Skip to main content
The vault is the heart of the protocol — a PDA that holds state and delegates authorization and fees to pluggable programs. A manager has execution rights under constraints, never direct fund control.

​
The Vault struct

Vaults are PDAs with customizable seeds. The policy_account points at the authorization program; the authority is the manager who can propose and execute transactions under that policy’s constraints.

​
The Transaction struct

A proposed CPI is stored in a Transaction PDA before it can execute. did_execute is a one-shot replay guard.

​
PDAs explained

A Program-Derived Address is a deterministic Solana address derived from a program plus a seed — it has no private key, so only the owning program can sign for it. Hyro uses two distinct PDAs to separate duties:

​
The non-custodial security triangle

A manager never signs as the vault. To act, the manager:
1

Proposes via create_tx

Calls create_tx with a proposed CPI — target program id, accounts, and instruction data — stored in a Transaction PDA. The core fires validate(Creation), which the policy may reject.
2

Executes via execute_tx

Later, execute_tx fires validate(Execution) and, only on approval, replays the proposed CPI with invoke_signed under the vault’s authority PDA.
The manager holds execution rights under constraints, never custody. The proposal and its execution are authorized independently — this is the multisig-like pattern at the core of the protocol.

Validation CPI

The validate interface, in detail.

Program topology

How the programs connect.