How to launch your own onchain vault
Vaults for treasury and fund teams · 3 of 3
Getting from a strategy idea to a live vault takes days to weeks. Most of that time goes on decisions you make rather than code anyone writes.
Launching a vault means agreeing a mandate, whitelisting the protocols and tokens it can touch, deciding who curates and who custodies, then seeding it and opening deposits. The ERC-4626 contracts, the accounting, the risk controls and the withdrawal processing already exist. What you supply is the mandate, the distribution and the sign-offs.
This piece covers what you need to bring, the sequence and how long each step runs, who holds which keys, what's hard to change afterwards, and what going live actually looks like.
What do you need to bring?
Seven decisions, and the contracts aren't one of them.
You supply | What it means in practice | Who usually owns it |
The mandate | Which strategies are in scope, the leverage ceiling, and which assets and venues are allowed | Your investment team, or the curator you appoint |
The asset | What the vault is denominated in. The denomination decides which strategies are open to it and which depositors it appeals to | Treasury, usually whatever already sits on your books |
The chain | Where the vault is deployed. This drives which protocols are reachable, what your custodian supports, and where your depositors already hold the asset | You, with input from your custodian |
The curator decision | Whether a named curator runs it or your own team holds the mandate | You |
The custody path | Your custodian, whether Anchorage, BitGo or another, confirming it will hold the receipt token | Operations, with your custodian |
Compliance sign-off | Your risk and legal functions accepting the strategy and the wrapper | Legal and risk |
Distribution | Where the vault appears, and who is told about it | Product and marketing |
The compliance row is the one that sets the timeline. On most launches the strategy conversation with legal and risk takes longer than everything else combined, which is why an explainable strategy beats a marginally higher-yielding one.
On the curator row, you don't have to go and find one. Upshift works with more than 20 curators, ranging from traditional asset managers to onchain lending specialists, and we can introduce the ones whose track record fits the mandate you have in mind.
What does a treasury vault actually look like?
Two shapes cover most treasury mandates. They differ on how much return the mandate reaches for, and both sit behind the same liquidity buffer.
Shape | What sits inside | Liquidity | Who it suits |
Cash management | A curated basket of money market funds, with a buffer in blue-chip onchain lending markets sized to the daily draw | Instant against the buffer, daily otherwise | Operating balances and float that has to stay spendable |
Enhanced yield | Investment-grade CLO tranches and short-duration bond funds, capped to daily-liquidity products, with the same buffer in front | Instant against the buffer | Treasury capital that can sit longer for more return |
The buffer is what makes either work as a product rather than a term deposit. It's sized to your draw pattern and held in front of the deployed positions, so a redemption settles without unwinding anything. Target returns move with prevailing rates and get set per mandate.
What does the sequence look like?
Steps 1 to 3 are fast. Step 4 is where teams find the things they hadn't thought about, usually in reporting rather than in the strategy, which is why a full deposit-and-redeem cycle before launch is worth insisting on.
Who does what once it's running?
Four parties share the work once a vault is live, and the split decides who you chase when something needs changing. This is the full role map for an onchain vault, including what each party cannot do.
Party | Controls | Cannot |
You, as the vault owner | The mandate, the depositor whitelist, distribution, and a share of the signing keys | Reach outside the approved perimeter |
The curator | Allocation inside the whitelist, and the day-to-day strategy view | Touch an unapproved protocol, token or address, or move funds to an external wallet |
Upshift | The contracts, the policy engine, NAV accounting, withdrawal processing | Choose the strategy, or move depositor funds out |
Your custodian | Holding the receipt token and the deposit path | Direct the strategy |
Depositors | Their own receipt tokens, held in their wallet or at their custodian | Direct individual positions |
Administrative control sits behind a multi-signature arrangement rather than with one party. On a standard setup the proxy admin runs as a 4-of-6 with two signers each from the asset issuer, Upshift and the curator, so no single organisation can change the vault alone. Operator keys sit in MPC wallets via Fireblocks or Fordefi, and operator actions run through pre-transaction simulation with maker-checker approval.
What's hard to change later?
Some choices are cheap to revisit and some aren't. Knowing which is which saves a rebuild.
Decision | How changeable | What it takes |
Allocation inside the whitelist | Freely, continuously | A curator decision, no depositor action |
The whitelist itself | Changeable with notice | A parameter change subject to the vault's timelock, which is configured per vault rather than fixed |
Management fee | Changeable with notice | Timelocked |
Instant redemption and withdrawal fees | Changeable | Not timelocked, so agree how changes get communicated |
The denomination asset | Fixed in practice | A new vault |
Public versus whitelisted | Set at configuration | Decide before launch; it shapes who can ever deposit |
The vault's contract code | Upgradeable via the proxy | The 4-of-6 multisig. Proxy upgrades are not timelocked, unlike parameter changes, so this is worth understanding before you sign |
That last row is about the code the vault runs, as opposed to its settings. A vault sits behind a proxy, so the implementation contract can be swapped for a newer one without depositors moving anything. In practice that's how a vault gains a capability it shipped without: instant redemption added on top of the daily queue, a basket of deposit assets where it previously took one, a bridge or swap module so the curator can run the strategy across chains, or a fix for something an audit surfaced. Changing a fee level, the protocol whitelist or the depositor list is a parameter change and doesn't touch the code.
The distinction matters for diligence because parameter changes carry a timelock and proxy upgrades don't, which makes the multisig the control that governs the code. Ask who the six signers are and how they're distributed.
What does it cost?
There's no listing fee and no fund-formation cost, which is most of why the timeline is days to weeks. The economics run through the fee on assets instead:
- Management fee on assets, accrued into the share price and timelocked.
- Performance fee on return, where the mandate includes one.
- Instant redemption fee, paid by whoever exits early, which is what funds same-day liquidity.
If you're bringing the depositors, the arrangement is usually a share of the fee on the balances you bring. Accounting, fees and fund flows sets out how fees accrue and settle, and Vault-as-a-Service covers the launch package.
What does going live actually mean?
Four things start on day one, and only the first is a launch task.
- Deposits open to whichever addresses your whitelist allows, which can be one address or anyone.
- Positions become visible onchain, so your depositors and your own risk team read the same data.
- Redemptions process daily, with instant available for a fee against the buffer.
- Monitoring begins. The things worth watching are the buffer against your draw pattern, leverage as gross assets over net value, and concentration by venue and collateral.
Where the vault appears is your call. The Upshift SDK embeds deposits, redemptions and balances into any frontend you already run, so the vault can live inside your app, your client portal or your treasury dashboard rather than sending anyone to a separate site.
Risk doesn't end at launch either. Contract risk has no analogue in a fund wrapper, and while Upshift's contracts have been through 10 audits by 6 independent firms as of August 2026, audits reduce that risk without removing it. These vaults carry no built-in smart contract cover, though third-party cover exists in the market from underwriters like Nexus Mutual and OpenCover and is arranged separately. Yields move with borrowing demand rather than being guaranteed. Always make sure to do your own research and be aware of the above and any other risks before depositing.
Should you curate it yourself?
Both routes are common, and the honest answer depends on whether you have a strategy view you want to express. Appointing a curator gets you a live product without building an onchain trading capability, and the curator carries the day-to-day allocation. Holding the mandate yourself keeps the strategy and the fee, and needs someone on your side who can operate within the whitelist.
Plenty of firms start with a curator and take the mandate in-house later, once the reporting is familiar and the internal appetite is proven. Upshift for curators covers what running a mandate involves.
Frequently asked questions
How long does launching a vault actually take?
Days to weeks, and the variable is your own compliance review rather than deployment. Scoping, whitelisting and configuration run in days. A full deposit-and-redeem test before opening to depositors is worth building into the plan.
Do we need our own onchain trading capability?
Only if you want to hold the mandate yourself. Appointing a named curator means someone else does the allocation inside a perimeter you approved, so you supply the mandate and the distribution.
Can we start with a private vault and open it later?
Public versus whitelisted is set at configuration, so decide it before launch. A common path is a private vault for your own balance sheet first, then a separate public vault once the internal reporting is proven.
Who can change the contract logic?
Contract upgrades go through the proxy admin multisig, typically a 4-of-6 with two signers each from the asset issuer, Upshift and the curator. Proxy upgrades are not timelocked, unlike parameter changes, so the multisig composition is the control worth diligencing.
What happens if we want to wind the vault down?
Positions unwind, redemptions process as normal, and depositors exit in the denomination asset. Sizing the wind-down against the liquidity of the underlying positions is the part to plan, which is easier for a lending strategy than a concentrated one.
Can the vault accept more than one deposit asset?
Yes, and there's a detail worth flagging to your operations team. A multi-asset vault takes deposits in a basket of assets, say USDC, USDT and DAI, and mints one share token against all of them. The vault still has a single reference asset, and every redemption processes in that one. So a depositor who came in with USDT can exit in USDC. Multi-asset vault architecture covers the structure.
Keep reading
This series: Part 1 covers what a vault is and who holds the assets. Part 2 covers using one inside a product, including the ETP comparison. This part covers launching your own.
- The DeFi yield strategies onchain vaults run: the strategy shapes, the risk in each, and what to specify in a mandate.
- Risk management framework: the controls the policy engine enforces, in detail.
- Vaults API: reading NAV, positions and allocations into your own systems.
- How traditional asset managers are controlling risk in DeFi: why allocators ask about the policy engine first.
- How Kraken Institutional clients access onchain yield: a live example of a partner-facing vault programme.
- Choosing a risk tier for your mandate: how much leverage each tier carries, with live figures.
Create a vault with Upshift
Share your use case and we’ll get back to you shortly