Risk and Security Model

AUM Change Limits

The vault enforces asymmetric increase and decrease limits on deployed_aum updates. These are set by the admin in basis points via set_aum_limits(increase_limit, decrease_limit).

• Increase limit — caps how much deployed_aum can grow in a single operator_update_aum call
• Decrease limit — caps how much deployed_aum can fall in a single update (typically set tighter than the increase limit)

This prevents sudden, large NAV swings, whether from operator error or attempted manipulation. The IDL enforces a maximum value via the AumLimitTooHigh error.

Pause Mechanism

The admin can instantly pause all vault operations via pause(). When paused:

• deposit and redeem calls revert with VaultPaused
• Operator functions continue to work (the curator can still manage deployed capital)
• The admin can unpause at any time via unpause()

This provides a circuit breaker in case of an exploit, market event, or strategy issue.

Admin Transfer Safety

Admin role transfers use a two-step nomination process:

1. Current admin calls nominate_admin(new_admin). This creates a NominatedAdmin PDA with the nominee and an expiry timestamp
2. Nominated admin calls accept_admin_nomination(). Must be called before expiry

This prevents accidental or malicious ownership changes. If the nomination expires, it must be re-issued. The NominatedAdmin PDA is closed upon acceptance.

Audit History

Built on the same architecture as Upshift's EVM vaults that secure $400M+ in TVL. Audited 3x in the past 12 months. A separate audit has been conducted for the Solana contracts and can be found here.