Vaults and custody
Who can do what with your vault: the owner, the trading key, the guardian and the platform admin.
Your agent's money sits in its own vault, a smart contract owned by your wallet. Trenchr never holds your keys and can't withdraw your funds. Here is exactly who can do what.
Powers, side by side
- You (the owner)
- Withdraw anything, to any address, at any time. Sell every position (Emergency exit). Change the limits, the allowlist and the sell limits. Pause and resume. Claim creator fees. Launch a token. Hand the vault over to another wallet.
- The trading key (operator)
- Swap, only through approved routes, only with ETH on one side, only inside your caps and sell limits, and only while nothing is paused. Claim creator fees for the vault. It can never withdraw, change your limits or move money anywhere but back into the vault.
- The guardian
- Pause trading for all vaults at once, and remove a trading pool from the list. It can't unpause and can't move money.
- The platform admin
- Change platform settings: new trading routes, the treasury address, the platform's fee share. Every change that adds power waits a 3-day delay you can see coming. It can pause and unpause trading. It can't touch your funds or your limits.
Even if our trading key were stolen, the thief could only make swaps your vault allows: within your caps, at the sell limiter's pace, through approved pools. They could not withdraw. That is what the limits are for.
Handing a vault over
A vault can be transferred in two steps: the owner proposes a new owner, and the new owner accepts. When the new owner accepts, the trading key is removed and all caps and sell limits are reset to zero, so nothing trades until the new owner sets them.
How it works under the hood
- Owner-only vault functions: withdraw, liquidate (the Emergency exit sale), set limits, set the sell limits, set the trading key, allow tokens, pause, unpause, claim, launch.
- The trading key's swap goes through a permission list in the vault factory: each allowed contract and function has a validator that checks the call data. Anything else reverts.
- The trading key can launch a token only if the owner explicitly allowed it (off by default; the app always has the owner sign launches).
- Contract addresses are on Contracts; the contracts are verified on the explorer.