Custody model
Who can move funds in a Tuo position, what the keeper can and cannot do, and the one place where funds leave on-chain custody.
Every asset in the Tuo vault belongs to exactly one position. There is no shared pot. The position NFT is the only key: whoever holds it can withdraw, and nobody else can, including Tuo.
The trust boundary
What each party can do
| Party | Can | Can never |
|---|---|---|
| Position NFT owner | Deposit, top up, request and execute a withdrawal, trigger the emergency exit, transfer the NFT | Nothing else. Ownership is the whole authority model |
| Keeper (Tuo) | Swap a position's idle balances between USDC and a pool token, mint and burn liquidity ranges, send hedge margin to the position's bound Hyperliquid operator, pull it back | Send funds to any address other than the vault, Uniswap, the bound operator, or the NFT owner. Exceed 10 actions per position per day or 150 bps of the position's basis in measured loss per day |
| Treasury (2-of-3 Safe) | Grant and revoke the keeper and pauser roles, set the fee recipient, sweep accrued fees, set the per-position cap, maintain the operator allowlist, add or retire a DEX aggregator | Change the fee percentage, upgrade any contract, touch a position, reach a deployed range, move an idle balance, block a withdrawal |
| Pauser | Pause and unpause new deposits | Affect withdrawals or emergency exits in any way |
| Hyperliquid operator | Receive bridged margin, act as the position's Hyperliquid account, approve the vault to pull margin back | Call the vault. It is a destination and a pull source, never a caller |
The contracts are immutable. There are no proxies, and the master admin role that OpenZeppelin's access control provides is never granted to anyone. The deployment script asserts that at deploy time. See Roles and admin controls.
The keeper perimeter
The keeper is the only Tuo role that can move a position's assets, and the vault bounds it on every call:
- Allowlists. Liquidity can only go into pools fixed at deployment. Swaps can only run through aggregators the treasury has allowlisted, with an exact-amount approval that is cleared in the same transaction.
- Price floors. Every swap and every range burn must return at least a floor derived from the pool's own 30-minute average price, and every keeper price path refuses if the spot price has moved more than about 2% from that average.
- Budgets. At most 10 metered actions per position per rolling 24 hours, and at most 150 basis points of the position's basis in measured value loss per rolling 24 hours.
- The hedge cap. Margin sent to Hyperliquid can never exceed the product's cap: 50% of basis for Basis Plus Core, 90% for Delta Hedge Standalone.
The loss budget is a rate limiter, not a solvency guarantee. It makes a hostile keeper slow enough to notice: 150 bps per day compounds to roughly 36% of a position in a month. The real bound is detection plus the treasury Safe revoking the keeper role, which is why keeper losses are a mandatory alert in Tuo's monitoring. See Operational risk.
Where funds leave on-chain custody
Hyperliquid credits deposits to the sending address, and a smart contract cannot sign Hyperliquid
orders. So the vault cannot hold the hedge itself. Instead, bridgeToHl pays USDC to a
Tuo-operated externally owned account whose key lives in a cloud HSM, and that account deposits
the margin on Hyperliquid and signs the short.
From that transfer until the margin is pulled back, the money is outside the vault. It is not valued on-chain, and no contract mechanism forces its return. This is the custody gap, and Tuo discloses it rather than describing the platform as fully non-custodial.
What bounds it:
- Only an operator on the treasury-maintained allowlist can receive margin.
- A position binds to the first operator it bridges to and can never be re-pointed to another.
- Margin sent can never exceed the product's hedge cap.
- No margin can leave while a withdrawal request is armed.
- Margin returns are measured: the vault credits what actually arrived, never what was promised.
What it means for the numbers: at the hedge cap, up to 50% (Basis Plus Core) or 90% (Delta Hedge Standalone) of a position's basis can sit at the operator account and on Hyperliquid at any moment.
The guaranteed exit
emergencyWithdraw is the door that always opens. No Tuo role can block it. It closes every open
range, pays every idle balance to the owner in kind, works while deposits are paused, and needs no
price feed to succeed. If margin is still at Hyperliquid, that margin becomes a claim ticket on
the position; when it comes home, the vault pays it directly to the NFT owner.
The claim ticket is a ledger entry, not an escrow. If the keeper never brings the margin home, the owner's claim on it is not enforceable on-chain. This limitation is stated in the auditor note and bounded by the hedge cap, the operator allowlist and the per-position binding. See Withdrawals and Counterparty and venue risk.
On chain
The accounting behind this model is direct to verify. For every token the vault holds, its balance equals the sum of every position's idle balance in that token plus fees accrued and not yet swept. That identity is a checked invariant in the contract test suite, along with "the keeper is never enriched" and "the owner can always exit". See Architecture.