Risk Framework & Emergency

The layered guardrails that constrain curator activity and the emergency unwind sequence when something goes wrong.

Risk Framework and Guardrails

Risk controls are layered; curators should know which constraints are contract-enforced and which are process-enforced.

Guardrail	What it does	Enforced by
Non-custodial perimeter	Neither Upshift nor the curator can move funds to an external EOA; transfers limited to vault ↔ subaccount ↔ whitelisted strategy contracts.	Smart contract
Policy engine	Whitelists the exact protocols, contracts, and functions a curator may call.	Subaccount layer
Liquidity buffer	Configurable % of assets held in-vault for instant redemptions; no forced unwinds.	Contract + ops
NAV volatility protection	Max percentage change per update cycle; mitigates bad oracles, erroneous NAV, and MEV/latency arbitrage.	Smart contract
Timelocks	24h delay on fee changes and withdrawal-period changes; users can exit before changes take effect.	Smart contract
Hypernative monitoring	Automated unwinds on critical alerts.	Integration
Emergency functions	Multisig can instantly pause deposits/withdrawals and pull all strategy funds back into the vault.	Owner multisig

On critical alerts — an exploit on a whitelisted venue, an oracle failure, a depeg — the response sequence is:

Automated unwind. Hypernative may auto-unwind affected DeFi positions on critical alerts.
Curator unwind. The curator unwinds remaining exposure and returns capital to the subaccount.
Recall. The operator pulls funds back into the vault with withdrawFromSubaccount.
Lockdown. The owner multisig can pause deposits/withdrawals (pauseDepositsAndWithdrawals) and, if needed, sweep with emergencyWithdraw to a safe destination.