Curator Model

An appointed curator (the operator) manages the vault's yield strategy by moving capital into and out of a whitelisted set of subaccounts. Each subaccount has one of two types, registered at the time it is added:

Subaccount Type	Custody Model	NAV Accounting
Strategy	Another Soroban contract that implements the vault's IStrategy interface (deposit, withdraw, get_balance, get_local_balance, get_asset)	Self-reports the full position (idle + deployed) on every NAV calculation via get_balance()
EOA	A MPC-controlled address (via Fordefi)	Vault-controlled tracker (WalletNetDeployed) maintained per-wallet and aggregated as deployed_assets

The operator interacts with subaccounts through the following entrypoints:

Operation	What It Does
deposit_to_subaccount	Transfers tokens from the vault to a subaccount. For Strategy targets, also calls IStrategy::deposit so the strategy knows tokens have arrived. For EOA targets, increments WalletNetDeployed and the aggregate deployed_assets.
withdraw_from_subaccount	Pulls tokens back. For Strategy targets, calls IStrategy::withdraw (push model). For EOA targets, pulls via SEP-41 transfer_from (the wallet owner must have pre-approved the vault as spender), then decrements the tracker and the aggregate.
update_wallet_deployed	Reconciles a single Wallet subaccount's attributed value used to recognize gains, losses, or external dust. Moves the per-wallet tracker and the aggregate deployed_assets in lockstep.
update_wallet_deployed_batch	Reconciles multiple Wallet subaccounts atomically. The per-call AUM rate limit is applied to the net delta, so a batch with offsetting moves (+100k on A, −100k on B) passes the limiter.
update_deployed_assets	Aggregate-only emergency reconciliation. Documented as deprecated for routine use after the introduction of per-wallet attribution.

Subaccount membership is controlled by the admin via add_subaccount and remove_subaccount. The admin is a multi-sig address with an signer quorum involving all parties of the upshift vault. The whitelist is capped at 10 entries.

The curator operates within strict bounds set by the Upshift team. A policy engine governs which protocols, contracts, and functions the curator is authorized to interact with as part of the vault's strategy. As an additional safety measure the admin sets AUM change limits, capping how much deployed_assets can move per update and per rolling window, preventing sudden NAV manipulation.