Security overview
How Tuo is built to keep customer funds inside the position even when its own operators are wrong, offline or compromised.
Tuo's security model starts from one assumption: the off-chain engine can be wrong and the keeper can be hostile. The contracts are written so that, even then, customer funds can only move back to the owner of the position NFT.
This page lists the layers. The pages that follow cover the audit status, the disclosure process, the exact roles, and the guarded-launch limits.
The layers
| Layer | What it guarantees | Where it lives |
|---|---|---|
| Owner-only exit | Only the holder of the position NFT can withdraw. No role can move a position's funds anywhere else | TuoVault, TuoPositionNFT |
| Immutable contracts | No proxies, no upgrade path. The fee percentage is a compile-time constant with no setter | All three contracts |
| Frozen allowlists | Pools, valuation pools and deposit tokens are fixed at deployment and have no setter | TuoVault constructor |
| Keeper perimeter | The keeper can only reshape a position inside the vault, swap through an allowlisted aggregator, or send hedge margin to an allowlisted operator | TuoVault keeper surface |
| Keeper budgets | 10 metered actions per position per 24 hours, and 150 bps of the position's basis in measured value loss per 24 hours | TuoVault budget accounting |
| Price gates | Every keeper price path compares spot with a 30-minute TWAP and reverts above 200 ticks of deviation | PoolTwap library |
| Measured-only settlement | The vault never values the Hyperliquid leg. It settles only what it can measure on-chain | TuoVaultViews |
| Split administration | A 2-of-3 Safe holds the treasury role. A separate pauser can stop deposits and nothing else | TuoRoles, TuoVaultAdmin |
| Guarded launch | 25,000 USDC cap per position on Arbitrum One | perNftCapUsdc |
| Invariant testing | A stateful fuzz harness driven by a hostile keeper checks ten invariants on every CI run | test/invariant/ |
What the keeper can never do
The keeper is the only automated actor with write access to a position, so its limits are the core of the model.
- It cannot transfer funds to any address except the vault itself, the Uniswap position manager, the position's bound Hyperliquid operator, or the position owner.
- It cannot exceed 10 metered actions per position per rolling 24 hours.
- It cannot cause more than 150 bps of a position's basis in measured value loss per rolling 24 hours. This is a rate limiter, not a solvency guarantee: the real bound on a compromised keeper is detection plus the treasury Safe revoking the keeper role.
- It cannot mint a position below 200 ticks of width, burn a position below 99.5% of its TWAP value, or act when spot has drifted more than 200 ticks from the TWAP.
- It cannot touch a position that has no withdrawal request when clearing a hedge attribution.
Signing keys for the keeper and the Hyperliquid operators are held in a cloud HSM and never on a server. The backend can request a signature; it can never read the key.
What the treasury can never do
The treasury Safe administers roles, receives fees, sets the per-position cap, and maintains the Hyperliquid operator and aggregator allowlists. It cannot change the fee percentage, upgrade any contract, touch a position, reach a deployed liquidity position, or move idle balances. See Roles and admin controls.
Where custody is not on-chain
While a hedge is open, the margin for that hedge sits at a Tuo-operated Hyperliquid account. Up to 50% of a Basis Plus Core position's basis and up to 90% of a Delta Hedge Standalone position's basis can be off-chain at once. This is the one place where the custody argument depends on Tuo's operations rather than on the contracts, and it is disclosed as such in Custody model and Counterparty and venue risk.
Status
| Item | Status |
|---|---|
| Internal audit-readiness review | Complete, 2026-09-08. See Audits |
| Independent external review | Pending. Launch is blocked until every critical and high finding is closed |
| Bug bounty | Planned after the external review. See Bug bounty and disclosure |
| Mainnet deployment | Pending. See Deployed addresses |