Skip to main content
No. The operator role has no function that moves value out of your vault. The worst a fully compromised agent key can do is manage positions badly within on-chain rate limits and swap caps. Theft would require a bug in the vault contract itself — see Smart contract risk — not a compromise of our systems.
No. Pausing stops automation only; every owner withdrawal path works during a pause, during a suspension, and with the operator revoked. This is contract behaviour, not policy. See Guardrails.
Your vault keeps existing and your exit keeps working. Withdrawal functions are owner-only and self-contained — callable from any interface, including a block explorer, with no dependence on our servers or the agent.
At any time, unilaterally, by revoking its operator role on your vault. Automation stops, positions hold, exits work.
The system’s reflex is suspension: automation stops, the app shows it loudly, and exits stay open. Fees that can’t be priced fairly are waived; fee transfers that fail are deferred without touching your payout. Failures are designed to degrade toward the owner’s benefit.
The vault contracts go through security review before launch; reports are published under Security as they complete. Audits reduce risk — they never zero it.
Deposits and fee accounting use accepted price feeds with staleness checks. A stale feed blocks deposits (never exits) and waives fees rather than compute from a bad price. Feed changes on a live vault follow a propose-accept process — no instant swaps.
The market. Your vault holds volatile assets, and no contract design protects against prices going down. See Price exposure.
Responsible disclosure. Please do not test on live vaults.