Verify: Check TradeAccountsEnabled, trade-account deposit controls, pool state, quote output, and route-specific halts.
• Do not claim: That an arbitrage bot, professional-trader path, or trade-account flow is available just because the design exists.

Interface or wallet support

• Use: Treat ecosystem listings as places to inspect for support.
• Verify: Check the interface implementation, quote recipient, memo, wallet permissions, source integrity, and live protocol state.
• Do not claim: Wallet safety, download integrity, support quality, or transaction suitability from this article.

What This Page Can Prove

This article can support a few narrow claims:

• THORChain App Layer contracts are CosmWasm contracts running in THORNode's Cosmos SDK environment.
• CosmWasm contracts are sandboxed from THORChain vault logic; an app-layer failure is not evidence of direct vault authority, and the sandbox is not proof that a particular contract is safe.
• App Layer availability is controlled by scoped live controls, not by one broad "contracts are live" switch.
• Secured assets, trade assets, trade accounts, and contract-moved tokens are separate concepts with different evidence needs. The reviewed official sources use inconsistent "replaces" wording, so this page preserves that divergence instead of inferring a completed module migration.
• Static docs can explain design and notation, while current use needs THORNode/Mimir, route, source-freshness, and interface-specific evidence.

It cannot prove that a specific contract, interface, secured asset, wallet path, or arbitrage flow works right now. For that, use the evidence ladder below.

Evidence Ladder

Use the strongest evidence available for the claim being made:

1. Specific app or contract action: current Network diagnostics for HaltWasm*, HaltOracle, signing, trading, and source warnings; then app-specific contract/deployer/checksum evidence.
2. Secured asset deposit or withdrawal: HaltSecuredGlobal, chain-scoped HaltSecuredDeposit-* and HaltSecuredWithdraw-*, asset notation, current route/chain state, and the interface path.
3. Trade-account or arbitrage flow: TradeAccountsEnabled, trade-account deposit controls, pool state, quote output, route halts, and current app-layer controls if contracts are involved.
4. Wallet or interface support: the interface implementation, quote/memo construction, recipient behavior, wallet permission surface, source integrity, and current protocol diagnostics.
5. Design-only explanation: official App Layer, CosmWasm, secured-asset, and Mimir docs. Use this only for architecture, not current execution claims.

If a claim jumps from "this feature exists in docs" to "a user can use it now," it is missing live evidence.

Common Misreadings

• "No global WASM halt means every contract is usable." Scoped deployer, checksum, contract, oracle, signing, chain, and source-warning evidence can still limit a path.
• "Secured assets are just pooled assets." They are native THORChain asset balances backed by deposited L1 assets, with their own controls and security-budget caveats.
• "Trade assets, trade accounts, and secured assets are interchangeable." Older terminology appears in integrations and controls, but contract movement and secured-asset redemption need separate checks.
• "The secured-asset docs prove exactly which older module was replaced." The high-level page says "Trade Assets," while the developer guide says "Trade Accounts." That is source terminology drift, not enough evidence to claim either module was removed or migrated.
• "A documented SECURE+ or SECURE- memo is a current transaction instruction." Those examples explain integration syntax. Current chain, inbound-address, quote, halt, signing, interface, and asset evidence still own usability.
• "A wallet or app listing is a safety review." Ecosystem listings and docs are starting points; they do not prove implementation quality, download integrity, memo construction, or current route availability.
• "Absent halt keys prove health." Absence is only useful when the source is fresh, pinned, source-labeled, and the relevant scoped control family is known.

What Changed From The Base Layer

The base layer is still the part of THORChain that secures vaults, observes external chains, signs outbound transactions, and prices swaps through RUNE-paired liquidity pools.

The App Layer adds a contract environment on top of that foundation:

• CosmWasm runs inside THORNode through the Cosmos SDK x/wasm module.
• Contracts can build application behavior such as orderbooks, lending, perps, launchpads, liquidations, and other DeFi workflows.
• Contracts can use THORChain liquidity and normal THORChain account capabilities, but they should not be described as having privileged access to vault logic.
• Official CosmWasm docs explicitly place contracts in a sandbox that cannot touch vault logic. That limits authority; it does not audit contract code or guarantee safe outcomes.
• Mainnet contract deployment is permissioned unless live Mimir says otherwise. Approved deployers, code checksums, and contract instances are the relevant control surfaces.

The practical reader takeaway: App Layer claims need two layers of evidence. Static docs explain the intended design. Live THORNode/Mimir evidence explains whether the relevant action, contract family, or asset flow is currently enabled.

CosmWasm Permission Model

CosmWasm contracts are WebAssembly contracts, commonly written in Rust. On THORChain, the important operational difference is permissioning and emergency control.

The source-backed control families to know are:

• WasmPermissionless: whether permissionless contract deployment is enabled.
• WasmMinGasPrice: minimum gas price for CosmWasm transactions.
• HaltWasmGlobal: global App Layer contract execution halt.
• HaltWasmDeployer-<address>: halt contracts deployed by a specific deployer.
• HaltWasmCs-<checksum>: halt a contract code checksum.
• HaltWasmContract-<suffix>: halt a specific contract by address suffix.
• HaltOracle: halt oracle price feeds used by app-layer products.

Do not reduce those controls to a single "App Layer is up" claim. A global contract halt, a scoped deployer halt, a code-checksum halt, and a specific contract halt affect different scopes.

Secured Assets

Secured Assets are native THORChain assets minted from deposited L1 assets. They are designed for account transfers, IBC-compatible movement, and CosmWasm integration using normal Cosmos SDK messages.

They are not the same as pooled L1 assets, synthetic assets, or historical trade assets:

• A user deposits an L1 asset and receives a secured-asset balance representing a share claim on that deposited asset.
• Secured assets can be swapped, sent, used by smart contracts, and redeemed back out to the represented L1 asset.
• The official source set is inconsistent about replacement terminology: the high-level secured-assets page says they replace Trade Assets, while the developer guide says they replace Trade Accounts for professional-trader and arbitrage flows. Preserve both statements as source wording; do not infer that either older module is absent from current code or controls.
• RUNE, synthetics, and trade assets should not be described as convertible into secured assets.

The developer guide also documents SECURE+ and SECURE- memo forms. They are useful for understanding the designed deposit and withdrawal interface, but this wiki does not turn static memo examples into current user instructions. A usable action still needs a freshly fetched inbound address, current quote or interface construction, chain and secured-asset controls, signing health, and transaction-specific review.

The security caveat is important. Because secured assets are not simply the pool balance itself, official docs tie them to network security budget checks and the broader Layer1-asset-versus-bond framing. A wiki page should not infer current capacity, live limits, or safety margins without checking current protocol state.

Trade Accounts And Non-Contract Assets

Trade accounts remain a useful search term because older integrations and control names still mention them. They should not be blurred into CosmWasm contract tokens.

The clean distinction:

• Trade assets/accounts are accounting and execution concepts for fast THORChain trading flows.
• Secured assets are App Layer-compatible assets backed by L1 deposits.
• CosmWasm docs explicitly warn that trade assets are not supported as contract-moved tokens.
• Current trade-account enablement is a live-control question, not a static docs claim.

If a reader asks whether a bot, interface, or contract can use a specific asset today, send them to live network diagnostics and the current protocol source map before answering.

Operational Controls

The App Layer shares the wiki's current-only trust boundary. Source-backed controls include secured-asset halts, smart-contract halts, oracle halts, and trade-account enablement.

Use the exact control family when describing risk:

• HaltSecuredGlobal: deposits and withdrawals of all secured assets across base and App Layers.
• HaltSecuredDeposit-<CHAIN>: deposits for secured assets scoped to a chain.
• HaltSecuredWithdraw-<CHAIN>: withdrawals for secured assets scoped to a chain.
• TradeAccountsEnabled and related trade-account deposit controls: whether trade-account behavior is available.
• HaltWasm* controls: whether all contracts, deployer-scoped contracts, checksum-scoped contracts, or one contract instance is halted.

These controls can also be malformed, stale, scheduled, or absent from a source snapshot. Absence is not the same as proof of health unless the dashboard has a fresh, pinned, source-labeled THORNode result.

What To Verify Before Claiming

Before saying an App Layer or secured-asset action is available, verify:

1. The current /network#network-diagnostics state for App Layer, secured-asset, trade-account, oracle, signing, trading, and chain-specific controls.
2. The exact Mimir keys involved, especially scoped HaltWasm* and HaltSecured* keys.
3. The destination and asset notation in official developer docs before giving memo or integration guidance.
4. Whether apparently conflicting source terminology is merely wording drift or is supported by current code, endpoints, and controls; do not resolve it by assumption.
5. The interface-specific implementation, because a listed wallet or app is not an endorsement or proof of current support.
6. The source freshness date. Static docs explain design; live endpoint evidence explains current availability.

Non-Claims

This page does not prove:

• Any specific app, contract, deployer, checksum, or wallet is safe.
• App Layer revenue, RUJI economics, or fee-share amounts are current.
• Secured-asset capacity, liquidity, or redemption timing is currently available.
• Every interface supports secured assets, IBC movement, or App Layer contracts correctly.
• A missing halt key is enough evidence to claim the feature is healthy.

Use this article as the map. Use live THORNode/Mimir evidence as the current-state proof.