Risk constraints

The six articles of the risk constitution. These are the terms depositors accepted when they deposited, so they are fixed for the life of a vault.

#I — The source has no vault permissions

The source account is a read-only signal. It holds no role, cannot call any vault function, cannot move or approve vault assets, and is never the recipient of a transfer. Every use of its address in the vault contract is a balance read.

Enforcement: an invariant asserts the source account never holds vault shares, across every randomised action sequence.

#II — Only approved assets may be mirrored

An asset is eligible only after a human review is recorded onchain, with its decimals cross-checked against the token itself. Anything unapproved is recorded as visible divergence and never bought — including a token airdropped to the source.

Enforcement: unapproved holdings are also excluded from the sizing denominator, so nobody can shrink a vault's trades by sending its source a nominally valuable token.

#III — Size, concentration, impact and slippage are bounded

Every trade is sized as a proportion of the source's prior portfolio, then capped by position concentration, available cash, the liquidity floor, a price-impact ceiling measured against an independent oracle, and a slippage floor.

Enforcement: the parameter ceilings are constants in the registry. No role can raise them — not even the role that sets the values beneath them.

#IV — Stale or unpriceable states fail closed

A price adapter reverts rather than returning a number it does not stand behind. If a held position cannot be priced, NAV cannot be computed and deposits are refused rather than mispriced.

Enforcement: refusing to trade costs an afternoon; minting shares at a wrong price is permanent, so the system chooses the former every time.

#V — Keepers cannot choose arbitrary trades or recipients

A keeper calls one function with one token address. The order it produces has no calldata field and no recipient field — the recipient is forced to the calling vault. There is nowhere to express "send the proceeds elsewhere".

Enforcement: approvals are exact and revoked in the same transaction, with the residual asserted to be zero.

#VI — Pro-rata in-kind exit remains available

Burn shares, receive your exact share of every asset the vault holds. This path has no pause check and consults no price feed, so it keeps working during an incident, while execution is paused, and when every oracle is failing.

Enforcement: tested by forcing every price feed to fail, asserting NAV computation reverts, and asserting the exit still succeeds.

#Parameters

Warning. Changing any of these requires deploying a new vault version — not editing a live one. The protocol is not audited, and V1 is not trustless. See Known limitations.