> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dionysus.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault

> The contract that holds your capital — roles, surfaces, guarantees.

Each depositor gets their own vault: a smart contract deployed by the factory, owned by the depositor, operated by the agent. This page describes the interface conceptually; the deployed source is verified on the explorer and is the binding reference.

## Roles

| Role         | Held by   | Surface                                                                                                                      |
| ------------ | --------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Owner**    | You       | Deposit, withdraw (all modes), grant/revoke operator, safety settings                                                        |
| **Operator** | The agent | Position management only: mint, rebalance, harvest, rotate — inside the pool allowlist, under swap-loss caps and rate limits |
| **Guardian** | Protocol  | Pause (stops automation, never exits) and safety administration                                                              |

## Owner surface

* **Deposit** — moves tokens in and books them into your contributed capital at feed price. Requires a live price feed for the token (a deposit that can't be priced would corrupt fee accounting).
* **Withdraw** — per-position unwind, partial withdrawal, in-kind withdrawal, reward withdrawal, and pulling loose token balances. Every one of these is the **fee gate**: outbound value is priced, checked against your high-water mark, and only new profit is charged. Multiple positions can be withdrawn in a single transaction via batched calls.
* **Emergency withdrawal** — a best-effort unwind path for a position that resists the normal route; the raw position can be transferred out as-is.
* **Operator control** — grant and revoke the agent's role at will.

## Invariants worth knowing

* **No operator function transfers value out of the vault.** Every release path is owner-only and pays only to the owner (fees to the treasury excepted, and only at the gate).
* **The performance fee is immutable** for the life of the vault, and generation-capped at deployment.
* **Exits have no dependency on automation, pausing, or modules.** They are deliberately self-contained so they work in every failure state.
* **Fee-transfer failure never blocks your payout.** If the treasury transfer fails, the fee is booked as owed and retried later; your withdrawal completes.
* **Stale feeds waive fees.** The vault never charges a fee it cannot price honestly, and emits an explicit waiver event when that happens.
* **Price feeds change only by propose-accept.** No instant feed swaps on a live vault.

## Deployment

Vaults are deployed through the factory in a guided flow: deployment, then an explicit ownership acceptance by you (two-step ownership transfer — you must claim the vault; it cannot be foisted on an address). The factory verifies the vault bytecode against the active generation's registered hash, so every genuine vault is provably running the audited code.