Core concepts

Six words the rest of the documentation assumes.

#Source account

The public address a vault mirrors. It is a read-only signal: an address the vault reads balanceOf from, and nothing else.

It holds no role on the vault, cannot call any vault function, cannot move or approve vault assets, and never receives depositor funds. There is no function that could grant it any of those later.

Which address a vault observes is fixed at deployment, recorded in the SourceRegistry against a source version, and immutable for the life of that vault. Changing it means deploying a new vault, not editing a live one.

See Source accounts.

#Mirror vault

The contract that holds the assets and issues the shares. One vault per source version.

It is an ERC-20 whose shares represent a claim on everything the vault holds. It owns custody; nothing else in the system does. The registries it consults can tell it no, but none of them can tell it to move an asset somewhere.

See Mirror vaults.

#Snapshot

The source balance a vault has accepted for a given asset.

A vault does not track the source's live balance directly — it tracks the last balance it acted on. A snapshot is only accepted after the corresponding trade succeeds, which is what makes a partially-completed sync safe: if the trade fails, the snapshot is unchanged and the work is still outstanding.

#Divergence

The difference between the source's live balance and the vault's accepted snapshot.

Divergence is not an error. It is the honest state of a mirror between syncs, and it is shown with a reason rather than hidden. A vault that has deliberately declined to copy a trade is diverged, permanently and correctly, and says so.

#Keeper

Whoever calls sync(token). Permissionless.

A keeper picks when a sync happens and which asset is evaluated. It cannot pick what the vault does about it. The order the contract produces has no calldata field and no recipient field — the recipient is forced to the calling vault — so there is nowhere to express "send the proceeds elsewhere".

See Keeper.

#Risk constitution

The parameter set fixed at deployment for the life of a vault: position concentration, cash buffer, NAV cap, liquidity floor, price-impact ceiling, slippage floor, dust threshold, pending expiry.

These are the terms depositors accepted when they deposited, so changing any of them requires deploying a new vault rather than editing a live one. The registry holds hard ceilings above them that no role can raise.

See Risk constraints.