Upshift Docs

How an appointed curator moves Stellar vault capital across whitelisted Strategy and EOA subaccounts within admin-set bounds.

An appointed curator (the operator) manages the vault's yield strategy by moving capital into and out of a whitelisted set of subaccounts. Each subaccount has one of two types, registered at the time it is added:

Subaccount Type	Custody Model	NAV Accounting
Strategy	Another Soroban contract that implements the vault's `IStrategy` interface (`deposit`, `withdraw`, `get_balance`, `get_local_balance`, `get_asset`)	Self-reports the full position (idle + deployed) on every NAV calculation via `get_balance()`
EOA	An MPC-controlled address (via Fordefi)	Vault-controlled tracker (`WalletNetDeployed`) maintained per-wallet and aggregated as `deployed_assets`

The operator interacts with subaccounts through the following entrypoints:

Operation	What It Does
`deposit_to_subaccount`	Transfers tokens from the vault to a subaccount. For Strategy targets, also calls `IStrategy::deposit` so the strategy knows tokens have arrived. For EOA targets, increments `WalletNetDeployed` and the aggregate `deployed_assets`.
`withdraw_from_subaccount`	Pulls tokens back. For Strategy targets, calls `IStrategy::withdraw` (push model). For EOA targets, pulls via SEP-41 `transfer_from` (the wallet owner must have pre-approved the vault as spender), then decrements the tracker and the aggregate.
`update_wallet_deployed`	Reconciles a single Wallet subaccount's attributed value, used to recognize gains, losses, or external dust. Moves the per-wallet tracker and the aggregate `deployed_assets` in lockstep.
`update_wallet_deployed_batch`	Reconciles multiple Wallet subaccounts atomically. The per-call AUM rate limit is applied to the net delta, so a batch with offsetting moves (+100k on A, −100k on B) passes the limiter.
`update_deployed_assets`	Aggregate-only emergency reconciliation. Documented as deprecated for routine use after the introduction of per-wallet attribution.

Subaccount membership is controlled by the admin via add_subaccount and remove_subaccount. The admin is a multi-sig address with a signer quorum involving all parties of the Upshift vault. The whitelist is capped at 10 entries.

The curator operates within strict bounds set by the Upshift team. A policy engine governs which protocols, contracts, and functions the curator is authorized to interact with as part of the vault's strategy. As an additional safety measure the admin sets AUM change limits, capping how much deployed_assets can move per update and per rolling window, preventing sudden NAV manipulation.

Curator Model