Skip to main content
The protocol is not a monolith. A small core program holds vault state and delegates two concerns — authorization and fees — to pluggable programs.

​
The flow

Every privileged instruction is gated by its own validate CPI. Every fund movement is metered by a charge_fees CPI. The claim_fees path is a payout, not a charge.

​
The security triangle

A manager never signs as the vault. Instead:
1

create_tx

The manager proposes a CPI (target program, accounts, data) stored in a Transaction PDA. The core fires validate(Creation) — the policy can inspect the proposal before it’s allowed to exist.
2

execute_tx

Asserts did_execute == false (one-shot replay guard), fires validate(Execution), and only on approval replays the proposed CPI with invoke_signed under the vault’s authority PDA.
The proposal and its execution are authorized independently. The manager holds execution rights under constraints, never custody.

​
Two PDAs, separate duties

​
Pluggability

A vault’s entire economic and authorization configuration is just two on-chain pubkeys plus their config accounts:
  • policy_program — who may do what
  • fee_calc_program — how much is charged
Both are swappable (while transactions are disabled). An LP can read exactly which policy and fee strategy a vault is bound to before depositing.