🟦 ETH / USDC Endowment Vault

Pool Ladder & Ranges

The vault runs THREE overlapping concentrated-liquidity positions at once on a shared log-price axis. Each colored bar is one pool's live range. The green SPOT line is the current price; the amber HIGH-WATER UPPER line is the highest ceiling the strategy has ever ratcheted to (it never moves down). Faint vertical gridlines are the ~1.42x ladder steps the strategy walks along.

🔒 Connect to unlock

Connect the admin wallet (full custody) or the keeper wallet (operations). Functions below appear only for the role you hold. Read-only visitors see nothing actionable here.

📜 Execution History

Every keeper / governance action the vault has ever taken, read straight from the chain with real block timestamps. Newest first. Each row links to its transaction.

📡 On-chain Events (raw, live)

📚 How It Works

What this is

An ETH-denominated endowment. You fund it with USDC; it provides concentrated liquidity in the deep Uniswap v3 WETH/USDC 0.05% pool across THREE overlapping ranges at once. Trading fees are skimmed to USDC and either compounded back in or released as a capped spend stream, but profit only releases when ETH-denominated principal is at its high-watermark, so it structurally cannot spend principal.

Funding

Fund in USDC only. The keeper's allocate() deploys idle reserve into the three pools 25/50/25; because each straddling range needs both tokens at its own ratio, the contract swaps part of the USDC to WETH (slippage-guarded vs TWAP) before minting each position. You don't need to provide WETH yourself.

The three pools

The pool is the shared, pre-existing Uniswap WETH/USDC 0.05% pool, one of the deepest in DeFi. The vault never creates a pool — it holds three position NFTs inside that one pool, with a target value split of 25 / 50 / 25:

Lower Safety (25%) sits one ladder step below the active range up to the active upper — a downside cushion that keeps earning if price dips. Active Fee (50%) straddles the current price with a sticky floor and a dynamic upper (spot +6–15%) — the main fee engine. Upper Breakout (25%) trails its lower edge near spot and reaches up to the next ladder target — it captures momentum on the way up. The ranges deliberately OVERLAP near price for depth.

How it moves

On a confirmed 4h hold above the active upper, the keeper calls breakoutUp: it raises the pools' uppers (active capped at spot +15%, lower's upper follows active, breakout chases the next ladder), re-mints only the pools that clear an anti-churn threshold (upper moves ≥5% OR value shifts ≥$100), and ratchets the high-water upper which never decreases. On a confirmed close below the lower floor, rollDown resets the Lower Safety pool one step down (never below MIN_PA). If price crashes below MIN_PA, belowFloorCollapse widens all pools to [MIN_PA – high-water upper] so nothing is abandoned. Each re-mint redeploys real recovered tokens, zapping USDC↔WETH to each pool's ratio (TWAP-guarded).

Safety

Spot-vs-TWAP guard (rejects manipulated rebalances), +15% extend cap on the active upper, high-water upper that never decreases, 4h close-and-hold confirmation, anti-churn re-mint threshold, full-precision math (FullMath), SafeERC20, reentrancy guards, and two-step timelocks on admin grants, profit-spending config, and ownership renounce. Admin has full custody and can always withdraw — but only to the owner or the immutable treasury address.

Roles & who can do what

Owner = 0xF60f… (Idon's Safe). Appoints/removes admins and keepers, pauses, sets the Profit Spending config, and can renounce ownership. Owner does NOT have custody by virtue of being owner. Owner-only functions: setAdmin, armAdmin/confirmAdmin, setKeeper, pause, setSpendConfig, armSpendConfig/confirmSpendConfig, armRenounceOwner/confirmRenounceOwner.

Admin = 0xF60f… (currently the Safe; adminCount = 1). The only role with custody. Admin-only functions: withdraw(to, amount) and withdrawAll(to) — BOTH locked so funds can only land at the owner or the immutable treasury — plus renounceAdmin (gives up own custody). skimFeesToBuffer is also callable by admin.

Keeper = 0x9e79… (agent operator). Runs the strategy, never touches custody. Keeper-only functions: allocate(6 ranges) (seed the 3 pools 25/50/25), breakoutUp(6 ranges) (raise uppers on a confirmed breakout), rollDown(newPa, newPb) (reset the lower anchor). belowFloorCollapse, skimFeesToBuffer and reinjectFees are keeper-or-admin. Set/removed by the owner via setKeeper(addr, bool) (instant, no timelock; multiple keepers allowed).

Spender = the wallet named in the Profit Spending config that receives profit payouts. Default: unset (address 0), so no payouts can happen until the owner configures it. It can ONLY ever receive skimmed LP fees, capped per period, and only when NAV is at/above the High Watermark — it can never touch principal. Set via the owner's Profit Spending Config (first set instant, changes 2-day timelocked).

Anyone (permissionless): fund(amount) (deposit USDC), updateHWM() (ratchet the watermark), releaseSpend() (push the capped profit stream to the Spender — math-gated, not role-gated).

High Watermark & LP Fees

High Watermark is measured in ETH, not USD. Specifically it's the highest the vault's principal has ever reached expressed as a quantity of ETH (NAV-in-USD ÷ ETH/USD TWAP). Denominating in ETH means the profit gate tracks real growth in ETH terms, so a falling ETH price alone can't make it look like you're "in profit." It's TWAP-valued so a flash pump can't game it. Profit can only be released when current principal is at or above this mark — i.e. only when genuinely in profit, never from principal. LP Fees is the pot of skimmed trading fees waiting to be either reinjected (compounded back into the 3 pools 25/50/25) or released to the Spender, capped per period. Fees accrue on both sides of every position (USDC and WETH), and skimFeesToBuffer() collects both legs from all 3 NFTs, then swaps the WETH leg to USDC so the buffer is single-denominated and easy to cap/account. So "USDC" is just the accounting unit, not a sign that one side is being dropped.

🔐 Who Can Do What

Three roles, strictly separated. Custody (the money) lives only with Owner/Admin. The Keeper runs the strategy but can never move funds out. Live on-chain addresses below.

🚪 Emergency exit — how it actually works

One call exits everything. withdrawAll(to) loops over all three positions, burns each NFT (pulling 100% of liquidity + uncollected fees back into the contract), then transfers every USDC and WETH to to. There is no per-pool withdraw and no partial amount — it's all-or-nothing, by design, so an emergency is a single atomic action.

Destination is locked. to must be the owner or the treasury address (both your Safe). Even a compromised admin key cannot redirect funds elsewhere.

After exit: deployed flips back to false and the vault is idle. To restart, fund USDC again and the keeper calls allocate.

🔄 How pools rotate — never more than 3

It's burn-then-create, atomically, never create-then-switch. The contract holds a fixed array of exactly 3 position slots. When a pool needs a new range (breakout, rollDown, or collapse), the internal _remint does, in ONE transaction: value the old position → burn the old NFT (recover its tokens) → zap to the new range's ratio → mint the new NFT into the same slot.

So the count goes 3 → 2 → 3 within a single tx, and can never reach 4. There's no window where orphaned or extra positions exist on-chain. This atomic, fixed-array design is exactly why this is ONE contract holding three NFTs rather than three separate contracts — no partial-fail races, no dust-stranded NFTs, one unified NAV and one withdraw lock.

Anti-churn: on a breakout, each pool only re-mints if its upper moved ≥5% OR its value shifted ≥$100. Pools below that threshold are skipped (emitting PoolSkipped), so small wiggles don't burn gas or rack up swap dust.

New pools are not "created" beyond the first allocate. The three slots are seeded once by allocate. Everything after is reshaping those same three slots in place.

⌨️ Running the keeper role yourself (all from this dashboard)

If the keeper bot is ever down or you just want manual control, you can run everything yourself from this page — no terminal, no code. The keeper is just a wallet, so the only setup is making your own wallet a keeper.

Step 1 — grant yourself keeper. Connect your owner wallet (your Safe). Go to Roles & Actions → Keeper Management, paste your wallet address, and hit Set keeper. It's instant, no timelock. (Your owner wallet can also just stay the keeper-granter; the keeper can be any wallet you control.)

Step 2 — reconnect as that wallet. Once your wallet is a keeper, the Keeper panel appears under Roles & Actions with a button for every action:

• Allocate — seed the 3 pools the first time (ranges auto-suggested around spot).
• Top Up — deploy freshly funded idle USDC into the live pools.
• Breakout Up — raise the windows after a confirmed 4h breakout.
• Roll Down — reset the lower anchor after a confirmed drop.
• Collapse to floor — crash-mode widen (also permissionless).
• Skim fees — harvest uncollected NFT fees into the buffer (do this if the bot forgets).
• Reinject — compound the buffer back into the pools.
• Update HWM / Release spend — set the high-watermark and pay the capped profit stream.

Step 3 — revoke when done. Back in Keeper Management, set your wallet to keeper = off. Clean.

Safety still applies in manual mode: breakout/rollDown only go through after the on-chain 4h TWAP confirmation, and withdraw can still only ever send funds to the owner or treasury Safe. Being keeper does not give you custody.

cast send $VAULT "setKeeper(address,bool)" <YOUR_ADDR> true   --private-key $OWNER_PK   --rpc-url $ETH_RPC_URL
cast send $VAULT "allocate(uint256,uint256,uint256,uint256,uint256,uint256)" 800e18 1790e18 1180e18 1790e18 1550e18 2310e18 --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "topUpPools()"          --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "breakoutUp(uint256,uint256,uint256,uint256,uint256,uint256)" 800e18 NEW_UP 1180e18 NEW_UP NEW_LO NEXT_LADDER --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "rollDown(uint256,uint256)" NEW_PA NEW_PB --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "belowFloorCollapse()"  --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "skimFeesToBuffer()"    --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "reinjectFees()"        --private-key $KEEPER_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "releaseSpend()"        --private-key $ANY_PK    --rpc-url $ETH_RPC_URL
cast send $VAULT "withdrawAll(address)" 0xF60f3B90677F06d8aB6cb4ACdBfdBa0385b98F58 --private-key $ADMIN_PK --rpc-url $ETH_RPC_URL
cast send $VAULT "setKeeper(address,bool)" <YOUR_ADDR> false  --private-key $OWNER_PK  --rpc-url $ETH_RPC_URL

📜 Development History