Risk Controls for Institutional Vaults

Upshift vaults separate control across an owner multisig, an operator, a ProxyAdmin multisig and the curator, and the vault contract enforces most of these limits onchain. Operational controls, such as MPC signing, maker-checker approval and pre-transaction simulation, cover the steps the contract cannot enforce.

This page is written for risk, compliance and due diligence teams. It describes the EVM vault (TokenizedVault). Solana and Stellar vaults differ in places, listed under Solana and Stellar vaults.

Summary table

Roles

Owner

The owner is a Gnosis Safe multisig. You can read its address on each vault contract (on a block explorer, Read as Proxy, then owner).

The owner configures the vault: fees, deposit caps, per-transaction limits, the deposit asset whitelist, fee collectors and performance fee recipients. The owner is the only role that can call emergencyWithdraw and transfer ownership. The owner can also call every function the operator can call.

Ownership transfer is two-step: the current owner nominates, the new owner accepts, and the transfer goes through the timelock.

Operator

The operator runs the vault day to day. It reports NAV with updateTotalAssets, moves capital between the vault and its whitelisted subaccounts, charges performance fees and processes redemptions.

The operator cannot change fees, caps or whitelists of assets, and cannot call emergencyWithdraw. The owner sets the operator address, so operator independence is a configuration choice by the owner. The contract does not enforce it.

Operator keys are MPC wallets:

• Fireblocks signs the automated backend jobs on supported chains: charging the management fee, collecting fees, NAV updates and yield distribution.
• Fordefi is used where an external party co-signs (a per-partner workspace that holds the operator wallet, subaccount and fee collectors), and on chains that Fireblocks does not support.

Neither MPC provider signs owner functions. Owner functions go through the Gnosis Safe.

ProxyAdmin multisig

Each EVM vault is a transparent upgradeable proxy (EIP-1967). Upgrades to the vault's code are approved by the ProxyAdmin multisig. It is generally a 4 of 6 Gnosis Safe with two signers each from the asset issuer, Upshift and the curator, so no single party can upgrade a vault alone.

A proxy upgrade changes the vault's code, for example to add instant redemption, multi-asset deposits, a bridge or swap module, or an audit fix. Fee levels, the protocol whitelist and the depositor list are parameters. They change through owner functions and do not need an upgrade.

Curator

The curator decides the strategy. The curator is an offchain role: it acts through the operator role and the subaccount, inside the limits the owner and the policy set. The curator cannot move funds outside the vault, its subaccounts and the whitelisted strategy contracts.

LoansOperator

Vaults that lend to institutional borrowers use a LoansOperator. This role is operational and does not exist in the vault contract. It uses an Upshift-managed MPC wallet with a two-signer approval flow, pre-transaction simulation and state checks. It cannot move funds outside the vault and its subaccounts.

Onchain controls

Non-custodial perimeter

Capital moves only between the vault contract, its whitelisted subaccounts and whitelisted strategy contracts. Neither Upshift nor the curator can send depositor funds to an outside wallet through the operator or subaccount paths.

The owner's emergencyWithdraw is the exception. See Emergency withdraw.

NAV volatility limit

maxChangePercent caps how far the vault's reported external assets can move in one update. The cap scales with the time since the last update (maxChangePercent * secondsSinceLastUpdate / 86400). A faulty oracle, an operator error or an attempted manipulation cannot move the share price past this bound in one step. Changes to maxChangePercent go through the timelock.

Pause

The pause stops deposits and withdrawals independently (pauseDepositsAndWithdrawals(bPauseDeposits, bPauseWithdrawals)). On most live vaults only the owner can pause. On a few vaults the owner or the operator can pause. A pause is not timelocked, so it takes effect in the same block.

Emergency withdraw

emergencyWithdraw(receiverAddr) is owner-only. It:

1. Pauses deposits and withdrawals.
2. Transfers all assets held by the vault contract to receiverAddr.

receiverAddr is any address the owner specifies. The contract does not restrict it to depositors.

emergencyWithdraw moves only assets held in the vault contract. It does not pull capital from subaccounts. To recall deployed capital, the operator or owner first calls withdrawFromSubaccount.

Depositor allow-list

A vault can restrict who deposits and withdraws with a senders whitelist. When the whitelist address is zero, the vault is open. Partners use this for allow-listed or single-depositor vaults, for example to limit a vault to wallets that passed the partner's own onboarding checks.

Deposit and withdrawal limits

The owner sets a deposit cap (in reference asset terms) and per-transaction maximums for deposits and withdrawals.

Strategy policy

Where a curator runs on an Upshift Subaccount (a smart-contract wallet owned by the vault, on an Upshift prime account), the policy engine whitelists the protocols, contracts, tokens and functions the curator can call. These policies are onchain and verifiable. The swap module trades only between whitelisted tokens. The bridge module (LayerZero / Stargate, Chainlink CCIP) sends funds only to the vault's own subaccounts on other chains.

Where a curator runs on a Fordefi MPC workspace, the transaction policy is enforced offchain by Fordefi. Changes to it need approval from Upshift and, where applicable, the partner. See Key Management & Execution.

What the timelock covers

Timelocked changes go through an external timelock contract with a schedule, wait, consume pattern. The delay is configured per vault. It is not a fixed value.

Timelocked

• Ownership transfer
• Management fee (most vaults. Lending-pool vaults do not timelock the management fee)
• maxChangePercent (NAV volatility limit)
• Withdrawal period (lagDuration, set with updateTimelockDuration)

Not timelocked

• Proxy upgrades (vault code). These need the ProxyAdmin multisig instead
• Performance fee
• Withdrawal fee and instant redemption fee
• Fee collector and performance fee recipient addresses
• Deposit caps and per-transaction limits
• Depositor allow-list, deposit asset whitelist and subaccount whitelist
• Pause and emergency withdraw

To see the timelock delay and pending changes for a vault, use the Governance endpoint of the Institutional API.

Operational controls

These controls run outside the vault contract. They reduce operational risk, but a depositor cannot verify them onchain.

• MPC signing. Operator transactions are signed through Fireblocks or Fordefi MPC. No single person holds an operator key.
• Maker-checker approval. The Upshift admin portal simulates each operator transaction before it is signed. An approver reviews the simulated state change and approves or rejects it.
• Independent NAV validation. Upshift calculates NAV for Upshift Subaccounts across spot, DeFi, perps and options. On Fordefi workspaces the curator proposes the NAV and the Upshift pricing engine validates it before it reaches the vault.
• Monitoring. Hypernative monitors whitelisted venues and can trigger automated unwinds on critical alerts.

Redemptions

• Queued redemption. A depositor calls requestRedeem. After the vault's withdrawal period (lagDuration, at least one day when set) the request becomes claimable. Upshift processes all claimable redemptions daily. The withdrawal period is set per vault and can carry a withdrawal fee.
• Instant redemption. Vaults that support it let a depositor redeem at once with instantRedeem, for an instant redemption fee. Instant redemption depends on available liquidity in the vault.
• Multi-asset vaults. A multi-asset vault accepts several deposit assets but has one reference asset. Every redemption pays out in the reference asset. For example, a vault that accepts USDC and USDT with USDC as the reference asset pays all redemptions in USDC.

Solana and Stellar vaults

Solana and Stellar vaults are separate programs with their own controls:

• No timelock. No parameter change on Solana or Stellar vaults is timelocked.
• Pause stops both directions. The admin's pause() stops deposits and redemptions together. The operator can still manage deployed capital while paused.
• AUM change limits. The admin sets limits on how far deployed assets can rise or fall per update. Stellar vaults also apply cumulative window limits.
• Two-step admin transfer with an expiry on the nomination.
• Instant redemption. Stellar vaults are instant-redeem only.

See Solana risk and security model and Stellar risk and security model.

What these controls do not cover

• Strategy losses. The controls limit where capital can go and how fast NAV can move. They do not stop a whitelisted protocol from losing money or being exploited.
• Subaccount funds in an emergency. emergencyWithdraw covers only assets held in the vault contract. Capital in subaccounts must be recalled first.
• Code upgrades. Proxy upgrades are not timelocked. Depositors rely on the ProxyAdmin multisig quorum, not on an exit window.
• Offchain policy. Fordefi transaction policies are enforced by Fordefi, not by the vault contract.
• Audits. The contracts have had 11 smart contract audits by 6 independent firms. Audits reduce risk but do not remove it. See Audits & Risk.

Yields are variable and are not guaranteed.

Related pages

• Risk Management Framework
• Risk Framework & Emergency
• Smart Contract Interface
• Multi Asset Vault