11 Trust
The vault and the venue
What the vault contract can and cannot do, who can call what, and how a coin's money moves through Lighter.
This page is the technical side of Who controls what. The contract is PerpyVault, created per coin by PerpyVaultFactory. Both are tested (42 tests, five of them against the real Pons, Uniswap and Lighter contracts on a fork) and not deployed yet. See Status.
#The money path
| Step | What the vault does | Where the funds go |
|---|---|---|
| Claim | Sweeps the coin's creator fees from the Pons curve into the Pons fee escrow, then claims them | Into the vault. Anyone can trigger it. |
| Split | 20% of the claim, then the rest by preset | The platform wallet, then three counters inside the vault: buyback, trade, reserve |
| Buyback | Buys the coin on its own Pons curve | The burn address, or the vault itself as a holder pot |
| Margin | Swaps ETH to USDG through the Universal Router, deposits USDG at Lighter | Into the vault's own Lighter account |
| Orders | Places orders on the vault's one market | Nowhere: orders move positions, not funds |
| Withdraw | Asks Lighter for USDG back, then claims it when it matures | Back to the vault only |
| Settle | Principal first, then wins pay the loss book, the rest of the profit is swapped to ETH | 15% to the creator, 85% to the buyback pile |
There is no function that sends the vault's funds to an arbitrary address. Every destination is in the table above and fixed in the code.
#Who can call what
| Call | Keeper | Creator | Anyone |
|---|---|---|---|
| claim, collect | yes | yes | yes |
| attach (bind the vault to its coin) | yes | yes | yes, checked against the Pons registry |
| buyback, fund, redeploy, placeOrder, distribute | yes | no | no |
| cancel all orders, close all, queue a withdrawal, settle, write off | yes | yes | no |
| emergency exit (cancel, close, stop new deposits and opening orders) | yes | yes | no |
| recover idle ETH after 14 days of keeper silence | no | yes | no |
The keeper is one address fixed when the vault implementation is deployed. It cannot withdraw to itself, change the market, the side, the leverage or the preset, or open an order bigger than margin × leverage.
#The Lighter account
The vault owns its Lighter account. The first deposit (at least 5 USDG) registers it. Orders, cancels, the position close and withdrawal requests are sent by the vault straight to Lighter's contract on Robinhood Chain, as the account owner. Lighter processes them as priority requests in its batches (about one a minute), so none of them happens in the same block. Matured withdrawals can only be paid to the account owner, which is the vault.
This is why the keeper does not need a Lighter API key: the vault places its own orders, and the keeper only decides when and how big.
#The loss book
The vault cannot read Lighter's account, so it keeps a loss book from what it can see. USDG that comes back is principal first. If the account is wiped out and nothing comes back, the keeper or the creator records a write-off, which moves that principal into the loss book. Later wins pay the book down before anything counts as profit, and only profit pays the creator's 15%. A false write-off could only lower what the creator earns. It cannot move funds, and every one is an event that can be compared with the venue's account history.
#Ways out
- Emergency exit. The creator (or the keeper) cancels resting orders, closes the position at market and stops new deposits and opening orders. The withdrawal path stays open.
- Withdrawing. The creator can queue a withdrawal and settle without the keeper.
- A platform that disappears. If the keeper has been silent for 14 days and no capital is deployed, the creator can recover the vault's idle ETH.
- Settling needs nobody's permission to land. Collecting a matured withdrawal is permissionless.
#What is verified and what is not
Verified against the real contracts on a fork: the Pons launch and fee flow, the buyback on the curve, the ETH to USDG swap and back through Permit2 and the Universal Router, the Lighter deposit and account creation, and Lighter accepting market orders, limit orders, a position close, a cancel and a withdrawal request from the vault.
Not verifiable on a fork: how the rollup fills and settles those requests, funding, and real liquidations. These are simulated in the keeper's tests. The first deployment is meant to be small, to watch one real cycle.
Not routed yet: buybacks after graduation (the coin trades in a Uniswap v4 pool then), and merkle payouts for pool coins.