Admin
Protocol administration
Bounded configuration for the index, Reserve, Depth, Engine, pricing and rebalancing. Every operation names the call it maps to and the role that call requires.
Contract-enforcedAdmin cannot move Reserve assets outside contract limits. There is no governor withdrawal path on the Vault — not a disabled one, an absent one — and a test reads the Vault ABI and fails if such a function ever appears. Every parameter below is bounded by an immutable cap, timelocked, versioned and emitted onchain.
Authority
Not deployedWho holds each role on the live deployment. Read from the contracts, not from this page’s configuration — a console that displayed its own idea of who governs would be describing an intention rather than a fact.
| Contract | Governor | Pending | Guardian | Paused | Guardian action |
|---|---|---|---|---|---|
| IndexVault | — | — | — | Not live | |
| IndexRouter | — | — | — | Not live | |
| ReserveController | — | — | — | Not live | |
| EngineController | — | — | — | Not live | |
| AssetRegistry | — | — | — | Not live |
Governor
Configures. Transferred in two steps.- Propose and commit methodology and Engine configuration
- Approve markets, set Depth ceilings and per-market caps
- Appoint operators, redeemers and the guardian
- Unpause
- Withdraw Reserve assets — no such function exists
- Skip a timelock, or mint shares directly
Guardian
Stops things. Cannot start them.- Pause any contract
- Halt a market adapter against new Depth
- Cancel a rebalance proposal mid-ramp
- Unpause — deliberately governor-only
- Change any configuration value
- Move capital in any direction
What is not hereOnly guardian actions are exposed in this console, and only pausing. Unpause is absent by design — a guardian that could unpause would simply be a governor. Every governor action — transferring governance, changing configuration, setting limits, appointing operators — carries a timelock precisely because it is meant to be slow and witnessed, and belongs in a multisig rather than behind a browser button.
Governance operations
- Transfer governanceNominates a successor. Nothing changes until the nominee accepts, so a typo cannot orphan the protocol.
- Accept governanceCalled by the nominee. This is the step that actually moves the role.
- Set guardianReplaces the pause-only role.
- PauseStops state-changing entry points on a contract. Redemption paths are deliberately excluded.
- UnpauseGovernor only. A guardian that could unpause would be a governor.
Read-only
How a methodology change lands
- ProposeParameters are validated on submission, not on commit. An impossible methodology cannot be queued, let alone enacted.
- WaitThe timelock runs in full. There is no expedited path, because the delay is the entire protection.
- CommitPermissionless once the delay has elapsed — after the wait there is nothing left to deliberate, so the governor is not a bottleneck.
- VersionThe version number increments and is emitted. Every screening result and weight computation is attributable to one version.
Operations
- Propose methodologyQueues a new parameter set behind the timelock. Validated now, enacted later.
- Commit methodologyEnacts the queued set once its delay has run.
- Cancel proposalDrops a queued set without enacting it.
- Record reviewMarks the periodic review as performed and restarts the clock.
- Set metrics sourceRepoints the market-cap, liquidity and volume feed.
—
Not live—
Not live—
Not live—
Not liveCore / Depth split
TOTAL RESERVE ├─ CORE RESERVE held directly for exposure and redemption ├─ DEPTH SLEEVE bounded, approved for market-making │ ├─ Market A – J deployed into constituent venues │ └─ Idle Depth approved but unallocated └─ ACCRUED FEES market fees owed to the Reserve
Operations
- Approve a marketAdds an adapter to the set the Controller may send capital to. Capital can only ever reach an approved adapter.
- Set per-market ceilingCaps how much of the Sleeve one constituent may consume.
- Set Depth limitsThe Sleeve ceiling and the idle floor, both on the Vault.
- Appoint an operatorMay deploy and rebalance Depth. Cannot redeem.
- Appoint a redeemerMay only unwind Depth back to core for a redemption — strictly weaker than an operator.
- Sweep surplusMoves an unaccounted balance into the accounting rather than leaving it stranded. It cannot leave the Vault.
Exclusive bucketsCore, idle Depth, deployed Depth and accrued fees are separate balances that sum to the accounted Reserve. Every mutation re-checks that sum before it returns, so a unit of an asset is in exactly one state at all times.
| Market | Index weight | Band | Depth | Utilization | State |
|---|---|---|---|---|---|
A PROJECT A / USDG | 12.0% | 10.5–13.5% | — | — | Not live |
B PROJECT B / USDG | 11.5% | 10.0–13.0% | — | — | Not live |
C PROJECT C / USDG | 11.0% | 9.5–12.5% | — | — | Not live |
D PROJECT D / USDG | 10.5% | 9.0–12.0% | — | — | Not live |
E PROJECT E / USDG | 10.0% | 8.5–11.5% | — | — | Not live |
F PROJECT F / USDG | 9.5% | 8.0–11.0% | — | — | Not live |
G PROJECT G / USDG | 9.0% | 7.5–10.5% | — | — | Not live |
H PROJECT H / USDG | 8.5% | 7.0–10.0% | — | — | Not live |
I PROJECT I / USDG | 9.0% | 7.5–10.5% | — | — | Not live |
J PROJECT J / USDG | 9.0% | 7.5–10.5% | — | — | Not live |
Operations
- Allocate to the SleeveMoves capital from core into idle Depth. Bounded by the Sleeve ceiling and the idle floor.
- Deploy to a marketSends idle Depth to an approved adapter. Credits what the adapter reports consuming, not what was sent.
- Move between marketsRebalances Depth without a round trip through core.
- Return to corePulls Depth back out of the Sleeve.
- Settle a marketWithdraws a fraction of an adapter position and books the result, gain or loss.
- Unwind for redemptionPulls exactly what a redemption needs. The one Depth call a redeemer may make.
- Halt a marketStops an adapter accepting new Depth. Withdrawal stays open.
Withdrawal is never gatedHalting an adapter blocks new Depth only. Removal and fee collection stay callable while halted and while paused, because a market pause that could trap capital is a market pause that can block a redemption.
Bounds are timelocked; the fee is notChanging the bounds a fee may move within is the dangerous operation, so it is proposed and committed after a delay. Moving a fee inside already-published bounds is routine and immediate. Three independent clamps apply to every published fee: the configured range, the per-update change limit, and the adapter's own immutable bounds.
Configuration
- Initialise a marketFirst configuration. Rejects a band that does not bracket its target, or a base fee outside its own range.
- Propose a config changeQueues new bounds behind the timelock.
- Commit a config changeEnacts queued bounds once the delay has run.
- Cancel a config changeDrops a queued change. The live bounds never moved.
- Repoint the price sourceChanges where the Engine reads constituent prices.
Safety controls
Independent
GuardianIndependent
GuardianAlways
Never gated- Pause dynamic feesThe Engine stops publishing. The last published fee stays in force, so pools keep trading.
- Disable a marketThe Engine stops steering it and targets zero Depth for it.
- Pause Depth allocationPausing the Controller stops new deployment. Unwinding is not affected.
A pause cannot strand a redemptionRedemption calls into the Controller to unwind exactly what it needs before settling. That path stays open while the Engine is paused, while fees are paused and while an adapter is halted. The Engine holds no capital at all — a test reads its ABI and fails if a capital-moving function ever appears on it.
What a price must survive to be used
- 01Not protocol-ownedAn INDX-controlled pool can never become its own authoritative oracle. Registered adapters are checked against the protocol-owned set on every read.Enforced
- 02Cross-check agreementA second independent source must agree within the configured deviation, or the price is refused.Enforced
- 03Not staleAn observation older than the staleness bound is refused rather than used.Enforced
- 04Not future-datedA timestamp ahead of the block is refused, with a small skew tolerance. Without this check a forward-dated observation would sail past the staleness test.Enforced
- 05Minimum liquidityA reference pool below the liquidity floor does not price anything.Enforced
- 06Minimum TWAP windowA window shorter than the configured minimum is refused, because a short window is a cheap window to move.Enforced
Operations
- Register a feedBinds an asset to a price adapter, its cross-check and its bounds.
- Enable or disable a feedTakes a feed out of service without deleting its configuration.
- Mark an adapter protocol-ownedAnything marked here can never price an index asset.
Valuation can only grow the SleeveA price is required to expand Depth, never to contract it. A stale or refused oracle therefore stops new allocation and blocks nothing else — it cannot trap capital, and it cannot prevent a redemption.
—
Not scheduled—
None—
IdleProposal lifecycle
- ProposedThe review has run on-chain: screen, rank, take the top N, compute weights. Current weights are snapshotted as the ramp's starting point.
- ExecutingActivation is permissionless once the timelock has run. From here the permitted weight for each constituent slides toward its target.
- CompletedThe window has elapsed and every constituent sits at its target.
- CancelledAvailable mid-ramp. Permitted weights snap back to where the proposal started rather than freezing half-applied.
Per-slice limits
All four, because each alone is evadableSmall slices in a rigged pool pass the size and impact checks. A single large fill at a fair price passes impact and deviation. Chained slices inside one block pass everything but the cooldown. They are checked together or not at all.
Guardian action
- Cancel the active rebalanceStops a ramp where it stands. Permitted weights snap back to where the proposal started rather than freezing half-applied. The proposal id is read from the chain, not chosen here.
Operations
- Run a reviewScreens the universe, ranks it, takes the top N and computes target weights. Reverts rather than shipping a thin index.
- ActivateStarts the ramp once the timelock has run.
- CompleteCloses a proposal whose window has elapsed.
- CancelStops a ramp where it stands.
- Set timingThe review timelock and the execution window.
- Set slice limitsDefaults, or tighter values for one asset.
- Reset a cycle totalClears the running executed-volume total for an asset.
Entry and Exit are one mechanismA new constituent starts at its current weight — zero — and slides up to the methodology weight across the window. A removed constituent slides down to zero the same way. There is no separate exit path, which is why an exit cannot be forgotten.
—
Not live—
Not live—
Not live—
Not liveCore invariants
- IndexVaultReserve accountingCore + idle Depth + market positions + claimable fees equals the accounted ReserveFuzzed
- IndexVaultNo double countingOne asset unit exists in exactly one accounting state, and the per-market ledger adds up to the deployed bucketFuzzed
- IndexRouterNo unbacked sharesShare supply never exceeds valid Reserve accountingFuzzed
- IndexVaultDepth capSleeve value cannot exceed its share of Reserve value, and Core cannot fall below its floorFuzzed
- ReserveControllerPer-market capNo deploy or move may push one venue past its share of an asset's Sleeve. An entry condition, not a held ratio — see belowEntry-checked
- IndexRouterRedemptionDepth deployment cannot permanently prevent valid redemption — including when a market has lost part of its positionFuzzed
- EngineControllerEngine limitsFees and allocations cannot escape configured bounds at any priceFuzzed
What this status meansFuzzed means the contract re-checks the invariant itself, and it is also re-verified after every operation in randomised sequences of hundreds of mints, redemptions, Depth moves, price shocks and market losses. Entry-checked means it is enforced when capital is added, not held as a ratio afterwards. Neither is a proof: fork testing is step 22 and independent security review is step 24. Nothing here has been audited.
Why the per-market cap can driftReturning idle Depth to Core shrinks the Sleeve, which makes every surviving position a larger share of a smaller whole. Holding the ratio continuously would mean refusing to return capital while a market is deployed — letting a concentration figure trap the Reserve. Capital coming home wins. What still holds is that the drifted position stays fully recoverable.
Three bugs this foundA market that had lost part of its position could not be closed out, which left units accounted for that no longer existed and could block every redemption for that asset. Accrued fees were inside the redeemable claim but had no path into Core, so one recorded fee made a full redemption impossible. And the Depth cap failed open: a silent price source removed the Sleeve ceiling and the Core floor entirely, at exactly the moment the data behind them had failed. All three are fixed and all three fixes are mutation-checked.
Handoff §45 test vectors
| Vector | What it checks | Status |
|---|---|---|
| Normal Flow | Mint, Depth deployed, everything in band, fees at base | Passing |
| High buy pressure | Constituent bid up; taking it away is made cheaper | Passing |
| High sell pressure | Constituent sold down; adding it is made cheaper | Passing |
| Constituent underweight | Fees lean against the drift; Depth ceiling unchanged | Passing |
| Constituent overweight | Depth target shrinks as well as the fee spread | Passing |
| Liquidity shock | Eligibility is lost; custody of the units is not | Passing |
| Manipulated spot price | Cross-check refuses the pair; the slice gate refuses the trade | Passing |
| Stale oracle | Growth refused, every unwind and redemption still open | Passing |
| Venue failure | A market that lost capital is written down, not stranded | Partial |
| Depth withdrawal | The Sleeve returns to Core with no price involved | Passing |
| Market pause | New Depth stops; exits do not | Passing |
| Mass redemption | Solvent through every slice of an exodus | Passing |
| Constituent Entry | Accumulates across the window, never in one step | Passing |
| Constituent Exit | Unwinds across the window, never dumped | Passing |
| Tracking difference | Market-making PnL lifts NAV and not the benchmark | Passing |
| Fee accrual | Fees lift NAV, issue no shares, and stay redeemable | Passing |
| Final share redemption | Last share out leaves every bucket at zero | Passing |
Deployment readiness
No contract can check its own wiring — each one sees only its half of every link. A Vault whose minter is the deployment key is a correct Vault with a fatal configuration, and nothing in the Vault can tell. A preflight check reads the deployed system back and reports every misconfiguration it can find; the checks below are each exercised against a system with exactly that one thing wrong.
- Links point at each otherNot merely non-zero: the share, minter, controller and router must all reference the same Vault, and the router must have cached the share after it was set.
- Minter is the routerWhoever holds it can mint. If that is the deployment key, the deployment key can print unbacked supply.
- Router holds the redeemer roleWithout it, nothing fails until a holder tries to exit while capital is deployed.
- Every asset is priceableAn unpriced asset does not throw. It silently contributes nothing to NAV, and now also refuses any Depth allocation.
- Adapter bounds contain the Engine rangeBoth clamp fees. If the Engine range is wider, updates outside the adapter bounds revert and the market silently stops responding to its Band.
- Governance actually movedA nomination is not a handover. Every contract must name the intended governor, not the deploy key.
One vector cannot be run hereA v4 pool failure at the venue level needs a real PoolManager. What is checked instead is the part that reaches the Reserve: a market that stops returning capital can neither strand the Reserve nor block an exit. The venue-level case is step 22.
Deployment
| Contract | Responsibility | Address | Status |
|---|---|---|---|
| IndexVault | Holds the Reserve; no admin withdrawal path | — | Tested |
| IndexShare | The index token; only the Vault may mint | — | Tested |
| IndexRouter | Mint and redeem, in kind | — | Tested |
| IndexBenchmark | Divisor and index level | — | Tested |
| AssetRegistry | Constituent lifecycle and safety flags | — | Tested |
| PriceRegistry | Oracle guards and cross-checks | — | Tested |
| MethodologyRegistry | Screening, weights, timelocked parameters | — | Tested |
| ReserveController | The only mover of Reserve assets | — | Tested |
| EngineController | Bands, fee direction, Depth targeting | — | Tested |
| RebalanceManager | Review pipeline and the entry/exit ramp | — | Tested |
| RebalanceExecutor | Per-slice trading limits | — | Tested |
| V4MarketAdapter | Depth inside a Uniswap v4 pool | — | Unverified |
| V4IndexEngine | Carries the Engine fee into the pool | — | Unverified |
Unverified means unverifiedThe two Uniswap v4 contracts are tested against a mock of v4 written from the same reading of v4 the contracts were written from. If that reading is wrong, both are wrong together and the tests still pass. They are not verified until they run against a real PoolManager on a fork.