Who does what in an onchain vault?

Four parties touch an onchain vault, and each one holds a different power. Most diligence treats them as a single counterparty, which hides where the risk actually sits.

The four powers split like this:

1. Depositors bring the capital and keep ownership of it through a receipt token.
2. The vault owner sets the mandate: the protocols, tokens and functions the capital may touch.
3. A curator allocates inside that mandate and can reach nothing outside it.
4. The infrastructure provider runs the contracts, the accounting and the withdrawal logic, and cannot move funds to an outside wallet.

That division matters because the four roles fail in different ways. A curator can pick a bad strategy inside a perfectly enforced mandate. A mandate can be drawn too wide, so a reasonable curator still ends up somewhere you wouldn't have approved. The contracts can hold a bug that no mandate prevents. When you diligence a vault, you're really diligencing four things, and a single "is this safe?" question collapses them into one.

Who brings the capital?

Depositors bring the capital, and they hold a receipt token that represents their claim on the vault's assets. Upshift vaults are ERC-4626 contracts. You send an asset to the vault and receive shares priced at the current asset-to-share ratio. Those shares sit in your own wallet or with your custodian, so you can transfer them, post them as collateral elsewhere, or redeem them.

Who the depositor is varies more than people expect, and in a public vault anyone who passes the frontend's geographic checks can deposit. In a whitelisted vault, the contract holds a list and rejects everyone else. That's how a single institution becomes the only depositor in a vault built for its own balance sheet. The choice between a shared vault and a sole-depositor vault changes the commercial terms and the reporting you get.

One detail catches treasury teams out: if your assets sit with a qualified custodian, then the custodian holds the receipt token. So the custodian has to support that token before you can do anything. That makes your custodian a counterparty on the deal, not a bystander, and their timeline becomes your timeline.

Who sets the mandate?

The mandate is set by the vault owner before any capital arrives, and it's enforced in code rather than in a document. On Upshift, the mandate lives in a policy engine. It checks every transaction at four levels: chain, protocol, token and contract function. A curator submitting a transaction to a protocol outside the list gets a reverted transaction rather than a warning. The tokenised vault standard handles the accounting; the policy engine handles the permissions.

Who plays the owner depends on the deal, and for a vault an institution commissions for its own capital, the institution usually holds owner rights or shares them. For a shared vault, the infrastructure provider and the curator hold them jointly. On Upshift, the proxy admin is a 4-of-6 multisig. Two signers each come from the asset issuer, the curator and Upshift. No single party can change the contract code alone.

That last row is the one worth reading twice. Parameter changes carry a configurable timelock, so you get notice. A proxy upgrade changes the code itself and doesn't, which is why the multisig composition matters more than the timelock length.

Who allocates the capital?

A curator allocates the capital day to day. Curators are usually hedge funds or asset managers rather than software teams. They decide which approved venues to use, in what size, and when to rotate. They earn a share of the performance or management fee. Their incentive tracks the vault's return rather than its size alone.

The curator's power is real but bounded, so they can move capital between any protocols on the whitelist, take leverage where the mandate allows it, and change the mix daily. They cannot send funds to an address that isn't approved, touch a protocol that isn't on the list, or withdraw to their own wallet. The strategy they run inside those limits produces nearly all of the return, and nearly all of the risk that isn't smart contract risk.

In practice the approved venues are named things. A stablecoin mandate might permit lending on Morpho markets, a tokenised credit position such as Maple's syrupUSDC, and a tokenised treasury fund like those Superstate issues. Capital reaches those strategies through segregated subaccounts rather than sitting in one commingled pot. Each vault's capital routes to its own subaccount, so one vault's positions can't be used to cover another's. For an asset manager worried about client assets mixing, that structure is the answer. Confirm it in the contract rather than taking it on trust.

What does Upshift control?

Upshift owns everything mechanical between the deposit and the redemption, which is the widest role in the chain and the one buyers most often mis-assign. Upshift is non-custodial vault infrastructure for onchain yield. Fintechs, exchanges, wallets, neobanks, chains and asset managers use it to launch yield products without building vault contracts, risk controls, NAV accounting, fee logic or withdrawal processing themselves. Depositors remain self-custodied throughout.

In practice that covers a specific list of jobs, and it's the list an asset manager would otherwise have to staff internally:

• Contracts. The ERC-4626 vault, the subaccount structure, the policy engine and any redemption modules.
• Deposit and withdrawal flow. Share pricing, the redemption queue, daily processing of claimable redemptions, and instant redemption where a buffer supports it.
• NAV and accounting. Valuing positions, striking the ratio, and producing the numbers your finance team reconciles against.
• Fee logic. Management, performance and redemption fees computed and split in code.
• Protocol diligence. Reviewing the underlying venues before they reach a whitelist.
• Operational controls. Pre-transaction simulation with a maker-checker approval flow, and operator keys held in MPC wallets from providers such as Fordefi.

What the provider can't do is as important. Neither Upshift nor the curator can move depositor funds to an external wallet. There's no guardian role that can seize assets, and pause rights sit with the owner or operator rather than a separate party. The risk framework and the audit reports are the two documents to read before you accept any of this on description alone.

Who holds the assets?

Custody works differently here than at a lending desk, where the company takes title to your coins and decides what happens to them. The vault contract holds the pooled assets and you hold the receipt token, which is a claim on them. That's the structural difference from the 2022 generation of yield products. Those companies took title to customer coins and made discretionary decisions about them.

The honest limit is that a receipt token is a claim on a pool, not on your specific coins. If a strategy inside the mandate loses money, the asset-to-share ratio falls and your claim is worth less. That's investment risk rather than custody risk. Your legal team will characterise those two exposures differently. Be precise about which of the two worries you before the conversation starts.

What happens when a strategy goes wrong?

Three mechanisms exist, and they respond to different problems:

• Pause stops new deposits and, depending on configuration, redemptions. It sits with the owner or an operator rather than a dedicated guardian role, and it's the right tool when something ambiguous is happening and you want to stop the clock.
• Emergency withdrawal moves assets the vault itself holds, and it's the one people misread. It falls short of a full recovery button, because it can't reach funds already deployed into a subaccount. It also sends to an address the owner specifies rather than automatically back to depositors, so the multisig composition determines whether that power is safe to grant.
• Unwinding covers most real situations. The curator closes positions inside the mandate and capital returns to the vault, at whatever value those positions fetched.

To learn how a vault behaves under stress, ask for the worst peak-to-trough move in its asset-to-share ratio. Then ask how long recovery took. That's the measured answer rather than the described one.

Always make sure to do your own research and be aware of the above and any other risks before depositing.

Which roles does Upshift not play?

Upshift doesn't pick strategies, and that's the sharpest way to place it on the map. The infrastructure provider builds and runs the machinery; the curator decides what the capital does. When a comparison article describes Upshift as a vault manager or an asset manager, it collapses two roles. Those roles sit on opposite sides of the mandate.

The same applies to two other common mix-ups, starting with custody: depositors and their custodians hold the receipt tokens throughout, so Upshift never holds them. The yield comes from the venues a curator allocates to, whether that's lending on Morpho, a tokenised treasury position, or a carry trade. Draw these boundaries correctly and a diligence process finishes; blur them and it keeps looping back to the same question.

Not playing those roles isn't the same as leaving you to source them. Three of the four seats around the vault are ones we can help fill:

• Curator. We can introduce curators whose existing mandate matches what you want to run, with a live track record you can read before committing. Teams that would rather hold allocation themselves keep it.
• Custodian. We can introduce custodians that already hold our share tokens, which removes the slowest step in most institutional launches. A custodian starting from scratch on a new receipt token usually sets the timeline.
• Depositors. On the distribution side we can support bringing capital in, through our own depositor base and the partner surfaces that already list Upshift vaults, rather than handing you an empty vault and a marketing problem.

For teams that want to run their own mandate rather than use an existing curator, vault-as-a-service covers the infrastructure while you keep allocation. For teams that would rather delegate, the curator model covers both. Either path uses the same contracts and the same policy engine.

Frequently asked questions

Is a vault curator the same as a vault infrastructure provider?

No. A curator allocates capital inside a mandate and is usually a hedge fund or asset manager. An infrastructure provider writes and operates the contracts, the NAV accounting, the fee logic and the withdrawal processing, and doesn't choose strategies. One vault normally has both, and they're separate companies with separate incentives.

Who legally owns the assets in an onchain vault?

Depositors hold receipt tokens representing a claim on the vault's pooled assets. Those tokens sit in a depositor's own wallet or with their custodian. No operator takes title to the underlying coins. A receipt token is a claim on the pool rather than on specific units. A loss inside the mandate reduces what the claim is worth.

Can a curator withdraw funds from a vault?

A curator can move capital between protocols on the vault's whitelist and can't send it anywhere else. The policy engine blocks transfers to an external wallet, for the curator and for Upshift alike. It checks every transaction against approved chains, protocols, tokens and functions before execution.

What does the custodian have to do before we can deposit?

The custodian has to support the vault's receipt token, since that's the asset it will end up holding on your behalf. That usually means an internal review and a token listing on their side. Start that conversation early, because custodian timelines often set the critical path on an institutional vault launch.

Who changes the list of protocols a vault can use?

The vault owner changes it as a parameter update, subject to the vault's configured timelock, so depositors get notice before the mandate widens. The curator can't add a venue. Changing the vault's code takes a proxy upgrade instead, approved by a 4-of-6 multisig. Two signers each come from the asset issuer, the curator and Upshift.

How do we get reporting out of a vault?

Vault state is readable onchain and through an API covering TVL, share price, allocations, and the redemption queue. Positions, valuations and the asset-to-share ratio come from the infrastructure provider's accounting rather than the curator. That independence makes them a real check on performance claims.

Can one vault's losses affect another vault?

Each vault routes capital to its own segregated subaccount, so one vault's positions aren't available to cover another's. That separation is the mechanism behind any claim about avoiding commingled funds. Verify it in the contracts and the subaccount structure rather than accepting a policy statement.

Keep reading

• What is an onchain vault: a treasury guide covers the mechanics of the wrapper itself and how it compares to a tokenised money market fund.
• How to launch an onchain vault walks the path from mandate to live product, including what's hard to change after launch.
• How traditional asset managers are controlling risk in DeFi goes deeper on the policy engine and what it does and doesn't prevent.
• The vault architecture documentation is the contract-level reference behind every claim on this page.
• The Upshift FAQ answers the operational questions that come up during diligence.