Risk Management Framework
The multi-layered, defense-in-depth safeguards protecting Upshift vaults, from protocol-level constraints to emergency procedures.
Upshift's "Institutional Grade" claim is backed by a multi-layered defense-in-depth strategy. We treat risk as a dynamic variable rather than a static setting.
Protocol-Level Safeguards
Non-Custodial Architecture: Neither Upshift nor the Curator can ever withdraw user funds to an external EOA. Funds can only move between whitelisted "Strategy" contracts (DeFi Protocols) and the vault smart contract.
Withdrawal Liquidity Buffer: A configurable percentage of assets is always held in the "Buffer" to ensure immediate redemptions without forcing a strategy unwind.
NAV Volatility Protection: To protect against price manipulation and oracle latency, Upshift vaults implement a Max Percentage Change constraint. This parameter enforces a strict ceiling and floor on the fluctuation of the share-to-asset ratio within a single update cycle. By capping the rate of change for the vault's NAV, the protocol effectively mitigates risks associated with faulty oracle feeds or erroneous NAV reporting. Furthermore, this mechanism eliminates "latency arbitrage" by preventing MEV snipers from exploiting temporary price discrepancies between the vault and external markets.
Curator-Managed Guardrails
Timelocks: Key parameter changes go through a timelock before they take effect, so depositors have time to exit if they disagree with a change. The delay is configured per vault.
- Timelocked: ownership transfer, the management fee (most vaults; lending-pool vaults do not timelock it), the NAV volatility limit (
maxChangePercent) and the withdrawal period (lagDuration).
To see a vault's timelock delay and any pending changes, use the Governance endpoint.
Emergency Procedures
Emergency functions: The owner multisig can pause deposits and withdrawals at once, independently of each other. The owner can also call emergencyWithdraw, which pauses the vault and sends all assets held in the vault contract to an address the owner specifies. Capital deployed in subaccounts is recalled first with withdrawFromSubaccount. Neither action is timelocked.