Appearance
Operator Vault
Private alpha
Operator Vault is not live. Want in early? contact@textilecredit.com.
The problem
Making markets on an FX corridor takes two things: a bot that prices well, and inventory to price with. They almost never sit in the same place.
An operator who knows the cNGN market can quote all day, but the book is their own balance sheet. Once it's full they stop, no matter how good their pricing is. Meanwhile the people with dollars to put to work, treasuries, funds, family offices, are never going to run a hot wallet, a price feed and a server that has to stay up.
Today the only bridge between the two is trust. Someone wires the operator money and hopes. That's a bad deal on both sides. The LP has no recourse if the operator disappears or blows up. The operator has to take custody they didn't want and can't insure.
What it is
An on-chain vault that splits capital from control.
LPs deposit the settlement asset (USDT) and hold ERC-20 shares. The operator points their Stitch bot at the vault and quotes the corridor with the vault's inventory. The spread the bot earns lands back in the vault, so it belongs to the LPs.
What the operator cannot do is move the money. There is no withdraw function for them to call. The only thing that ever leaves the vault is a swap the vault itself validated, and the only address allowed to receive the other side of that swap is the vault.
This is not a lending pool. The vault does not lend and does not take credit risk on anyone. It holds two assets and makes a market between them.
What the operator can sign
The vault is the swapper on every order, so nothing settles unless the vault approves the signature. It checks the whole order, not just who signed it:
- The pair has to be the vault's own two assets, one in and one out.
- There is exactly one output, and the recipient is the vault.
- The size is under the per-side cap fixed at deploy, and under what the vault actually holds minus the reserve floor.
- The order expires inside the maximum lifetime, and it carries the current trading epoch.
- The order names the reactor and the validation contract the vault was built with.
Anything else fails. A quote paying out to the operator's own wallet fails on the recipient check. A quote in a token the vault doesn't hold fails on the pair check. A quote for more than the vault has fails on the size check.
Two keys, not one
Every fill needs two signatures on the same order.
The strategy key is the bot. It lives on the operator's machine, signs quotes at market speed, and is the key most likely to leak.
The risk key is separate and signs the same digest independently. It also signs the valuation that prices deposits and redemptions.
One key alone moves nothing. If the bot key is stolen, the thief can sign quotes that no one can execute. The operator admin rotates the strategy key immediately and every outstanding quote dies with the rotation.
Rotation is deliberately asymmetric. Strategy rotates instantly, because you want that to be fast when something goes wrong. The risk key rotates behind a fixed delay, so nobody can quietly swap out the second signer and then drain the first.
In the alpha, Textile runs the risk key and the operator runs the strategy key. That is a real trust assumption and worth saying out loud: it means Textile can refuse to co-sign, and it means the two keys are not held by two fully independent parties in the way the design allows. Moving the risk key to independent operators is the point of the next phase.
Deposits and redemptions run in batches
Share price only makes sense at a moment when someone has actually valued the book. So LP flows are batched.
Depositing. You request a deposit and your USDT sits in the vault, ring-fenced from trading, until the epoch cuts off. You can cancel and take it back any time before the cutoff. After the cutoff the epoch is priced against a signed valuation, shares are minted, and you claim them.
Redeeming. You request a redemption and your shares are escrowed. When the epoch closes the vault flips into close-only mode: it can still sell the corridor asset for USDT, but it cannot buy more of it. It raises the cash it owes and stops adding to the position it's trying to unwind. Then the epoch settles and you claim.
Only one redemption epoch runs at a time, so redeemers are never racing each other for the same inventory.
Batching is the honest version of this. A vault that lets you exit instantly either holds idle cash it isn't earning on, or pays you out of someone else's position. Both are worse than waiting for the next epoch.
Share price
Share price comes from a signed valuation, not from a live balance read.
The valuation states the corridor price, the vault's free balance in both assets, and a validity window, all bound to that specific vault, chain and epoch. The chain then checks it against reality: live balances have to be at least what the valuation claims. If a fill drained inventory since it was signed, settlement reverts rather than paying at a stale price.
A stale valuation cannot be replayed later, because it also commits to the last settled value.
The brakes
Three of them, and they escalate.
Pause. A guardian can pause the vault. Pausing kills signature validation, which means Permit2 cannot pull a single token out of it. Outstanding quotes die. Redemption requests still queue while paused, because exits should never be blocked. Only new capital is.
Close-only. Any closed redemption epoch puts the vault in close-only mode automatically. No guardian action needed.
The timeout ladder. If the risk key stops signing, the vault does not become a trap.
The last rung takes no valuation and no permission. Once the vault is paused and the emergency timeout has passed, anybody can settle the epoch and pay every redeemer their pro-rata share of whatever is actually in the vault. Deposits have their own version of this: an unpriced deposit epoch can be voided after a timeout and everyone takes their own USDT back.
Idle yield, optional
A vault can park settlement inventory it isn't quoting with in an Aave v3 market. It's off by default and chosen at deploy.
The rules are narrow on purpose. Only the settlement asset, never the corridor asset. Never money that belongs to a pending deposit or a queued payout. Never below the liquid floor the operator set. A helper contract unstakes and fills in one transaction, so a quote can't fail because the cash was busy earning.
Who can do what
| Role | Can | Cannot |
|---|---|---|
| LP | Deposit, cancel before the cutoff, redeem, claim, transfer shares | Anything else |
| Strategy key | Sign quotes that pass the policy | Sign alone, move funds, change anything |
| Risk key | Co-sign quotes, sign valuations | Sign alone, move funds |
| Operator admin | Rotate the strategy key, set the guardian and fee recipient, hand over the vault | Move funds, change caps, fees or timers |
| Risk admin | Propose a new risk key, subject to the delay | Sign anything |
| Guardian | Pause, unpause, sweep tokens that aren't the vault's two assets or its shares | Touch inventory or shares |
Note what's missing. Nobody upgrades the vault. Nobody raises the fee. Nobody lifts a size cap or shortens a timeout. The vault is deployed immutable: assets, caps, reserve floors, fee and every timer are fixed at creation. Changing any of them means a new vault and a new set of LPs, which is a cost we'd rather pay than hold an upgrade key over other people's money.
Fees
The operator is paid a management fee, expressed per year, accrued continuously as shares, and capped in the contract at 10%. Each vault sets its own rate at deploy and it can never go up.
There's no performance fee in this version.
Trading P&L is not the operator's. Every fill has to pay back into the vault, so the spread is LP return. The taker fee a trader pays on a swap is separate and goes to the protocol, exactly as it does for any other filler. See Fees.
What it doesn't do
Worth being clear about the edges.
One vault covers one pair. A second corridor means a second vault. There's no instant exit, only the next epoch. There's no live on-chain share price between epochs, because there isn't an honest one. Shares are a claim on a trading book, so LPs carry market risk: if the corridor asset moves against the vault while it holds inventory, the value falls, and a bad operator can lose money inside the rules. The vault stops theft. It does not stop bad trading.
Next
- How to become a filler for running a bot on your own inventory today
- Under the hood for the settlement rails everything here is built on
- How it works for the RFQ mechanics