Vault provider due diligence: questions fintechs ask

Before a neobank, exchange or payments company puts customer stablecoins into a vault, its risk team reviews who can move the funds, who can change the contract, how positions are priced and how money comes back out. Each of the ten areas pairs the question with what a strong answer contains and how Upshift answers it.

Vault contract providers with institutional risk controls

Five vault contract providers publish the controls a DD review asks about: Upshift, Midas, Mellow, Veda and Morpho. Cells for the first four come from each provider's docs as read on 30 September 2026, and Morpho's from its Vault V2 documentation as read on 4 October 2026. A separate guide compares risk controls across seven vault providers, including Aera, Lagoon and IPOR Fusion.

A fintech that launches a stablecoin Earn product is adding a new vendor to the path its customers' money takes. Its risk, compliance and product leads run due diligence (DD) on that vendor before signing, much as a bank reviews a payments processor before routing card settlement through it. US banking agencies set out that review for banks in their 2023 interagency guidance on third-party relationships: who controls the money, what can change without notice, who checks the vendor's work and what happens when something fails. A vault provider gets the same review, with smart contracts and signing keys in place of a processor's data centre and settlement accounts.

Upshift is non-custodial vault infrastructure. A depositor sends a stablecoin to a vault contract and receives a receipt (share) token, which it redeems at net asset value (NAV) under that vault's published withdrawal terms. Through Vault-as-a-Service, any vault type can launch under the partner's own brand and front end. The roles involved are mapped below and covered in more depth in who does what in an onchain vault.

In the diagram, the depositor reaches the vault through the fintech's front end. The owner multisig holds parameter changes and the ProxyAdmin multisig holds code changes. The operator runs daily jobs on the curator's instruction, every deployment passes the policy engine, and the multi-oracle NAV engine prices the positions behind each share.

1. Custody and who can move funds

Question. Who holds the assets, which keys can move them, and can any single person or device send funds outside the vault's approved venues?

A strong answer names every role with power over the funds, the signing setup behind each one, and the limits on the most powerful function. It separates routine operations from emergency powers and shows that no single key can redirect customer money.

How Upshift answers. Vaults are non-custodial: deposits sit in the vault contract and its segregated subaccounts, and depositors hold share tokens. The owner of each vault is a Gnosis Safe multisig, and the owner sets the operator role. Automated jobs such as fee charging and NAV updates are signed through Fireblocks MPC (multi-party computation, where a key is split into shares so no single device holds it), and Fordefi is used where an external party co-signs. Operator transactions run through pre-transaction simulation and a maker-checker approval, where one person proposes and a second approves. Pause sits with the owner or the operator, and there is no separate guardian role. The owner's emergencyWithdraw function moves vault-held assets only, to an address the owner specifies, and doesn't reach funds deployed in subaccounts.

2. Contract changes

Question. What can change after launch, who approves each kind of change, and how much notice do depositors get?

A strong answer splits parameter changes (fees, caps, whitelists) from code changes (the contract logic itself) and gives the approval threshold and waiting period for each, including the changes that take effect immediately.

How Upshift answers. Each vault has a configurable timelock on parameter changes. A change such as a new management fee is scheduled and waits out the delay before it applies. Not every fee change is timelocked: instant-redemption and withdrawal fees can change without that wait. Code changes are proxy upgrades, used for things like adding instant redemption, adding deposit assets or shipping an audit fix. Proxy upgrades are controlled by the ProxyAdmin multisig, which typically needs 4 of 6 signatures from the asset issuer, Upshift and the curator (2 signers each). No single party can upgrade a vault alone. The proxy pattern follows EIP-1967.

3. Audits

Question. Which firms have audited the contracts, covering which code, and when?

A strong answer lists each audit with its date, scope and public report, including new vault types as they shipped.

How Upshift answers. Upshift's contracts have been through 11 smart contract audits by 6 independent firms: Halborn, Hacken, OtterSec, ChainSecurity, Sigma Prime and Zellic. Hacken's five reviews between September 2025 and April 2026 covered the core contracts, the AllocationWhitelist, the instant-redemption subaccount and the Atomic Vault, and Halborn reviewed the Stellar vault in April 2026. Reports are linked from the audits page in the Upshift docs. Audits reduce smart contract risk without removing it.

4. Pricing and NAV

Question. Who calculates the value of a share, and can the party running the strategy mark its own positions?

A strong answer separates pricing from strategy and uses more than one price source.

How Upshift answers. Upshift's multi-oracle engine prices every position in the vault, and the curator doesn't set the NAV. Vaults follow the ERC-4626 tokenized vault standard for deposits, shares and redemptions.

5. Strategy limits

Question. What stops the curator or operator from deploying funds somewhere the mandate doesn't allow?

A strong answer describes limits enforced before a transaction executes, set at a level of detail finer than "approved protocols", and identifies who can change them.

How Upshift answers. August's policy engine restricts deployment by chain, protocol, token and contract function, and checks each deployment against those rules before it goes through. A curator can allocate inside the mandate and can't reach anything outside it. Each vault carries its own mandate, and tiering vault strategies by risk covers how fintechs build a low, mid and higher-yield menu from them.

6. Redemptions and liquidity

Question. How fast can customers get their money back, in which asset, and what happens if many redeem at once?

A strong answer gives the standard redemption timeline, any faster route and its cost, and the asset the redemption pays out in. Our comparison of stablecoin redemption times shows those routes across product types.

How Upshift answers. Upshift processes claimable redemptions daily, and each vault has its own lag, published in its withdrawal terms. Most vaults also offer instant redemption for a fee, subject to available liquidity. Multi-asset vaults accept several deposit assets but have one reference asset, and every redemption pays out in that asset. A depositor who came in with USDT may exit in USDC. For tokenized assets, Upshift Clear provides an instant, oracle-priced USDC exit.

7. Compliance

Question. Who can deposit, how are customers screened, and are the fintech's customer funds kept apart from other depositors?

A strong answer covers screening at the front end, a way to restrict the vault to approved addresses, account segregation and the regulatory framework in each target market.

How Upshift answers. Whitelisted and sole-depositor (private) vaults restrict deposits to approved addresses, and segregated vault accounts keep one client's allocation apart from a shared pool. For platforms serving EU customers, the licensing questions under MiCA are set out in MiCA licence: who needs one, alongside ESMA's MiCA pages.

8. Reporting

Question. Can the vault's positions and performance be verified by someone other than the provider?

A strong answer offers onchain data plus an independent party's reporting that an auditor or board can rely on.

How Upshift answers. Vault contracts, share supply and owner addresses are readable onchain. Securitize provides independent third-party reporting on Upshift vaults at an LP's request.

9. Insurance

Question. Is there insurance against a smart contract failure?

A strong answer states plainly what cover exists and what doesn't, and where additional cover can be bought.

How Upshift answers. There's no smart contract insurance at protocol level. A fintech or its depositors can buy cover from third-party providers, and onchain insurance covers how those policies work and what they pay out on.

10. Track record

Question. Which institutions already run on the platform, and at what scale?

A strong answer names live, public integrations and gives dated figures that can be checked.

How Upshift answers. As of September 2026, Upshift had reached over $550M in peak TVL across more than 50 vaults on over 30 chains, with more than 66,000 users. Kraken Institutional runs custom vaults on Upshift, announced in July 2026, and SDK integrations are live with Tria and app.monad.xyz. Case studies for Kraken and Tria describe each setup. Upshift raised a $10M Series A led by Dragonfly in March 2025.

How vault providers compare on public information

This comparison sets Upshift's answers beside what Midas, Mellow and Veda publish about their own vaults. Every cell comes from that provider's documentation, code repository or app as read on 30 September 2026, and "not disclosed" marks a question the provider's public material doesn't answer. Providers update their docs often. A DD file should confirm each point directly with the team before relying on it.

Sources, read 30 September 2026: Upshift docs, Upshift audits, Upshift app; Midas smart contract security, Midas audits, Midas contracts; Mellow vaults overview, Mellow security; Veda architecture, Veda audits, BoringVault repository; live chain TVL from DefiLlama for Mellow and Veda.

Summary for a DD file

Every onchain vault carries smart contract, oracle, bridge and counterparty risk, and yields float with market conditions and are never guaranteed. Always make sure to do your own research and be aware of the above and any other risks before depositing.

Frequently asked questions

What is vault provider due diligence?

It's the vendor review a fintech runs before integrating a stablecoin vault provider, covering custody, contract controls, audits, pricing, strategy limits, redemptions, compliance, reporting, insurance and track record.

Who approves Upshift vault upgrades?

Proxy upgrades change the vault's code and typically need 4 of 6 signatures on the ProxyAdmin multisig, split between the asset issuer, Upshift and the curator. Parameter changes such as the management fee sit behind a configurable per-vault timelock.

Who controls an Upshift vault?

A Gnosis Safe multisig owns each vault and appoints the operator, whose MPC-signed transactions pass a maker-checker approval and the policy engine's limits on chains, protocols, tokens and contract functions.

How often are redemptions processed?

Upshift processes claimable redemptions daily, and each vault publishes its own lag. Most vaults also offer instant redemption for a fee, subject to liquidity.

Do Upshift vaults have insurance?

There's no smart contract insurance at protocol level. Cover can be bought from third-party providers.

Can a fintech restrict a vault to its own customers?

Yes. Whitelisted and sole-depositor vaults limit deposits to approved addresses, and segregated accounts keep a client's allocation apart from shared pools.

Which vault contract providers have institutional risk controls?

Upshift, Midas, Mellow, Veda and Morpho all publish their upgrade, timelock and depositor controls. On 30 September 2026 Upshift listed 11 reports from 6 firms, Midas 15, Veda 14 and Mellow 13 on its core vaults. Audit records across vault providers are compared in vault smart contract audits.

Keep reading

• How onchain yield vaults are secured. The control layers and the threats each one contains.
• How neobanks and fintechs offer stablecoin yield. The structures behind yield on customer balances.
• Onchain yield in qualified custody. How vault shares sit with a custodian.
• Stablecoin yield infrastructure compared. How vault platforms differ on custody, chains and controls.
• Vault smart contract audits. What an audit covers and how providers compare.
• Stablecoin vault infrastructure providers. The platforms businesses use to launch their own vaults.