Security and limits
What protects your money, what is checked on every trade, and who holds which power.
The aim is simple: no one but you can take money out of your vault, and every automated move has a hard ceiling. This page lists what protects you and who holds which power.
#The vault
- Every user has their own vault, a small contract created from the site. Only its owner can withdraw.
- Withdrawals always work, even when strategies are paused or the whole protocol is paused.
- Rules, the agent's box and the funds all live in the vault. The protocol hub is a registry and holds no user funds.
#What is checked on every trade
| Check | What it does |
|---|---|
| Oracle minimum | The contract reads the Chainlink price and works out the least it will take: the oracle price minus the rule's slippage (1.5% by default). The vault measures its own balances before and after, and does not trust the swap adapter. Anything worse reverts the whole transaction. |
| Stale prices | Stock feeds update 24/5. When a price is older than 25 hours (a weekend, a closed market), rules pause by themselves and resume when it updates. |
| Corporate actions | If a token has a planned multiplier change (a split, reinvested dividends), it is treated as having no price for an hour before it and two hours after, so rules using it wait. The same happens when the token itself is paused. |
| Pool allowlist | Trades go only through a fixed list of vetted Uniswap v4 pools: 31 pools (26 stock/USDG, 2 stock/WETH, 3 WETH/USDG). A trade can chain up to three pools in one transaction (ETH → USDG → stock). |
| Pool choice | The keeper asks each allowed pool for a quote, simulates from best to worst and sends the first one that passes. If none passes the rule waits, retrying less and less often (up to 10 minutes). |
| Trade cap | A single trade is limited to $250 inside the contract (maxTradeUsd). It is a brake for the beta, set by the owner and shown in the banner at the top of the site. |
| Fee caps | Each fee is limited by the contract to 0.5%. |
| Agent limits | The agent's box is checked when a rule is created and at every run. See The agent. |
#Who holds which power
| Role | Holds | Does not hold |
|---|---|---|
| You (vault owner) | Withdraw, create and cancel rules, draw and revoke the agent's box | — |
| Agent | Create and cancel its own rules; trade by itself if enabled, inside the box | Withdrawing, your rules, changing its box |
| Keeper | Run a due rule, as signed by the owner, at the price the contract checks | Changing a rule, withdrawing |
| Guardian | Pause executions (a hot key that can only pause) | Unpausing, touching funds |
| Protocol owner | Oracles, the pool allowlist, operators, fee levels (capped), the trade cap, pause and unpause, banning a keeper | Withdrawing from vaults, taking keeper bonds, taking collected fees |
#Emergencies
- Pause. The owner or the guardian can stop all executions. The owner alone can resume. Withdrawals are not blocked.
- Revoke an operator. The owner can remove a robot address from the allowed list.
- Revoke the agent. You can take the agent's powers away in one transaction, and stop its rules with it.