Security model
Every token’s strategy funds move through the same route: vault, revenue router, token-specific custody contract, and that contract’s Lighter account. The standard withdrawal calls have no field for choosing another wallet.
Keepers manage trades and move funds along that route. The protocol owner and Guardian manage operating settings, while the upgrade owner manages contract upgrades.
Standard fund path
- Flap sends the configured share of trading-tax revenue to the token’s strategy vault.
- The vault normalizes its registered revenue asset into USDG and sends the result to the fixed revenue router.
- The router assigns 75% to token-specific strategy capital and 25% to the token’s snapshotted protocol treasury.
- A keeper releases strategy capital only to the custody account stored for that token.
- Custody deposits only configured USDG into the Lighter account owned by that custody contract.
- Secure Lighter withdrawals return to that same custody contract.
- Custody settlement transfers USDG only to the fixed revenue router.
- Settled profit can leave the router only through validated buyback or dividend adapters.
Roles and permissions
These are the roles that can change settings or operate the system. Strategy control and fund movement are listed separately.
| Role | What it can do | Fund access |
|---|---|---|
| Deployer / creator | Chooses the token, trading pair, taxes, tax split, first strategy, control mode, manager, profit split, and dividend asset at launch. | No standard withdrawal access to strategy funds. |
| Fixed-mode controller | Can update Fixed-mode markets, direction, allocation, leverage, and active state. | Controls strategy settings, not withdrawal destinations. |
| Delegated manager | Can update a Delegated strategy and transfer the manager role. | Controls strategy settings, not withdrawal destinations. |
| DAO stakers | Can create proposals and vote on DAO-mode strategy changes. | Can withdraw their own staked tokens and rewards, not strategy capital. |
| Gateway submitter | Can submit the keeper actions exposed by the gateway. Active and Standby submitters have the same onchain permissions. | Uses the fixed vault, custody, router, and adapter paths. |
| Keeper | Can swap tax income, release margin, deposit to Lighter, request secure withdrawals, settle funds, and run buybacks or dividends. | Cannot choose another withdrawal wallet, but controls trading and how returned capital is marked during settlement. |
| Configuration owner | Can set the keeper, markets, leverage caps, quote assets, routes, launch fee, proposal fee, tax limits, deposit limits, launch availability, Fixed strategies, DAO rules, delegated manager recovery, loss records, and order cancellation. | Can change operating settings and loss accounting; standard fund destinations remain fixed. |
| Flap Guardian | Provides a permanent fallback for operating settings, keeper changes, Fixed strategies, DAO rules, manager recovery, loss recording, and cancelling Lighter orders. | No protocol-treasury withdrawal role. |
| Gateway owner | Can manage submitter roles and pause or resume the gateway. | Controls access to gateway actions, not their fixed recipients. |
| Treasury owner | Can manage treasury buyback permissions, operating funds, proposal fees, asset recovery, ownership, and treasury upgrades. | Can withdraw treasury balances. The treasury is separate from token strategy capital. |
| Protocol buyback signer | Can approve treasury-funded buyback amounts, routes, minimum outputs, deadlines, cycles, and chunks. | Uses the treasury buyback budget and sends purchased tokens to the burn address. |
| Buyback executor owner | Can manage the signer allowlist and recover unaccounted assets held by the buyback executor. | Manages the executor contract; buyback spending still uses the treasury’s recorded buyback budget. |
| Upgrade authority owner | Can upgrade the non-treasury proxies and the strategy-vault, custody, and DAO stake-vault beacons. | Can change contract behavior through upgrades, including how upgraded contracts move funds. |
Strategy vault restrictions
The standard strategy-vault implementation exposes revenue synchronization, normalization, router deposit, and read methods. It does not expose a user redemption, creator withdrawal, arbitrary token rescue, or recipient-selecting transfer function.
Vault finalization is one-use and requires the exact custody address predicted for the launched token. The creator cannot substitute a personal wallet or unrelated custody contract.
Revenue router restrictions
Only the registered vault can deposit normalized capital for a token. The router pulls the exact USDG amount, performs the fixed 75/25 split, and records per-token liabilities.
Margin release is keeper-only. Its parameters contain a token, amount, and action ID—not a recipient. The recipient is loaded from the token’s registration and must be its custody account.
Settlement accepts funds only from that same registered custody account. A random wallet cannot settle funds for a token or inject arbitrary accounting through the public interface.
Lighter custody account
Each custody contract is initialized for one launched token and one fixed set of dependencies:
- revenue router;
- protocol configuration;
- USDG collateral token;
- Lighter proxy;
- Lighter USDG asset index;
- expected USDG and Lighter runtime code hashes.
Its operational methods do not accept an arbitrary asset, route, Lighter owner, transfer recipient, or external call target. Deposits identify address(this) as the Lighter account owner.
Secure withdrawal
The keeper requests a Lighter withdrawal for the custody-owned account and configured USDG asset. After Lighter processes it, the keeper claims the pending balance to address(this). The claim method contains no external recipient.
Settlement
Custody approves the fixed router for the settlement amount, calls the router, and clears the approval. The request cannot redirect settlement to a keeper or creator wallet.
Lighter credential model
The custody contract is the L1 owner of its Lighter account. The execution service uses a Lighter API key in a dedicated account slot. The key can trade and request secure withdrawals.
Under Lighter’s secure-withdrawal model, a withdrawal requested without the owner’s Ethereum signature returns to the L1 account owner. In Perpetuals, that owner is the custody contract, not an EOA with a known private key.
Keeper powers
The configured keeper can:
- normalize vault revenue through approved routes;
- release available strategy capital to custody;
- deposit custody USDG to Lighter;
- initialize or operate permitted Lighter actions;
- request and claim secure withdrawals;
- choose settlement amount and principal-return classification;
- execute strategy-profit buybacks and dividends.
Upgrade authority
Most Perpetuals components use transparent proxies or upgradeable beacons. The upgrade authority can replace the router, normalizer, configuration, gateway, authority hub, factories, coordinator, adapters, strategy vault implementation, custody implementation, and DAO stake-vault implementation.
Upgrade calls check expected current and candidate code hashes, component identifiers, and registered dependency relationships. These checks protect against accidental upgrades and mismatched components.