Keys and controls

Every fill needs two signatures on the same order.

The strategy key is the bot. It lives on the operator's machine, signs quotes at market speed, and is the key most likely to leak.

The risk key is separate and signs the same digest independently.

Valuations work the same way. Both keys sign the attestation that prices deposits and redemptions, so one key alone can neither move inventory nor set the price it is valued at.

One key alone moves nothing. If the bot key is stolen, the thief can sign quotes nobody can execute. What it can still do is close an open redemption epoch, which kills every outstanding quote and holds the vault in close-only until the epoch settles. Disruptive, not dangerous. No inventory moves and no price gets set. The operator admin rotates the strategy key and every outstanding quote dies with the rotation.

Rotation is deliberately asymmetric. Strategy rotates instantly, because you want that fast when something goes wrong. The risk key rotates behind a fixed delay, so nobody can quietly swap out the second signer and then drain the first.

The brakes

Three of them, and they escalate.

Pause. A guardian can pause the vault. Pausing kills signature validation, which means Permit2 cannot pull a single token out of it. Outstanding quotes die. The management fee banks what has accrued and stops until unpause. Redemption requests still queue while paused, because exits should never be blocked. Only new capital is.

Close-only. Any closed redemption epoch puts the vault in close-only mode automatically. It can still sell the corridor asset for USDT but cannot buy more of it. No guardian action needed.

The timeout ladder. If the keys stop signing, the vault does not become a trap.

The rungs cannot overlap: the factory refuses to deploy a vault whose emergency timeout is not longer than its valuation window, so the keys always get their chance to sign before anyone else can force the exit. The keys' chance also ends there: once an epoch is past its timeout the vault refuses any valuation for it, however long the signed window runs, so a price can't be signed early and held for later. The last rung takes no valuation and no permission. Once the emergency timeout has passed, anybody can settle the epoch. It pauses the vault itself if the guardian has not, so no quote can move inventory under the payout, then pays every redeemer their pro-rata share of whatever is actually in the vault — and forfeits the management fee for the span since the last checkpoint, so those redeemers are not diluted for the attestation the operator failed to produce. If idle settlement is stuck in Aave, that slice is paid out as aTokens instead. Deposits have their own version: past the valuation timeout the vault refuses any valuation for that epoch, and anyone can void it — Textile's keeper does — so depositors take back exactly what they put in, USDT or cNGN.

Who can do what

Role	Can	Cannot
LP	Deposit, cancel before the cutoff, redeem, claim, transfer shares	Anything else
Strategy key	Sign quotes that pass the policy, co-sign valuations, close a redemption epoch (which kills live quotes and forces close-only)	Sign alone, move funds, change a vault parameter
Risk key	Co-sign quotes and valuations	Sign alone, move funds
Operator admin	Rotate the strategy key, set the guardian and fee recipient, retune the idle-yield liquid floor, close a redemption epoch, hand over the vault	Move funds, change caps, fees or timers
Risk admin	Propose a new risk key, subject to the delay, hand over the role	Sign anything
Guardian	Pause, unpause, sweep tokens that are not the vault's two assets, its shares or its yield token	Touch inventory or shares

Note what is missing. Nobody upgrades the vault. Nobody raises a fee. Nobody lifts a size cap or shortens a timeout. The vault is deployed immutable: assets, caps, reserve floors, fees and every timer are fixed at creation. The one dial left is the idle-yield liquid floor, which only decides how much idle settlement sits in Aave. It never changes what a quote may pull or the size of a redeemer's pro-rata slice, though a lower floor does mean more of that slice can come back as aTokens if an emergency exit finds Aave unable to pay. Changing anything else means a new vault and a new set of LPs. That is a cost we would rather pay than hold an upgrade key over other people's money.

Next

• Depositing and redeeming for the epoch mechanics
• Operator Vault for what the vault is