Appearance
Keys and controls
Every fill needs two signatures on the same order.
The strategy key is the bot. It lives on the operator's machine, signs quotes at market speed, and is the key most likely to leak.
The risk key is separate and signs the same digest independently. It also signs the valuation that prices deposits and redemptions.
One key alone moves nothing. If the bot key is stolen, the thief can sign quotes nobody can execute. The operator admin rotates the strategy key and every outstanding quote dies with the rotation.
Rotation is deliberately asymmetric. Strategy rotates instantly, because you want that fast when something goes wrong. The risk key rotates behind a fixed delay, so nobody can quietly swap out the second signer and then drain the first.
The brakes
Three of them, and they escalate.
Pause. A guardian can pause the vault. Pausing kills signature validation, which means Permit2 cannot pull a single token out of it. Outstanding quotes die. Redemption requests still queue while paused, because exits should never be blocked. Only new capital is.
Close-only. Any closed redemption epoch puts the vault in close-only mode automatically. It can still sell the corridor asset for USDT but cannot buy more of it. No guardian action needed.
The timeout ladder. If the risk key stops signing, the vault does not become a trap.
The last rung takes no valuation and no permission. Once the vault is paused and the emergency timeout has passed, anybody can settle the epoch and pay every redeemer their pro-rata share of whatever is actually in the vault. Deposits have their own version: an unpriced deposit epoch can be voided after a timeout and everyone takes their own USDT back.
Who can do what
| Role | Can | Cannot |
|---|---|---|
| LP | Deposit, cancel before the cutoff, redeem, claim, transfer shares | Anything else |
| Strategy key | Sign quotes that pass the policy | Sign alone, move funds, change anything |
| Risk key | Co-sign quotes, sign valuations | Sign alone, move funds |
| Operator admin | Rotate the strategy key, set the guardian and fee recipient, hand over the vault | Move funds, change caps, fees or timers |
| Risk admin | Propose a new risk key, subject to the delay | Sign anything |
| Guardian | Pause, unpause, sweep tokens that are not the vault's two assets or its shares | Touch inventory or shares |
Note what is missing. Nobody upgrades the vault. Nobody raises the fee. Nobody lifts a size cap or shortens a timeout. The vault is deployed immutable: assets, caps, reserve floors, fee and every timer are fixed at creation. Changing any of them means a new vault and a new set of LPs. That is a cost we would rather pay than hold an upgrade key over other people's money.
Next
- Depositing and redeeming for the epoch mechanics
- Operator Vault for what the vault is