How it works

Six actions touch the fund: deposit, ask, decide, execute, redeem and fee. Anyone can run ask, execute and fee.

1. Deposit

sequenceDiagram
  participant U as Holder
  participant F as Fund program
  participant S as Share mint
  U->>F: deposit(amount, min_shares)
  F->>F: value the pool at oracle prices, shares = amount net of the 0.1% fee / value per share
  F->>F: USDC into the USDC vault (public)
  F->>S: mint shares (public), then confidential Deposit into the holder's pending balance

An explorer shows the USDC amount and the minted amount in that one instruction, and a share balance of zero afterwards. The 0.1% deposit fee stays in the pool, so existing holders are paid for the price staleness a deposit can exploit. min_shares protects the depositor from a move in price between quote and landing (SharesBelowMinimum).

Before the first deposit the holder's share account must be configured for confidential transfers (an ElGamal key and a validity proof, 5,008 CU). Then ApplyPendingBalance moves pending shares into the available balance.

2. Ask

Anyone calls request_decision. The program values each vault at its price (Pyth for the crypto assets, Kamino Scope for the stocks and gold) and queues the decide computation with the eight values and the sealed rules. At most one decision every 15 minutes (DecisionCooldown), and only when the pool is worth at least $100 (PoolTooSmall).

3. Decide

The cluster compares current weights to the hidden targets and reveals one order: sell the most overweight asset, buy the most underweight one, by the smaller gap, if that gap exceeds the hidden band. A quiet run reveals all zeros. decide_callback verifies the cluster's BLS signature and writes the order into Order. A callback that does not belong to the latest request fails (StaleCallback).

4. Execute

sequenceDiagram
  participant K as Anyone
  participant F as Fund program
  participant R as Orca or Jupiter
  K->>F: execute(route accounts)
  F->>R: vault authority signs the route call
  R-->>F: tokens move
  F->>F: check what moved against the order and the bands

After the route call the program checks: only the sell vault went down, by at most the order's amount; the buy vault went up; the output is worth at least 99.5% of the input at the fund's prices; the trade fits the order and uses at least half of it; the day's traded value stays under 20% of the pool's value at the start of the UTC day; and no vault's owner, delegate or close authority changed. An order lives five minutes. Any failure reverts the whole trade.

5. Redeem

1. The holder moves shares from the confidential balance to the public one with the standard Token-2022 withdraw: a range-proof context account, the range proof (111,000 CU on its own), and the withdraw with its equality proof.
2. redeem(shares, min_out) burns the public shares and pays the same fraction of each of the eight vaults, in kind.

Four transactions in all. No prices are involved, and redeem works while the fund is paused.

6. Fee

crystallize, callable by anyone (and run at every deposit), mints new shares to the fee account worth 5% of the gain in value per share above the high-water mark, then moves the mark. No management fee.

What a reader of the explorer sees