Security and trust
What the contracts guarantee, what the protocol can do, and the risks.
What the contracts guarantee#
- Shares are minted only against tokens the vault receives, and in proportion to what it already holds.
- A redemption pays a pro-rata slice of every token; it needs no price and no permission.
- A deposit’s plan and minimums are fixed when it opens; a keeper cannot change them.
- A rebalance can only move value between the fund’s own declared assets.
- No instruction lets a creator send the vault’s tokens to a wallet.
- Fees are the same for every fund and can never exceed 10% on entry or exit.
What the protocol can do#
One protocol authority — a single key today, not a multisig — holds the platform’s emergency powers. The contracts let it:
| Power | Effect |
|---|---|
| Pause one fund | Stops new deposits into that fund. Redemptions continue. |
| Pause the whole platform | Stops every fund operation, redemptions included. |
| Emergency recovery on a fund | Freezes redemptions, and lets the protocol withdraw all of that fund’s assets — basket included — to an address it controls. This is the custody switch for an incident. |
| Close a fund | Winds it down and recovers its accounts’ rent; with holders still in, only under emergency recovery. |
| Change platform fees and launch costs | For all funds at once, up to the 10% cap; launch costs only for future launches. |
| Run the keeper | Executes the purchases and sales of deposits and redemptions, inside the plan each user signed. |
The protocol cannot rebalance a fund: that power belongs to its creator.
Guards switched off in this version#
The contracts contain a set of protections for depositors that are compiled out of the current version, which treats each fund as a tool its creator runs:
- no waiting period on policy changes or basket edits;
- no speed limits on a creator rebalancing directly (delegated keys stay limited);
- tokens with a freeze authority or issuer powers are accepted, and marked.
A future version for funds open to the public can switch them back on without moving any fund.
Risks#
- Smart contracts. The programs have been reviewed and audited internally. That is not the same as being safe.
- Market. The tokens in a fund can lose value, all of it.
- Creator. A creator can choose badly, rebalance badly, or change the basket and the policy at any time. The contracts bound where value can go, not whether decisions are good.
- Issuers. A token whose issuer can freeze, pause or move balances can block that asset in a fund.
- Liquidity. An illiquid token can make deposits fail and redemptions pay in kind.
- Custody. DFM’s server can sign for your app wallet (see App wallet).
- Displayed values. Share prices, TVL and returns are offchain estimates; the onchain truth is the token balances.
What DFM does not do#
- No price oracle in the contracts.
- No management fee, no performance fee, no per-fund fees.
- No automatic rebalancing unless a creator arms it.
- No curation of tokens, no liquidity floors, no depositor allowlists.