Tuo docs

Security overview

How Tuo is built to keep customer funds inside the position even when its own operators are wrong, offline or compromised.

Tuo's security model starts from one assumption: the off-chain engine can be wrong and the keeper can be hostile. The contracts are written so that, even then, customer funds can only move back to the owner of the position NFT.

This page lists the layers. The pages that follow cover the audit status, the disclosure process, the exact roles, and the guarded-launch limits.

The layers

LayerWhat it guaranteesWhere it lives
Owner-only exitOnly the holder of the position NFT can withdraw. No role can move a position's funds anywhere elseTuoVault, TuoPositionNFT
Immutable contractsNo proxies, no upgrade path. The fee percentage is a compile-time constant with no setterAll three contracts
Frozen allowlistsPools, valuation pools and deposit tokens are fixed at deployment and have no setterTuoVault constructor
Keeper perimeterThe keeper can only reshape a position inside the vault, swap through an allowlisted aggregator, or send hedge margin to an allowlisted operatorTuoVault keeper surface
Keeper budgets10 metered actions per position per 24 hours, and 150 bps of the position's basis in measured value loss per 24 hoursTuoVault budget accounting
Price gatesEvery keeper price path compares spot with a 30-minute TWAP and reverts above 200 ticks of deviationPoolTwap library
Measured-only settlementThe vault never values the Hyperliquid leg. It settles only what it can measure on-chainTuoVaultViews
Split administrationA 2-of-3 Safe holds the treasury role. A separate pauser can stop deposits and nothing elseTuoRoles, TuoVaultAdmin
Guarded launch25,000 USDC cap per position on Arbitrum OneperNftCapUsdc
Invariant testingA stateful fuzz harness driven by a hostile keeper checks ten invariants on every CI runtest/invariant/

What the keeper can never do

The keeper is the only automated actor with write access to a position, so its limits are the core of the model.

  • It cannot transfer funds to any address except the vault itself, the Uniswap position manager, the position's bound Hyperliquid operator, or the position owner.
  • It cannot exceed 10 metered actions per position per rolling 24 hours.
  • It cannot cause more than 150 bps of a position's basis in measured value loss per rolling 24 hours. This is a rate limiter, not a solvency guarantee: the real bound on a compromised keeper is detection plus the treasury Safe revoking the keeper role.
  • It cannot mint a position below 200 ticks of width, burn a position below 99.5% of its TWAP value, or act when spot has drifted more than 200 ticks from the TWAP.
  • It cannot touch a position that has no withdrawal request when clearing a hedge attribution.

Signing keys for the keeper and the Hyperliquid operators are held in a cloud HSM and never on a server. The backend can request a signature; it can never read the key.

What the treasury can never do

The treasury Safe administers roles, receives fees, sets the per-position cap, and maintains the Hyperliquid operator and aggregator allowlists. It cannot change the fee percentage, upgrade any contract, touch a position, reach a deployed liquidity position, or move idle balances. See Roles and admin controls.

Where custody is not on-chain

While a hedge is open, the margin for that hedge sits at a Tuo-operated Hyperliquid account. Up to 50% of a Basis Plus Core position's basis and up to 90% of a Delta Hedge Standalone position's basis can be off-chain at once. This is the one place where the custody argument depends on Tuo's operations rather than on the contracts, and it is disclosed as such in Custody model and Counterparty and venue risk.

Status

ItemStatus
Internal audit-readiness reviewComplete, 2026-09-08. See Audits
Independent external reviewPending. Launch is blocked until every critical and high finding is closed
Bug bountyPlanned after the external review. See Bug bounty and disclosure
Mainnet deploymentPending. See Deployed addresses

On this page