VANEVault Autonomy EngineBY KESTREL

VANE · Vault Autonomy Engine

The vault that can't be emptied by its own advisor.

VANE is the on-chain program under every Kestrel portfolio. Your assets sit in a vault only you can open. The advisor is granted exactly one power — rebalance inside it — and eight checks on every swap make sure that is all it ever does.

Read the guarantees View the code

In development Program written and under test. External review of every invariant below precedes any mainnet funds; the pilot runs under per-vault caps.

$VANE is liveAxho6eDr…jhyypump

How the engine is wired

Two keys. One vault. One permitted move.

Green paths are yours and never close. The steel path is the advisor's — a single instruction, and both ends of every swap must land back inside your vault.

OWNER Your wallet holds the keys signs withdraw · pause · reconfigure VAULT Program-derived account USDC · vault-owned account SPYx · vault-owned account GLDx · vault-owned account every asset account is owned by the vault, not by a person ADVISOR Delegated keeper one instruction only rebalance_swap WHITELISTED VENUE single permitted swap program deposit withdraw — never gated rebalance_swap only both ends of every swap leg are vault-owned accounts to any other account no instruction exists 1 2 3 4 5 6 7 8
Check 1 of 8 Signer is the vault's delegate, and the vault is not paused.

Smallest possible surface

Three accounts. Five instructions. Nothing else.

Every privilege the advisor has is enumerated on-chain. Anything not on this list is denied by construction — there is no "admin override", no hidden path, no upgrade-by-mutation.

Vault

One per owner. Records the portfolio it follows, the delegate allowed to rebalance, a user-set pause flag, the cooldown stamp and a rolling traded-notional counter.

["vault", owner]

Portfolio definition

Target weights and the mint list for Roost, Perch, Soar and Apex. Immutable once active — a change is a new version, and your vault adopts it only when you sign.

["portfolio", id, version]

Whitelist

The permitted assets, the single permitted swap program, and the per-epoch notional cap. Append-only: versions are added, never edited in place.

["whitelist", version]
InstructionWho signsWhat it may do
open_vaultYouCreate the vault and its asset accounts; set the delegate to the published keeper key.
depositYouMove USDC from your wallet into the vault.
rebalance_swapAdvisorOne swap leg through the whitelisted venue, subject to all eight checks. The advisor's only instruction.
withdraw · withdraw_allYouMove any holdings back to your wallet. Never gated by the delegate, the pause flag or the cooldown.
set_portfolio · set_paused · set_delegateYouChange what the vault follows, freeze the advisor, or replace it.

The heart of the system

Eight checks on every swap.

All eight run inside the program on every rebalance_swap. Any one failing rejects the transaction. Select a check to see where it sits in the engine.

  1. Right signer, vault liveThe signer must be the vault's delegate, and the owner's pause flag must be off.
  2. Source is yoursThe account being sold from is owned by the vault and holds a whitelisted asset.
  3. Destination is yoursThe account being bought into is also owned by the vault and holds a whitelisted asset. Value cannot leave.
  4. One venue onlyThe swap call targets exactly the whitelisted swap program. No arbitrary program calls.
  5. Minimum out, verified afterThe vault's own balance is re-read after the swap; the received amount must meet the floor. The router's word is not trusted.
  6. No over-spendThe amount that left the source cannot exceed what this instruction authorised — route tricks can't drain more.
  7. CooldownThe first leg of a plan must respect the on-chain cooldown; later legs within a fifteen-minute window share the stamp.
  8. Epoch capTraded notional this epoch plus this leg must stay under the whitelist's cap. A compromised keeper is bounded to slippage grinding — and the bound is on-chain.

Guarantees, not promises

What VANE can never do.

These are the invariants the program is built to and the external review is scoped to. Each one maps to a specific threat in the Kestrel threat model.

I-1

No instruction can move value to any account that isn't owned by the vault or by you. The advisor has zero paths to third-party accounts.

Stops: keeper key theft
I-2

Withdraw requires your signature and can never be blocked by the advisor. Pause freezes the advisor, never you.

Stops: funds held hostage
I-3

The advisor's only instruction is rebalance_swap, and both ends of every swap are vault-owned accounts of whitelisted assets.

Stops: exfiltration by swap
I-4

No admin key can move user funds. Kestrel publishes portfolio and whitelist versions; adopting one is always your signature.

Stops: admin rug
I-5

Minimum-out is enforced by re-reading the vault's own balance after the swap.

Stops: bad-route griefing
I-6

Exactly one swap program is callable per whitelist version.

Stops: fake pools, arbitrary calls
I-7

Per-epoch traded notional per vault is capped on-chain.

Bounds: compromised-keeper damage
I-8

Whitelists and portfolio definitions are append-only. Nothing is mutated in place.

Stops: silent weight changes
I-9

Program upgrade authority sits behind a multisig and timelock from the second milestone, and is published on this site when live.

Stops: upgrade-authority abuse

Your kill switch

Pause stops the advisor. It never stops you.

Flip set_paused and every rebalance_swap is rejected at check one. Your deposit and withdraw paths don't read the flag at all. If the keeper disappears tomorrow, your withdraw still clears — it never touched the keeper in the first place.

Where it stands

Built. Under test. Reviewed before it holds a dollar.

01Program written

Vault, portfolio definition and whitelist accounts; the five instructions; all eight swap checks and a route guard against foreign vault accounts.

02Adversarial test suite

Every invariant has a negative test that must fail on-chain: slippage, over-spend, wrong signer, wrong venue, foreign accounts in the route, paused vault, epoch cap.

03External review

Independent review scoped to I-1 through I-9 plus an internal pass attempting each threat in the model, before any real-funds exposure.

04Capped pilot

Mainnet with per-vault caps and a published upgrade authority. Caps lift only after the review closes.

VANE is the reason Kestrel can be an advisor without being a custodian.