Smart Contracts

The protocol adopts a modular smart contract architecture in which user subscription and redemption, asset custody, investment execution, NAV accounting, fee settlement, and permission management are each handled by dedicated contracts. The modules collaborate around the Vault, supporting synchronous settlement, asynchronous requests, and different asset allocation approaches across external protocols.

Architecture Overview

Users subscribe to or redeem from a product through the Vault and hold ShareToken as product shares. Escrow safeguards local assets and keeps categorized records; the strategy manager calls approved adapters through ACModule to allocate assets to external protocols. The valuation module aggregates assets and positions, the accounting module computes the per-share NAV from them, and the fee and rule modules execute at the corresponding business stages.

Business Layer	Main Contracts	Role
User entry and custody	CoreVaultSync, CoreVaultAsync, Escrow, ShareToken	Process subscriptions and redemptions, safeguard local assets, record product shares
Asset allocation	ACModule, AdapterRegistry	Execute investment plans; manage allowed adapters and assets
Valuation and queries	AssetSummedNAVOracle, OffchainAssetPriceOracle, Accountant, VaultAccountingLens	Aggregate asset value, compute per-share NAV, provide fee and trade previews
Fee management	FeeRouter, EntryFixedBpsFee, ExitFixedBpsFee, TimeAccrualFee, HWMPerformanceFee, ProjectFeeTreasury	Compute, settle, and distribute fees
Permissions and business rules	AccessManager, VaultPolicyRouter, LifecycleRule, VaultLimitGuard, SubscriptionWhitelistGuard	Manage operation permissions, open windows, product limits, and subscription eligibility
External protocol access	Various Adapters, TopnodRouter	Connect external vaults, trading pools, asynchronous orders, and cross-chain fund channels

In this document, "base asset" is the asset a product uses for subscription, redemption, and unified valuation; "shares" refers to the ShareToken; "NAV" refers to the accounting value of a product's assets; a "Keeper" is the execution account that holds settlement permission.

Vaults, Custody, and Shares

CoreVaultSync: Synchronous Vault

CoreVaultSync is the user entry point for synchronous products. On a successful subscription, assets are transferred into the custody contract and the user receives shares in the same transaction; on a successful redemption, the corresponding shares are processed and the base asset is paid to the designated recipient in the same transaction.

It supports subscribing by asset amount, subscribing by target share amount, redeeming by shares, and withdrawing by target asset amount, together with the corresponding fee and conversion previews. An actual transaction coordinates rule checks, fee settlement, and a valid-NAV read, after which Escrow completes the asset and share operations.

Synchronous redemption relies on base assets already available in Escrow. External positions must first be exited through the asset allocation module and returned to the custody account before they can be used for payout.

CoreVaultAsync: Asynchronous Vault

CoreVaultAsync separates request submission from actual settlement, suiting products that need to wait for funding arrangements or external asset exits.

• After a subscription request is submitted, the base asset moves into the pending subscription account; after a redemption request is submitted, the user's shares move into the locked account.
• A Keeper can settle requests one by one or in batches. Each request is computed at the effective NAV and applicable fees at settlement time.
• Settlement delivers the shares or base asset directly to the request's asset owner within the same transaction; the user does not need to claim afterwards.
• An unsettled request can be cancelled by the asset owner or an authorized operator, returning the corresponding assets or shares.

This contract uses ERC-7540-style request and operator-authorization interfaces and adopts a settle-and-deliver workflow. Integrations should process orders around the request, cancellation, and settlement states, and must not assume a claim-after-settlement flow.

Escrow: Asset Custody and Categorized Bookkeeping

Escrow safeguards the product's assets on this chain and records balances separately by purpose, including pending subscription assets, in-processing subscription assets, assets available for allocation or payout, and locked shares awaiting redemption settlement.

Vault, FeeRouter, and ACModule call Escrow under their respective permissions to execute asset payouts, trade funding disbursement, trade-return booking, and share minting, burning, and transfer. Categorized bookkeeping keeps funds from unfinished subscriptions clearly separated from assets that already belong to the product portfolio.

Escrow also distinguishes booked balances from unrecorded balances transferred in additionally. Transferring directly to the custody address neither completes a subscription nor automatically produces product shares.

ShareToken: Product Share Token

ShareToken is an ERC-20 share token independent of the Vault that records users' product shares and supports standard balance queries, transfers, and approvals.

Protocol-level minting, burning, and controlled transfers of shares are performed by the authorized custody contract for subscription, redemption, request locking, and fee settlement. ShareToken also exposes the base-asset-to-Vault relationship so integrators can discover the corresponding product entry point.

Share quantity and the base-asset value it represents are distinct concepts; the actual conversion is determined jointly by the NAV and applicable fees.

Asset Allocation and Execution

ACModule: Asset Allocation Execution Hub

ACModule receives trade plans submitted by the strategy manager or an authorized trade executor and coordinates Escrow and adapters to carry out investment operations.

Before execution, it checks whether the adapter is enabled and whether the input and output assets are approved, and invokes the relevant business rules. When funding is required, Escrow disburses to the adapter; for synchronous completion, the trade result and the minimum-output requirement are verified against Escrow's actual balance change.

For asynchronous trades, ACModule receives the assets returned by the registered adapters and completes custody booking. It also provides a liquidity-preparation entry point that can replenish the base asset through redemption plans; this entry requires that available funds have reached the target when execution ends.

AdapterRegistry: Adapter and Asset Registry

AdapterRegistry maintains the list of adapters available to the product, including adapter address, category, chain, enabled status, and the assets each adapter is allowed to handle.

It provides trade admission checks for ACModule and sources positions and asset scope for the valuation module. Administrators can enable or disable adapters and adjust supported assets; removing an asset checks position status by adapter category, preventing necessary configurations from being removed while related business exposure still exists.

Disabling an adapter blocks new trade calls; existing positions are still valued under the valuation rules.

Valuation, Accounting, and Queries

AssetSummedNAVOracle: Portfolio Asset Valuation

AssetSummedNAVOracle converts the product's effective assets and adapter-reported positions into a unified base-asset value, providing the portfolio's total assets and valuation validity to Accountant.

It aggregates the effective booked assets in Escrow plus the positions reported by local and mirror adapters. Non-base assets require a preconfigured valuation method: external vault shares can be valued through the target vault's conversion interface; other assets can be converted via a price oracle.

Pending subscription funds are excluded from the effective assets attributable to existing shares. Adapters registered directly as the remote type are not read individually; a cross-chain portfolio can report its aggregate position through a local mirror adapter.

OffchainAssetPriceOracle: Publishing Off-Chain Asset Prices On-Chain

OffchainAssetPriceOracle stores asset prices submitted by authorized price-updater accounts and provides the on-chain valuation input for assets that require external quotes.

It records the price, update time, and an incrementing quote round, supports single and batch updates, and returns whether a price is valid within a default or per-asset staleness window. Price update permission and price-staleness configuration permission are managed separately.

This contract is responsible for storage and staleness checks; the price data itself is provided by authorized updaters.

Accountant: NAV Accounting and Share Conversion

Accountant computes the per-share NAV from the total assets reported by the valuation module and the total supply of ShareToken, and provides conversions between assets and shares.

It provides a unified accounting snapshot to the Vault and the fee modules, including total assets, total shares, per-share NAV, and valuation validity. Reads distinguish a query mode that tolerates stale data from a mode that requires a valid valuation; actual pricing steps such as subscription and redemption settlement use the latter.

Plain asset-share conversions express accounting values. Trade estimates that should include fee effects must use the preview functions of the corresponding Vault or query contract.

VaultAccountingLens: NAV and Fee Previews

VaultAccountingLens is a read-only query contract used by the website, the admin console, and integration systems to simulate asset values and fee effects. Callers can pass in price data packages and compute results without updating on-chain prices or actually charging fees.

It supports management fee estimation, performance fee estimation, fee-adjusted per-share NAV, and simulations of subscription, target-share subscription, redemption, and target-amount withdrawal.

The fee-adjusted NAV simulates the management fee and the performance fee; the subscription and redemption previews consider the management fee and the corresponding entry and exit fees, but do not automatically include the independently settled performance fee. Results are for display and estimation; actual transactions still settle against the on-chain state at execution time.

Fee Calculation, Settlement, and Distribution

FeeRouter: Fee Execution and Settlement Router

FeeRouter connects the fee modules to the Vault's subscription, redemption, asynchronous settlement, and independent fee settlement stages, executes fee calculations in the configured order, and completes asset payouts, share transfers, or share minting through Escrow.

It also provides combined fee previews, passing the asset or share changes produced by earlier fees to subsequent modules. Where a fee module is installed, its order, and its receiving addresses jointly determine a product's charging behavior.

EntryFixedBpsFee: Subscription Fee

EntryFixedBpsFee computes the subscription fee at the configured rate, pays it in the product's base asset to the fee receiver, and supports synchronous subscription, target-share subscription, and asynchronous subscription settlement.

When subscribing with a total spend amount, the contract first separates the fee from the fee-inclusive amount and converts the net subscription assets into shares; when subscribing for a target share amount, the fee is charged in addition to the required net assets. Asynchronous products collect this fee at request settlement.

ExitFixedBpsFee: Redemption Fee

ExitFixedBpsFee computes the exit fee at the configured rate and settles it in product shares.

When redeeming by shares, a portion of the shares goes to the fee receiver and the remainder is exchanged for base assets; when withdrawing by a target asset amount, the contract computes the shares required to complete the withdrawal and adds the corresponding fee shares. Asynchronous redemption fees are handled from the locked shares at request settlement.

TimeAccrualFee: Time-Accrued Management Fee

TimeAccrualFee accrues the management fee from the configured annualized rate, the elapsed time, and the asset-scale base last recorded, prorated over a 365-day year.

The current version first records the accrued fee as a base-asset amount and then settles it to the fee receiver by minting additional product shares. Related subscription, redemption, asynchronous settlement, or independent fee settlement stages can trigger accrual and settlement and update the subsequent fee base.

This mechanism increases the total share supply, and the fee impact is reflected in the per-share NAV. The contract also records cumulative settled fees and allows the fee administrator to reduce fees accrued but not yet settled.

HWMPerformanceFee: High-Water-Mark Performance Fee

HWMPerformanceFee computes the performance fee on the portion of the per-share NAV appreciation above the fee hurdle. The hurdle is the higher of the recorded high-water mark and the configured NAV threshold.

The current version collects the performance fee through a Keeper-initiated independent fee settlement flow and supports settlement either by base-asset payout or by minting product shares. After a successful collection, the contract updates the high-water mark to the post-settlement per-share NAV and records the cumulative fee.

The high-water mark is recorded per product, not per user subscription cost; the configured NAV threshold is likewise a per-share NAV value and is not automatically converted into a time-growing annualized return hurdle.

ProjectFeeTreasury: Fee Distribution Treasury

ProjectFeeTreasury pays beneficiaries according to published distribution results and is used for the onward distribution of fee income. Each instance is configured with a single distribution asset, which can be an ERC-20 token or the native coin.

The distribution manager publishes a Merkle root; beneficiaries submit the corresponding proofs, and the contract verifies their cumulative entitlement and pays the difference after deducting historically claimed amounts. It also supports verifying an entitlement first and then having the beneficiary claim to a designated address.

This contract executes published distribution results; the distribution list and amounts are produced by off-chain business processes. How fees are received and transferred into the treasury is determined by each product's configuration.

Permissions and Business Rules

AccessManager: Roles and Administrative Permissions

AccessManager provides product modules with unified role granting, revocation, and role-admin configuration, so that strategy management, trade execution, request settlement, fee management, price updates, and upgrade permissions can be assigned to different accounts.

It prevents the removal of the last member of a key administrative role, keeping role administration from losing its owner. Upgradeable modules that use this permission system control upgrade operations through a designated upgrade role.

VaultPolicyRouter: Business Rule Router

VaultPolicyRouter mounts rule modules onto the designated business stages of the Vault or ACModule and invokes them uniformly before and after operations.

A product can enable the subscription whitelist, amount limits, and lifecycle rules as needed. Each rule module attaches only to the stages it supports, and administrators can mount, unmount, or toggle them, keeping product rules managed separately from the core fund flows.

LifecycleRule: Subscription and Redemption Open Windows

LifecycleRule manages the product's subscription windows, lockup information, and redemption windows, and checks whether the corresponding window is open when a synchronous subscription or redemption, or an asynchronous request, is submitted.

In the current version, subscription and redemption are each governed by their own windows. The lockup provides product-phase information; if the redemption window overlaps the lockup, an open redemption window still permits redemption or the submission of redemption requests.

For asynchronous requests already submitted, this module does not re-check the open windows at the later settlement stage.

VaultLimitGuard: Trade Limits and Product Size Constraints

VaultLimitGuard controls per-transaction participation amounts and the overall product size. It supports configuring the minimum and maximum asset amount per subscription, the minimum and maximum shares per redemption, a total-asset-size cap, and a total-share-supply cap.

The rules cover synchronous operations and the relevant asynchronous request stages. When checking product size, pending subscription funds are considered according to the respective flow; after a subscription or settlement completes, the actual share supply is also checked against the cap.

In the current version, the redemption minimum is denominated in shares; no minimum redemption asset payout amount is enforced.

SubscriptionWhitelistGuard: Subscription Whitelist

SubscriptionWhitelistGuard restricts which accounts can subscribe to the product and supports administrators updating the list individually or in batches.

Synchronous subscription checks the account that calls the Vault directly; asynchronous subscription requests check the asset owner providing the funds. Therefore, when an integrator calls on behalf of a user, the whitelist subject must be configured according to the flow used.

This rule applies to subscription only; it does not restrict redemption, nor does it act as a whitelist for ordinary ShareToken transfers.

External Protocol Adapters and Business Routing

Adapters convert the calling conventions of external protocols into trade actions that ACModule can execute. Each adapter only handles the operations and assets it supports; trade returns ultimately flow into Escrow, and while a wait state exists, the adapter reports the corresponding positions for the valuation module.

JtrsyAdapter: JTRSY-Style Asynchronous Vault Access

JtrsyAdapter targets the asynchronous subscription and redemption flows of JTRSY-style external vaults, handling request submission, status tracking, and result claiming.

Depending on the target vault's delivery method, it receives the claimed results at the adapter itself first and then transfers the shares or assets into Escrow. This adapts to the target protocol's delivery requirements while preserving the product's unified custody model.

VRPCQAdapter: Vault Access with an External Withdrawal Queue

VRPCQAdapter targets VRPCQ-style vaults that offer synchronous subscription, asynchronous exit, and a separate withdrawal queue.

Besides recording redemption requests, it reads the target vault's withdrawal queue and includes both the unfilled withdrawal amounts and the assets already settled to the adapter but not yet returned to Escrow in its position report. After funds settle to the adapter, a claim action moves them into Escrow and completes the booking.

FaroSwapAdapter: USDC–WPROS Swap

FaroSwapAdapter connects to FaroSwap V3 pools and executes the configured two-way swaps between USDC and WPROS for strategy asset allocation.

The executor selects the pool's fee tier; the adapter resolves the corresponding trading pool and verifies the swap callback source. Swap results are sent directly to Escrow, and the minimum output is checked against the amount actually received; if the swap does not consume all input assets, the remainder is returned to Escrow and its booking is restored.

The current version focuses on the direct swap of this fixed pair.

TopnodAdapter: Asynchronous Buy/Sell Orders

TopnodAdapter submits buy or sell orders through TopnodRouter, recording the order ID, input asset, target asset, amount, and minimum output target, and waits for the external system to call back with settlement.

While waiting, an order is reported as a pending position in its input asset and quantity. On settlement, the adapter verifies the returned assets, routes the fill result and any applicable refunds back to Escrow through ACModule, and closes the order record.

In the current version, a successful order that falls below the minimum output target is recorded as an event and the settlement result is still accepted; this differs from synchronous trades, which revert when the minimum output is not met.

HyperAdapter: Hyperliquid Cross-Chain Funds and Position Mapping

HyperAdapter handles the fund movement between the local Vault and a designated Hyperliquid Manager. It sends the local base asset along a fixed configured route to the remote management contract via TopnodRouter, records the cumulative sent and returned amounts, and handles failed transfer refunds and remote fund returns.

Returned assets are verified and booked into Escrow by ACModule. The remote portfolio is identified by the Manager address as a single aggregate mirror position, expressed at a fixed quantity precision, and participates in local valuation through the configured oracle price.

This contract carries the local fund-channel and position-mapping responsibilities; the remote investment operations are performed by the remote management system, whose internal contracts are outside the scope of the current repository.

TopnodRouter: Order Submission and Callback Forwarding

TopnodRouter is the business router between adapters and the external Topnod service. It supports the submission of asynchronous trade orders and cross-chain fund requests and forwards settlement funds and callback data to the corresponding adapter.

It manages the admitted adapter list, the destination-chain trusted routes, and the external service address; generates order tracking IDs; verifies callback sources; and records processed IDs to prevent duplicate settlement. The specific order or fund business state is maintained by the corresponding adapter.

TopnodRouter uses its own role management configuration to separately control the admission list, the route settings, and the upgrade permissions.

How the Contracts Collaborate

User Subscription and Redemption

In synchronous products, the Vault coordinates the rule, fee, accounting, and custody modules within a single transaction to complete the asset-share exchange. In asynchronous products, the Vault first records requests and custodies assets or locks shares, after which a Keeper settles and delivers the results once the funding and valuation conditions are met.

Both product types use a separate ShareToken to record users' holdings. When product assets are allocated to external protocols, the base assets required for redemption must first exit the relevant positions and return to Escrow.

Strategy Execution and Portfolio Valuation

The strategy manager submits trade plans via ACModule, AdapterRegistry checks the admission scope, the adapters execute the external protocol operations, and Escrow records the actual outgoing and returning funds.

AssetSummedNAVOracle aggregates the effective custodied assets and the adapter positions, converting via OffchainAssetPriceOracle prices where necessary, after which Accountant computes the per-share NAV. The website and the admin console can present simulated fees and the adjusted NAV through VaultAccountingLens.

Fees and Product Rules

VaultPolicyRouter enforces product admission, limit, and open-window rules at the designated stages; FeeRouter invokes the fee modules at the corresponding stages and settles through Escrow. When fee income must be distributed onward, the cumulative-entitlement claiming mechanism of ProjectFeeTreasury can be used.

These modules collaborate through explicit contract responsibilities and permissions, allowing a product to combine different settlement methods, asset access options, fee schemes, and participation rules.