Trust & failure model
What is self-custodial, what is centralized, what can fail, and what users should expect when it does.
What self-custody means here
Your USDC is held in a strategy account created for you. The operator does not get a withdrawal key. The executor cannot pull arbitrary amounts, cannot withdraw to itself, cannot change your destination wallet, and cannot change your selected asset.
Self-custody does not mean nothing external matters. It means the protocol is designed so external actors have narrow powers and failures generally stop execution rather than give someone custody of your funds.
Who you trust, and for what
| Actor or system | What it can do | What it cannot do | Main risk |
|---|---|---|---|
| Your wallet | Create, fund, pause, resume, withdraw, claim pending output. | Change immutable strategy settings after creation. | Wallet compromise can withdraw your strategy funds because it is the owner. |
| Executor bot wallet | Trigger scheduled batches through executeBatch. | Withdraw user funds, execute early, over-pull, change settings, lower the oracle floor. | Liveness and gas/key management. A compromised key can waste gas or trigger due batches within contract limits. |
| 2-of-3 owner Safe | Change protocol config, pause, whitelist assets, set executor/router/oracle, set capped fees. | Withdraw from user strategy accounts or mutate existing strategy parameters. | Admin misconfiguration can halt execution or route future execution badly. |
| Treasury Safe | Receives execution fees and yield fees. | Control user strategy funds. | Fee recipient compromise affects protocol revenue, not user custody. |
| Aave V3 | Holds idle USDC when yield is enabled. | Change your strategy settings. | Aave smart-contract or market risk affects yield-enabled idle USDC. |
| Uniswap V3 | Executes current Base swaps. | Pull funds except through approved adapter flow. | Liquidity, price movement, and routing failures. |
| Chainlink feeds | Set the independent on-chain price floor. | Execute swaps or move funds. | Stale, down, wrong, or misconfigured feeds cause reverts or bad floors. |
| GitHub Actions / RPC / Quoter | Run automation, read state, quote routes, submit transactions. | Bypass on-chain validation. | Downtime delays scheduled buys. |
What can never be changed for an existing strategy
After creation, the following values are immutable in the strategy account: owner, target asset, amount per execution, frequency tier, destination wallet, yield enabled flag, yield adapter, referrer, batch executor address, and factory address.
Admins can change protocol-level settings for future behavior, but they cannot rewrite an existing strategy into a different asset, different amount, or different destination.
What the operator can change
The owner Safe can update capped fee parameters, the treasury address, approved yield adapters, Aave config for new auto-deployed adapters, minimum amounts, the executor address, the swap router, asset allowlist entries, adapter routes, and oracle routing/configuration. It can also pause strategy creation or batch execution.
These powers exist because the protocol depends on external systems whose addresses and health differ by chain: tokens, Aave, Uniswap, Chainlink feeds, and automation providers. The trade-off is explicit admin trust around configuration.
What happens if automation fails
GitHub Actions is the current interim executor on mainnet. If GitHub, the configured RPC, the quoter, the executor wallet, or the workflow configuration fails, scheduled buys can be delayed or missed.
Missed execution does not give anyone custody of funds. Your USDC remains in your strategy account or in its Aave adapter if yield is enabled. The account stays withdrawable. When automation recovers, it resumes from the current protocol schedule window; it does not automatically buy every missed historical window.
What happens if pricing protection fails safe
The protocol is designed to prefer no trade over an unsafe trade. If the executor quote fails, the script skips the batch. If the on-chain oracle is missing, stale, unsupported, or detects the Base sequencer is down or recently recovered, executeBatch reverts and no swap happens.
This protects users from a bad price, but it also means buys can be delayed during oracle or sequencer incidents.
What happens if pricing protection is misconfigured
The most important oracle configuration risk is the composed feed for cbETH and wstETH. Those assets use market <asset>/ETH feeds multiplied by ETH/USD. If an operator configured an exchange-rate feed instead of a market feed, the floor could be wrong during a depeg.
The deployment mitigates this by using feed addresses verified through on-chain description() reads and by running an off-chain divergence monitor. The contract itself cannot know whether a feed was chosen for the right economic reason. This is an operator trust assumption.
What happens if Aave fails
If yield is disabled, Aave is not in your fund path. If yield is enabled, idle USDC sits in Aave through a per-account adapter. When a scheduled buy is due, the strategy tries to withdraw the exact per-execution amount from Aave. If that withdrawal fails, the account is skipped for that window without being auto-paused.
On full withdrawal, the account withdraws its full Aave position, calculates yield only if the returned amount is above tracked principal, pays the capped yield fee on that positive yield, and sends the rest to the owner.
What happens if output delivery fails
The strategy account first tries to transfer purchased tokens to the destination wallet. If the token transfer returns false or reverts, the account records the amount as pending and keeps the tokens in the strategy account. The owner can call withdrawPending(asset) later.
What happens if the protocol is paused
There are separate pauses. Pausing the factory blocks new strategy creation. Pausing the BatchExecutor blocks batch execution. Neither pause blocks user withdrawal from a strategy account.
A pause is an emergency brake for new activity, not a custody freeze.
What is not guaranteed
- No guarantee that every scheduled window executes exactly on time.
- No guarantee of a particular price, only minimum-output checks for each submitted batch.
- No guarantee that Aave yield is positive or available.
- No guarantee that external protocols such as Aave, Uniswap, Chainlink, Base, RPC providers, or GitHub Actions remain available.
- No guarantee that smart contracts are bug-free.
Related topics
- User flows explains the day-to-day lifecycle.
- Price oracle explains the independent price floor.
- Deployed contracts explains the current executor setup.
- Security & controls explains what the protocol can and cannot do.