FidesDocs · trust model
Security & invariants
Security here isn't a promise in a PDF — it's five invariants the test suite hammers on every path, plus a deliberately boring admin surface.
| # | Invariant | Plain English |
|---|---|---|
| INV1 | Backing | For every asset, the vault's balance always covers supply × units. One token is never worth less than its basket. |
| INV2 | No drain | Tokens leave the vault only via redemption or whitelisted rebalance swaps. There is no arbitrary transfer, sweep, or rescue function. |
| INV3 | Redeem liveness | No admin action can block redemption. Pausing mint, zeroing the rebalancer, dropping the cap — redeem still works. |
| INV4 | Closed set | The asset list is fixed at construction. A rebalance can never introduce a new token. |
| INV5 | Bounded guardian | The guardian can pause mint, lower the cap, and rotate roles. It can never move balances, change units, or touch redemption. |
| Actor | Can | Cannot |
|---|---|---|
| Guardian | pause/unpause mint · lower supply cap · set fee recipient · rotate rebalancer/guardian | withdraw · pause redeem · raise the cap back up · change rails or the asset set |
| Agent (rebalancer) | call rebalance() within whitelist, slippage cap, turnover cap, cooldown | withdraw · mint · touch any other function |
| Holder | mint (when open) · transfer · redeem anytime | — |
The suite is 95 tests across six files — unit, fuzz, invariant, adversarial, and fork:
- Invariant fuzzing — INV1/INV2 hold across hundreds of thousands of random mint/redeem/rebalance sequences (2 × 128k calls, zero reverts).
- Adversarial suite — reentrant router, router that over-pulls funds (
EvilRouter), frozen-asset tokens, exact-wei boundary attacks on every rail. - Fork tests— mint/redeem against real Robinhood Chain state (chain 4663) with the real stock tokens' ERC-20 semantics.
- Real-basket suite — the actual 6-asset Frontier configuration at real prices, not just toy 2-asset setups.
- Issuer risk is inherited. Tokenized stocks are debt instruments of Robinhood Assets (Jersey) Ltd — holders are creditors, not shareholders. An issuer freeze on one asset blocks whole-basket redemption until it lifts.
- Oracles gate rebalance, not redemption. A broken feed can pause good rebalancing; it cannot lock your exit.
- Testnet ≠ mainnet. Current deployment is testnet with mock feeds. Mainnet ships after a final hardening pass (sequencer-uptime check, oracle-pause handling, route fork-testing against live pools).