Who does what in an onchain vault?

Four parties touch an onchain vault, and each one holds a different power. Most diligence treats them as a single counterparty, which hides where the risk actually sits.

The four powers split like this:

1. Depositors bring the capital and keep ownership of it through a receipt token.
2. The vault owner sets the mandate: the protocols, tokens and functions the capital may touch.
3. A curator allocates inside that mandate and can reach nothing outside it.
4. The infrastructure provider runs the contracts, the accounting and the withdrawal logic, and cannot move funds to an outside wallet.

That division matters because the four roles fail in different ways. A curator can pick a bad strategy inside a perfectly enforced mandate. A mandate can be drawn so wide that a reasonable curator still ends up somewhere you wouldn't have approved. The contracts can hold a bug that no mandate prevents. When you diligence a vault, you're really diligencing four things, and a single "is this safe?" question collapses them into one.

Who brings the capital?

Depositors bring the capital, and they hold a receipt token that represents their claim on the vault's assets. Upshift vaults are ERC-4626 contracts. You send an asset to the vault and receive shares priced at the current asset-to-share ratio. Those shares sit in your own wallet or with your custodian. From there you can transfer them, post them as collateral elsewhere, or redeem them.

Who the depositor is varies more than people expect, and in a public vault anyone who passes the frontend's geographic checks can deposit. In a whitelisted vault, the contract holds a list and rejects everyone else. That's how a single institution becomes the only depositor in a vault built for its own balance sheet. The choice between a shared vault and a sole-depositor vault changes the commercial terms and the reporting you get.

One detail catches treasury teams out: if your assets sit with a qualified custodian, then the custodian holds the receipt token. The custodian has to support that token before you can do anything. That makes your custodian a counterparty on the deal, and their timeline becomes your timeline.

Who sets the mandate?

The mandate is set by the vault owner before any capital arrives, and it's enforced in code. On Upshift, the mandate lives in a policy engine that checks every transaction at four levels (chain, protocol, token and contract function), and a curator submitting a transaction to a protocol outside the list simply gets it reverted. The tokenised vault standard handles the accounting; the policy engine handles the permissions. An asset manager choosing a wrapper for an onchain fund weighs this vault model against a tokenized fund share.

The owner depends on the deal. For a vault an institution commissions for its own capital, the institution usually holds owner rights or shares them, and for a shared vault the infrastructure provider and the curator hold them jointly. On Upshift, the proxy admin is a 4-of-6 multisig with two signers each from the asset issuer, the curator and Upshift, which means no single party can change the contract code alone.

Parameter changes carry a configurable timelock that gives you notice. A proxy upgrade changes the code itself and doesn't, which makes the multisig's composition more important than the timelock length.

Who allocates the capital?

A curator allocates the capital day to day. Curators are usually hedge funds or asset managers, and they decide which approved venues to use, in what size and when to rotate, in return for a share of the performance or management fee. Their incentive tracks the vault's return along with its size.

The curator's power is real, and it has limits. Inside them a curator can move capital between any protocols on the whitelist, take leverage where the mandate allows it, and change the mix daily. A curator can't send funds to an address that isn't approved, touch a protocol that isn't on the list, or withdraw to their own wallet. The strategy they run inside those limits produces nearly all of the return, and nearly all of the risk that isn't smart contract risk.

In practice the approved venues are named things. A stablecoin mandate might permit lending on Morpho markets, a tokenised credit position such as Maple's syrupUSDC, and a tokenised treasury fund like those Superstate issues. Capital reaches those strategies through segregated subaccounts. Each vault's capital routes to its own subaccount, which keeps one vault's positions from covering another's. For an asset manager worried about client assets mixing, that structure is the answer. Confirm it in the contract.

What does Upshift control?

Upshift owns everything mechanical between the deposit and the redemption, which is the widest role in the chain and the one buyers most often mis-assign. Upshift is non-custodial vault infrastructure for stablecoin yield. Fintechs, exchanges, wallets, neobanks, chains and asset managers use it to launch yield products without building vault contracts, risk controls, NAV accounting, fee logic or withdrawal processing themselves. Depositors remain self-custodied throughout.

In practice that covers a specific list of jobs, and it's the list an asset manager would otherwise have to staff internally:

• Contracts. The ERC-4626 vault, the subaccount structure, the policy engine and any redemption modules.
• Deposit and withdrawal flow. Share pricing, the redemption queue, daily processing of claimable redemptions, and instant redemption where a buffer supports it.
• NAV and accounting. Valuing positions, striking the ratio, and producing the numbers your finance team reconciles against.
• Fee logic. Management, performance and redemption fees computed and split in code.
• Protocol diligence. Reviewing the underlying venues before they reach a whitelist.
• Operational controls. Pre-transaction simulation with a maker-checker approval flow, and operator keys held in MPC wallets from providers such as Fordefi.

What the provider can't do is as important. Neither Upshift nor the curator can, on its own, move depositor funds to an external wallet. There's no guardian role that can seize assets, and on most vaults only the owner can pause. The risk framework and the audit reports are the two documents to read before you accept any of this on description alone.

Who holds the assets?

Custody works differently here than at a lending desk, where the company takes title to your coins and decides what happens to them. The vault contract holds the pooled assets and you hold the receipt token, which is a claim on them. That's the structural difference from the 2022 generation of yield products, whose operators took title to customer coins and made discretionary decisions about them.

A receipt token is a claim on the pool as a whole. If a strategy inside the mandate loses money, the asset-to-share ratio falls and your claim is worth less. That's investment risk, which your legal team will characterise differently from custody risk, and it helps to be clear which of the two concerns you before the conversation starts.

What happens when a strategy goes wrong?

Three mechanisms exist, and they respond to different problems:

• Pause stops new deposits and, depending on configuration, redemptions. On most vaults only the owner can trigger it (there's no dedicated guardian role), and it's the right tool when something ambiguous is happening and you want to stop the clock.
• Emergency withdrawal moves assets the vault itself holds, and it's the one people misread. It falls short of a full recovery button, because it can't reach funds already deployed into a subaccount. It also sends to whatever address the owner specifies, which is why the multisig composition determines whether that power is safe to grant.
• Unwinding covers most real situations. The curator closes positions inside the mandate and capital returns to the vault, at whatever value those positions fetched.

To learn how a vault behaves under stress, ask for the worst peak-to-trough move in its asset-to-share ratio. Then ask how long recovery took, which gives you a measured answer.

Always make sure to do your own research and be aware of the above and any other risks before depositing.

Which roles does Upshift not play?

Upshift doesn't pick strategies. The infrastructure provider builds and runs the machinery; the curator decides what the capital does. A comparison that describes Upshift as a vault manager or an asset manager collapses two roles that sit on opposite sides of the mandate.

The same applies to two other common mix-ups, starting with custody: depositors and their custodians hold the receipt tokens from deposit to redemption. The yield comes from the venues a curator allocates to, whether that's lending on Morpho, a tokenised treasury position, or a carry trade. Draw these boundaries correctly and a diligence process finishes; blur them and it keeps looping back to the same question.

Not playing those roles isn't the same as leaving you to source them. Three of the four seats around the vault are ones we can help fill:

• Curator. We can introduce curators whose existing mandate matches what you want to run, with a live track record you can read before committing. Teams that would rather hold allocation themselves keep it.
• Custodian. We can introduce custodians that already hold our share tokens, which removes the slowest step in most institutional launches. A custodian starting from scratch on a new receipt token usually sets the timeline.
• Depositors. On the distribution side we can support bringing capital in, through our own depositor base and the partner surfaces that already list Upshift vaults.

For teams that want to run their own mandate rather than use an existing curator, vault-as-a-service covers the infrastructure while you keep allocation. For teams that would rather delegate, the curator model covers both. Either path uses the same contracts and the same policy engine.

Frequently asked questions

Is a vault curator the same as a vault infrastructure provider?

No. A curator allocates capital inside a mandate and is usually a hedge fund or asset manager. An infrastructure provider writes and operates the contracts, the NAV accounting, the fee logic and the withdrawal processing, and doesn't choose strategies. One vault normally has both, and they're separate companies with separate incentives.

Who legally owns the assets in an onchain vault?

Depositors hold receipt tokens representing a claim on the vault's pooled assets, in their own wallet or with their custodian. No operator takes title to the underlying coins. The token is a claim on the pool as a whole, and a loss inside the mandate reduces what it's worth.

Can a curator withdraw funds from a vault?

A curator can move capital between protocols on the vault's whitelist and can't send it anywhere else. The policy engine blocks curator transfers to an external wallet. It checks every transaction against approved chains, protocols, tokens and functions before execution.

What does the custodian have to do before we can deposit?

The custodian has to support the vault's receipt token, since that's the asset it will end up holding on your behalf. That usually means an internal review and a token listing on their side. Start that conversation early, because custodian timelines often set the critical path on an institutional vault launch.

Who changes the list of protocols a vault can use?

The vault owner changes it as a parameter update, subject to the vault's configured timelock, which gives depositors notice before the mandate widens. The curator can't add a venue. Changing the vault's code takes a proxy upgrade instead, approved by a 4-of-6 multisig. Two signers each come from the asset issuer, the curator and Upshift.

How do we get reporting out of a vault?

Vault state is readable onchain and through an API covering TVL, share price, allocations, and the redemption queue. Positions, valuations and the asset-to-share ratio come from the infrastructure provider's accounting, independent of the curator. That independence makes them a real check on performance claims.

Can one vault's losses affect another vault?

Each vault routes capital to its own segregated subaccount, walled off from every other vault's positions. That separation is the mechanism behind any claim about avoiding commingled funds. Verify it in the contracts and the subaccount structure.

Keep reading

• What is an onchain vault: a treasury guide covers the mechanics of the wrapper itself and how it compares to a tokenised money market fund.
• How to launch an onchain vault walks the path from mandate to live product, including what's hard to change after launch.
• How traditional asset managers are controlling risk in DeFi goes deeper on the policy engine and what it does and doesn't prevent.
• The vault architecture documentation is the contract-level reference behind every claim on this page.
• The Upshift FAQ answers the operational questions that come up during diligence.