Contracts

Implemented

The contract topology, what each one owns, and which roles can touch it.

#Topology

flowchart TB
  F[MirrorVaultFactory] -->|deploys| V[MirrorVault]
  V --> SR[SourceRegistry]
  V --> AR[AssetRiskRegistry]
  V --> PR[PriceRouter]
  V --> FC[FeeController]
  V --> ER[ExecutionRouter]
  ER --> AD["IExecutionAdapter<br/>(allowlisted)"]
  PR --> PA["IPriceAdapter<br/>(allowlisted)"]
  F -.->|"isVault() — only vaults may route"| ER

#What each contract owns

Contract	Owns	Cannot
`MirrorVault`	Custody, shares, snapshots, sync decisions	Be upgraded; accept arbitrary calldata; send proceeds elsewhere
`MirrorVaultFactory`	Deployment, the `isVault` registry	Touch a deployed vault's assets
`SourceRegistry`	Which address a source version observes	Change a live vault's source
`AssetRiskRegistry`	Approved assets, decimals, per-asset pause	Move an asset
`PriceRouter`	Adapter allowlist, conservative valuation	Return a price it does not stand behind
`ExecutionRouter`	Adapter allowlist, order construction	Choose a recipient
`FeeController`	Fee policy	Hold or claim any asset

#Roles

Roles gate configuration, never custody. No role can move a depositor's assets, rewrite a snapshot, or block a withdrawal — those functions do not exist.

Role	Can	Cannot
`RISK_ROLE`	Approve assets, set parameters beneath the registry ceilings, allowlist adapters	Raise a ceiling; touch vault balances
`PAUSER_ROLE`	Pause deposits or execution	Pause in-kind redemption
Curator	Propose and activate a source for future vaults	Change a live vault's source
Keeper	Call `sync(token)`	Choose what the sync does

Security. In production the admin and pauser roles must be a multisig or timelock. A single EOA holding PAUSER_ROLE across the protocol is a single point of failure, and is called out as such in the production gates.

#The one-way doors

Three properties are structural rather than policy, which is what makes them worth relying on:

No upgrade path. No proxy, no delegatecall to a mutable implementation. What is deployed is what runs.
No arbitrary execution. The order struct has no calldata field and no recipient field.
No pausable exit. redeemInKind has no pause check and consults no price feed.

#Reference

Per-contract methods, events and errors are in Contract reference.