Security model
The claim is narrow and precise: no address, including ours, has a code path that moves your funds. Everything below is what makes that true rather than marketing.
Principles
- No admin transfer path. No function moves assets to an address a caller chooses — not for a holder, not for the keeper, not for the owner. The basket adapter is the one contract that ever receives funds to trade with, and it is fixed once, before the vault has issued a single share. It cannot be swapped afterwards. The slippage a rebalance may accept is a constant in the code rather than an argument, so a trade cannot be routed through a pool priced to suit and settled at any price. This is a claim about our contracts; it does not bind the issuer of an asset we hold.
- Exit cannot be paused. Redemption has no pause switch. A protocol you cannot leave during a crisis is a protocol you do not control.
- Automation is bounded. The keeper role is deliberately small. See Guardrails for the specific limits.
- Fail closed. When an oracle is stale or a quote is bad, the vault does nothing. Doing nothing is always available and is usually right.
A note on custody
The equity leg is the exception, and it is not a small one. Stock tokens let their issuer pause transfers, burn balances and block addresses. Nobody can take your shares in this vault, but the assets behind them are not beyond the issuer's reach. Only the lending leg is free of that.
If you sign in with a social login, an embedded wallet is created for you and the provider holds a key share. That is a real trade-off and we would rather name it than hide it: it removes the seed phrase you can lose, and it adds a party to the signing process. Connect your own signer if you would rather not make that trade. Either way the protocol's guarantee is unchanged, because it is a statement about the contracts, not about where your key lives.