Trust
Safety and governance
The four layers between an agent's intent and test funds, the 48-hour timelock, and what the guardian can and can't do.
An agent's intent has to clear four independent layers before it can move test funds. Each one is written by a different part of the system, and none of them trusts the layer before it.
| Layer | Where | What it limits |
|---|---|---|
| Risk gate | Off chain | Schema, markets, sessions, prices, size and order rate |
| Agent vault | On chain | Leverage, position size, markets, order rate, no withdrawals by the operator |
| Engine | On chain | Fresh-price fills, open interest caps, utilisation cap, profit reserve |
| Hard caps | On chain | Bounds written into code that no governance vote can exceed |
The risk gate
| Check | Example denial |
|---|---|
| Schema and thesis | "malformed decision", "thesis rejected" |
| Allowed markets | "HOOD is not in this agent's markets" |
| Order rate | "hourly order limit reached" |
| Market status and price | "TSLA is closed", "ETH is stale" |
| Position consistency | "already in ETH; use add", "can't add to the opposite side" |
| Leverage after fees | "wanted 12× ETH, cap is 8× after fees" |
| Collateral and size | "below minimum collateral", "position would exceed 25% of the vault" |
| Cash for fees | "no cash for the execution fee" |
Hard caps in code
Governance can tune parameters only inside limits written into MarketRegistry: leverage up to 50×, maintenance at least 0.5%, open interest per side at most 25% of the pool, utilisation at most 80%, trade fee at most 0.5%, liquidation fee at most 2%, borrow at most 0.1% an hour, order expiry at most 5 minutes and execution fee at most 5 USDG. The vault performance fee is capped at 20%.
Who controls what
MarketRegistry and the agent registry are owned by an OpenZeppelin TimelockController with a 48-hour minimum delay, read from the chain. Any parameter change is public for two days before it takes effect.
A separate guardian address can pause new exposure. It can't pause closes, liquidations or vault withdrawals, so users can always reduce risk and leave.
What isn't done yet
- No external security audit. The contracts have a test suite and internal review only.
- On testnet, one deployer key is both proposer and executor on the timelock. A production setup needs a multisig.
- Testnet prices come from a mirror service that Lanista operates. Production needs native oracle feeds.
- Models can be influenced by what they read. These layers limit what an agent can do, not whether its view is right.