Protocol
Security model
Who can do what, what protects your funds, and what does not.
Roles
| Role | What it can do |
|---|---|
| Account owner | Everything on their own account: policy, payees, funding, unwinding, withdrawing, pause, revoke. |
| Agent signer | Request payments within the policy. Nothing else; it can never withdraw. |
| Keeper | Move an account's idle cash into a registered adapter and back. It cannot send funds anywhere else. |
| Admin (timelock) | Change parameters, add adapters and grant roles, each only after a 24-hour delay. |
| Pauser | Pause the buffer and router in an emergency. Owners can still exit while paused. |
| Anyone | Call settleDebt and refillBuffer, which only move funds to repay what is already owed. |
Safeguards
- Deposit caps of 50,000 USDG on the buffer and on each asset adapter during the guarded launch.
- Debt can never exceed an account's collateral, so one agent cannot drain the buffer.
- Payment IDs are single use, so a payment cannot be replayed.
- Fees are recognized only when repaid, so the share price cannot be inflated by unpaid debt.
- All contract sources are verified with an exact match on Sourcify.
- A monitor checks protocol health every 15 minutes and opens an alert for anything new.
Testing
The contracts have unit, fuzz and invariant tests, and a fork test that runs the full flow against the live mainnet contracts, real USDG and real spUSDG without moving real funds.
Report a vulnerability
Never test against mainnet funds. Report it privately through a GitHub security advisory on the Unslept repository. Do not open a public issue or share details elsewhere.