Security model
ImplementedWhat is trusted, what is not, and the blast radius of each trusted thing failing.
#The trust ledger
| Component | Trusted for | If it fails |
|---|---|---|
MirrorVault | Everything — it holds custody | Total loss for that vault. No upgrade path means no key can fix it either. |
| Price adapters | Honest valuation | NAV becomes wrong or unavailable. Deposits refuse; in-kind exit is unaffected. |
| Execution adapters | Honest swaps | Bad execution within the slippage and impact bounds. Cannot redirect proceeds. |
RISK_ROLE | Parameters beneath registry ceilings | Worse-but-bounded trading. Cannot raise a ceiling or touch balances. |
PAUSER_ROLE | Pausing deposits and execution | Mirroring stops. Cannot pause withdrawal. |
| Keeper | Liveness only | Vaults drift from their sources, visibly. No loss of custody. |
| Indexer | History only | History unavailable. Live state unaffected. |
| Identity provider | Display only | Names and avatars disappear. Mirroring unaffected. |
| Base asset (WETH) | Behaving like WETH | Upgradeable by bridge governance — outside this protocol's control. |
#What is not trusted
- The source account. It has no permissions.
- The keeper's choice of trade. It has none.
- The identity provider. It is advisory and structurally isolated.
- The read model. It is never authoritative.
#The three structural guarantees
These hold because of what the code is, not because of what a role promises.
No upgrade path. No proxy, no delegatecall to a mutable implementation. What is deployed is what runs, forever.
No arbitrary execution. The order struct passed to an adapter has no calldata field and no recipient field; the recipient is forced to the calling vault. Approvals are exact and revoked in the same transaction, with the residual asserted to be zero.
No pausable exit. redeemInKind has no pause check and never calls the price path.
Security. The third is tested directly: force every price feed to fail, assert
totalAssets()reverts, then assert the in-kind exit still succeeds. If that test ever fails, the central promise of the design has been broken.
#Where the design chooses to fail closed
Refusing to act is cheap; acting on a wrong number is not. So:
- unpriceable position → NAV reverts → deposits refused
- unapproved asset → never bought, and excluded from the denominator
- price adapter unsure → reverts rather than guessing
- non-EVM identity → refused as structural mismatch, not retried
#What this does not protect against
Read Known limitations and the Threat model. The protocol is unaudited and has never run on mainnet.