FidesDocs · system design
Architecture
Three components, each with the minimum power it needs. The vault is the only one that ever holds funds.
| Component | Where | Role | Power over funds |
|---|---|---|---|
FidesVault | onchain | ERC-20 index token + custody + every rule (mint, redeem, rebalance rails, invariants) | Full — and rule-bound |
FidesUniV4Router | onchain | Adapter that executes the vault's swaps over Uniswap v4 (multi-hop through a quote currency) | Transient only — pulls in, swaps, pushes back in one call |
| Agent | offchain | Momentum strategy → swap plan → submits rebalance() with its rationale | None — holds only the rebalancer key |
A single contract per index: ERC-20 token, asset custody, and all policy. Configuration that matters for safety — the asset set, slippage/turnover caps, cooldown, fee cap, supply ceiling — is immutable after deploy. The mutable surface (guardian actions) is deliberately tiny and can never move balances or block redemption.
The vault doesn't speak Uniswap; it calls one clean interface — swap(tokenIn, tokenOut, amountIn, minOut). The adapter walks an owner-registered route of v4 pools (stock → quote → stock, since stocks pair against a quote currency, not each other) inside a single lock. It is stateless with respect to funds: a malicious or buggy route can at worst waste one approved amountIn— already bounded by the vault's turnover and slippage rails — and can never drain custody.
Runs offchain: fetch prices → compute momentum-tilted target weights (with per-asset caps) → plan the smallest set of swaps within the turnover budget → submit. Its key is a rebalancer session key: the only function it can successfully call on the vault is rebalance().
- If the agent dies, the product degrades gracefully: mint and redeem keep working; the basket just stops rotating.
- If the key leaks, the attacker inherits the same cage — bounded trades inside the rails, no withdrawals.
Valuation uses Chainlink stock feeds (AggregatorV3Interface, 8 decimals) — the official oracle stack on Robinhood Chain. Oracles gate rebalance quality (slippage checks and NAV); they are intentionally not in the redemption path.
Oracle note