The manager signs. The vault decides. The chain remembers.
Zorpha separates three things that most asset management collapses into one: who decides the trade, who holds the funds, and who keeps the record. A manager only ever produces a signature. The vault holds custody and enforces its own limits. The chain writes the record, and nobody can edit it afterwards.
What happens when a manager rebalances
- 1
The manager signs an instruction
An EIP-712 payload naming the vault, the target weight, a nonce and an expiry. It is a signature, not a transaction. The manager never holds a privileged position in the vault.
- 2
Anyone can submit it
The signature is worthless to a third party: it can only do the one thing it says, to the one vault it names, once. Submission is permissionless, so the protocol does not depend on the manager also running reliable infrastructure.
- 3
The executor verifies and rate-limits
It checks the signer is the vault’s authorised manager, that the nonce has not been used, that the expiry has not passed, and that the manager is under their daily limit.
- 4
The vault enforces its own rules
Independently of the executor, the vault re-checks the target is within bounds, prices the trade against its oracle, reverts if the price is stale or out of range, and refuses a fill worse than its slippage cap.
- 5
The receipt is emitted
Target, both legs of the trade, resulting NAV per share, the nonce and a commitment hash binding all of it. Permanent, timestamped, and readable by anyone.
- manager
- 0x8f2a…4c19
- targetBps
- 7000
- navPerShare
- 1.04182
- nonce
- 42
- commitment
- 0xb617f5353dc8…18ff
The key that signed. Not a display name someone typed.
70% exposure requested. The intent, recorded before the fill.
Vault NAV at execution, computed from the oracle the vault is pinned to.
Strictly increasing. A skipped nonce is a visible gap in the record.
Hash binding every field above. Change one number and it stops matching.
Emitted by the vault contract itself, so it exists whether or not this website does.
The commitment hash is what makes a track record checkable rather than merely public. Recompute it from the fields; if it does not match, the record has been tampered with.
Three mandates, deliberately few
A permissionless vault factory produces a long tail of anonymous strategies that nobody can meaningfully evaluate. V1 curates instead: every vault is deployed through a gated factory and reviewed before it exists.
Long / Flat Equity
zqHOODHolds a single tokenised equity or sits in cash. The manager sets a target exposure in basis points; the vault will not act on a target that moves less than its rebalance threshold, which stops fee-generating churn.
- Mandate
- One asset versus USDC, 0–100% exposure
- Pricing
- Single oracle, staleness-checked, fails closed
- Slippage cap
- 1% per rebalance, enforced onchain
- Performance fee
- 20% above high-water mark
RWA Rotation
zqROTHolds a basket of tokenised equities against a USDC base and reweights between them. Target weights are stored onchain, so the intended portfolio is public before the trades settle.
- Mandate
- N-asset basket, weights sum to 100%
- Pricing
- One oracle per asset, each staleness-checked
- Weights
- Stored onchain and emitted per rebalance
- Performance fee
- 20% above high-water mark
USDC Yield
zqUSDRoutes idle USDC through a pluggable yield adapter. V1 ships a zero-yield, zero-risk stub so the slot is real before a lending market is wired in; swapping the adapter is a timelocked action.
- Mandate
- USDC in, USDC out, via one adapter
- Adapter changes
- Timelock-gated, 48-hour delay
- Performance fee
- 10% above high-water mark
- Status
- Live. Capital routes through the adapter
The properties that hold regardless of who is managing
- Custody
- Funds live in the vault contract. No manager, keeper or admin address can transfer them out.
- Share accounting
- ERC-4626. Deposits and redemptions are priced from the vault’s own valuation, not from a quoted figure.
- Oracle failure
- Fails closed. A stale or out-of-bounds price reverts the rebalance rather than pricing it wrongly.
- Fee basis
- Performance fee only, charged above a high-water mark. No management fee, so an idle vault costs nothing.
- Rate limiting
- Each manager has a per-day rebalance limit, capping the damage from a compromised signing key to roughly a day of misdirected exposure.
- Circuit breaker
- A risk-council role can halt deposits and rebalances on a single vault without touching redemptions.
- Admin delay
- Every privileged change is queued in a 48-hour Timelock owned by a multisig.
Each of these is pinned by a test
Each guarantee above is covered by tests rather than asserted in prose: 97 unit and fuzz tests plus seven stateful invariants, including one that fails the run outright if the fuzzer never actually managed a deposit or a rebalance.