Trust
Foundling takes the keys out of the vault, not the trust out of the system. Here is every party you still rely on, what each one can do, and what limits it.
Cannot happen
Governor, guardian, keeper and agent can stop, start or propose. The contract sends tokens only to share holders, and to Rhea for a capped swap.
Can happen
Inside caps per trade and per epoch. Windows add up over time, and only the book value bounds the total.
Still trusted
Vault code no third party has audited, the enclave hardware and OutLayer, Rhea and its oracle, and the USDC issuer. Each one is listed below.
Who can do what to the vault. None of them can move your funds.
| Role | Account | Can | Cannot |
|---|---|---|---|
| Governor | gov.foundling.near | Unfreeze, clear a halt, tighten the policy, add depositors, schedule keeper and guardian changes after the timelock. | Loosen a cap, add an asset or route, change the strategy, upgrade the contract, move funds, or open the secret. |
| Keeper | keeper.foundling.near | Start a cycle and run its steps: trigger_cycle, execute_decision, advance, abort_stale_cycle, expire_decision. | Make the decision or move funds. |
| Guardian | guard.foundling.near | freeze and cancel_keeper_change. | Unfreeze, change the policy, or move funds. |
Foundling is built by a team of two, so these roles are split between two teammates, not between independent parties. The lead holds the governor and keeper roles. The other teammate holds only the guardian role. Whoever holds these keys, the contract still enforces the caps, moves tokens only to share holders and Rhea, and keeps redeem open while frozen.
Changes wait out a timelock and show here before they take effect.
No rotation is scheduled.
What can go wrong with each one, and what in the design limits it.
| Party | What it could do | What limits it |
|---|---|---|
| Chain and tokens | ||
| USDC contract and its issuer | Freeze or block USDC, including USDC on its way out of the vault. | Nothing on our side. Exits depend on it. |
| wNEAR contract | Fail a transfer of wNEAR. | A failed transfer is kept in claimable and can be withdrawn later. |
| Trading | ||
| Rhea contracts and their DAO | Pause the exchange, freeze tokens, or upgrade the contract. | The vault trades only pool 4512 and its two tokens, fixed at init. A stuck swap has a recovery path. |
| Rhea aggregate oracle and its DAO | Move the price the vault uses; the DAO can upgrade the oracle at once. | Per-trade caps, price age and price width checks, and a deviation check against the pool. |
| Strategy and proofs | ||
| OutLayer operator | Withhold a decision, or run the enclave with its full-access key. | No decision means no trade. Caps hold whatever the decision is. |
| Intel TDX, NVIDIA and the Phala host | Break the enclave and read the sealed parameters. | Caps still hold. Sealing is lost, not funds. |
| NEAR AI Cloud | Answer badly or not at all. | Its advice can only lower exposure. A missing answer blocks a buy, never a sell. |
| Website and deposits | ||
| This website and its server | Show you a misleading screen, or a false proof result. | Every action has a CLI command, and every proof has a command to check it yourself. |
| Wallet executor code | The wallet connector loads each wallet's code from a third party at run time, unpinned. A changed executor can ask your wallet to sign any transaction your key allows, including transfers that have nothing to do with the vault. | Only your wallet's own confirmation screen. Read it before you sign. |
| 1Click (NEAR Intents) | Give a wrong deposit address, or fail or refund a swap. | The website checks the quote signature and every field before it shows an address, and USDC lands in your own NEAR account first. |
What bounds each kind of loss, and what does not.
| Scenario | What bounds it |
|---|---|
| A run of bad trades | Each trade is capped, but losses add up across cycles. Only the book value bounds the total. |
| A wrong oracle price | Caps, price age, price width and the pool deviation check limit one trade, not a series. |
| A frozen USDC or wNEAR balance | Exits wait on the token contract. |
| A contract bug | There is no audit and no upgrade. The answer is a new vault. |
A swap step that gets no answer for stuck_after seconds can be advanced by anyone. If it is still stuck halt_after seconds after it first stalled, the next advance halts the vault until the governor clears it. Redeem stays open throughout.
stuck_after = 600 s · halt_after = 3600 s
On 2026-04-16 an attacker built a swap route through a pool of fake tokens on Rhea and opened margin positions, for a loss of about 18.4 million USD by Rhea's post-mortem. Margin trading was stopped for good. The vault is not exposed to that pattern: its pool and both tokens are fixed at init with no method to change them, so no route through another pool can be formed.