Security & trust

Your deposit sits in one of exactly two places, and there is no function anywhere that sends it to a third.

1. The winter store — idle USDG held by the vault itself. Every transfer of USDG out of the vault contract is a redemption paying a depositor, or a transfer to the liquidity manager below. There is no rescue function, no admin withdrawal, and no owner path to the accounting asset. 0x942ED2fa…24F0f01e
2. Uniswap positions — held by the liquidity manager. It can hand USDG to a pool the registry has verified, or hand it back to the vault. Its one recovery function rescue() explicitly reverts on the accounting asset, so governance cannot use it to remove your capital. 0xcC4c4141…435e0Ca7

The manager can only be funded by calling the vault, and the vault only accepts that call from the same contract that reports position value — so the thing holding the positions is necessarily the thing pricing them. Every keeper action is wrapped in a check that value has not left the system by more than a set tolerance, and that nothing was left stranded in the manager afterwards. If either fails, the whole action reverts.

The keeper cannot choose where to put money. It can only use pools that governance has already listed in the registry, and listing is not a matter of trust — the registry asks the Uniswap factory whether it deployed that pool, for that exact token pair and fee tier, and refuses the listing if the factory says no. 0x8D81A3DC…0D2b3cA4

That check matters more on this chain than most. The canonical Uniswap addresses from Ethereum mainnet are squatted here by a contract whose entire interface is {changeOwner, recoverETH, recoverUSDT, transferTokensTo} — a fund sweeper that the block explorer labels “UniswapV3Factory”. Worse, calls to it succeed with empty data rather than reverting, so a naive integration decodes zeros and carries on. There are also explorer-verified counterfeit tokens: a fake “USD Coin” with 18 decimals, a fake “Tether USD”, and a memecoin using the ticker USDG. Making the factory vouch for every pool is what makes any of that survivable.

• Each pool carries its own allocation cap, so no single pool can hold the whole vault.
• Pools move through active → exit-only → banned. Governance can stop new money entering a pool without stranding the money already in it.
• A range must contain the time-weighted average price and be roughly centred on it, so the keeper cannot park liquidity somewhere it will never earn.
• Swap floors are derived on-chain from the pool's own TWAP. The keeper never passes in the price it wants to accept.

A Pippin Leaf is a share of the vault. The leaf token records who may mint it as an immutable set at construction, and there is no setter — so the only address that can ever create a leaf is the vault, and the only way the vault creates one is when someone deposits. No premine, no treasury allocation, no owner mint. 0xbAD1293b…85755035

Your leaf count never changes on its own. What moves is what each leaf is worth: net asset value divided by leaves outstanding. Because deposits and exits are both priced at the conservative mark, neither can shift that number in their own favour — so what drives it is the strategy earning, which is what carries the leaf price up.

• Instant, from the buffer. If the idle store covers your exit you are paid immediately.
• Otherwise you queue, strictly first-in first-out, with no ability for anyone to skip you. Your leaves are escrowed, not burned, at the moment you request — burning them early would reprice every remaining leaf in your favour.
• Payouts are pull-based. One address that cannot receive tokens therefore cannot jam the queue for everybody behind it.
• There is an escape hatch. If the queue stalls past its limit, anyone can force the head of the queue out by handing them a strictly pro-rata slice of every position — no swap and no price read, so it works even if the vault cannot be valued at all.

Exiting instantly while the vault is fully deployed pays a redemption fee. It is the only fee live in the contracts today, it scales with how much of the buffer your exit drains, it is capped, and it is zero when the buffer absorbs you. It is not our revenue — it stays in the vault and accrues to the holders who did not exit, which is what stops a race to be first out. 0xa722bdA6…0C564B49

The minimum comes first. 15% a year in stables and 50% a year in ETH is what you receive, and our share is taken from what the strategy earns beyond it — so a fee is only ever charged against money you would not otherwise have had.

Above the minimum

20% of the return above 15% in stables, or above 50% in ETH. Nothing is taken from the return up to that line — the first 15% or 50% is untouched. Used to buy Pippin tokens.

Below the minimum

1% of what was earned, taken when you withdraw. You still receive the minimum: closing the gap is our side of the arrangement, not a cost passed to you.

Pool management

0.01% of assets per day — which compounds to 3.58% a year, not 3.65%. It comes out of the return above the minimum, never out of the minimum itself. Used to buy Pippin tokens.

Every one of those goes into buying Pippin tokens, so what we earn is tied to the token rather than to churn in your position. Nothing in the schedule rewards us for trading you more often.