Introduction
ImplementedWhat a mirror vault is, what it is not, and the one guarantee the design is built around.
A Vault is an onchain fund that copies the positions of one chosen public account, inside limits that are fixed when the vault is deployed and cannot be changed afterwards.
You deposit WETH. You receive vault shares. When the account being followed buys or sells an eligible asset, a keeper can make the vault perform the proportionally-sized version of that same trade. When you want out, you burn your shares and receive your exact slice of everything the vault holds.
#The account being followed holds nothing
This is the design's load-bearing property, so it is worth stating before anything else.
The account a vault mirrors — the source account — is a read-only signal. It is an address the vault reads balances from. It holds no role on the vault, cannot call any vault function, cannot move or approve vault assets, and is never the recipient of a transfer. It cannot be granted control later, because there is no function that would grant it.
Security. The source account is never described as a manager, and the distinction is not cosmetic. A manager has discretion over your money. A source has none: it is being watched, not obeyed. Nobody involved in a vault can trade your deposit, redirect it, or withhold your exit.
That property is asserted by an invariant test across randomised action sequences: the source account never ends up holding vault shares, no matter what sequence of deposits, redemptions, source trades and syncs is played out.
#What a vault can and cannot do
| A vault can | A vault cannot |
|---|---|
| Buy an asset its source bought, if that asset is approved | Buy anything not on the approved list |
| Sell an asset its source sold | Be told what to trade by a keeper |
| Refuse a trade and record why | Send proceeds anywhere but itself |
| Pause deposits, or pause execution | Pause or block withdrawal in kind |
| Refuse to price itself | Mint shares at a price it does not stand behind |
#The two exits
There are two ways out, and they behave differently on purpose.
In-kind exit. Burn shares, receive your pro-rata share of every asset the vault holds — the base asset and every position token. This path has no pause check and consults no price feed. It keeps working during an incident, while execution is paused, and when every oracle is failing.
Base-asset exit. Request a redemption in WETH. Your shares are escrowed immediately and burned when the epoch settles. Settlement never forces a liquidation; it pays from base asset the vault already holds.
The first one is the guarantee. The second one is a convenience.
#What this is not
It is not a managed fund, a signal service, or a social-trading product where somebody trades on your behalf. Nobody trades on your behalf. A vault is a deterministic transformation of one address's observable balance changes into another address's balances, bounded by published limits.
It is also not finished. The protocol is unaudited, has never been deployed to mainnet, and depends on things it does not control — see Known limitations.
#Where to go next
- How Vaults works — the whole path, end to end.
- Core concepts — the six words everything else assumes.
- Getting started — find a source, read a vault, deposit.