Hard, on-chain limits
- Pool allowlist. The agent can only touch pools written to your vault’s allowlist. Anything else reverts.
- Per-swap loss caps. Every conversion has a maximum acceptable loss, checked on-chain. Ordinary conversions and rotation swaps each have their own cap. A trade that would exceed it reverts — the agent cannot accept a bad price on your behalf, even if it wanted to.
- Rate limits. Operator actions are rate-limited by the contract. A runaway or compromised agent cannot grind your vault down through sheer churn.
- No exit paths. The operator role has no function that moves value out of the vault. See What the agent can and cannot do.
- Immutable fee. The performance fee cannot be changed for the life of your vault.
Suspension: the safety posture
When something is wrong, the system’s reflex is to stop automation and keep exits open — never the reverse. A vault can become suspended three ways:
Suspension is always shown loudly in the app — a banner, not a footnote. A suspended vault never pretends to be earning.
Oracle honesty
Deposits and withdrawals are valued at oracle prices. When a feed goes stale the vault refuses to guess: deposits of that token stop, and fees on exits are waived rather than computed from a stale number. The waiver appears explicitly in your statement.The design principle underneath all of this: failures degrade toward the owner’s benefit. When in doubt, the vault stops charging, stops automating, and keeps the door open.