Custody & Key Management¶
The custody model¶
ARKONIX operates a strictly non-custodial model for user assets.
- End users interact directly with vault smart contracts (ERC-4626 / ERC-7540) from their own wallets — via the Earn app, a partner UI built on the Vault SDK, or raw contract calls.
- Positions are share tokens held by the user. ARKONIX does not hold, control, or take possession of user deposits at any point in the deposit or withdrawal path.
- The platform's role is operational: executing vault strategies, settling epochs, and publishing NAV — within the permissions the contracts grant the operator role, which do not include transferring user balances.
What ARKONIX keys can do (and only this)¶
| Control point | Mechanism |
|---|---|
| Strategy execution / rebalancing | Operator-signed transactions between the vault and whitelisted strategy venues |
| Epoch settlement | Operator-signed settlement at NAV |
| Price oracle (NAV) updates | Signed on-chain share-price publications |
| Contract deployment | Deployer-signed vault/strategy deployments |
| Vault parameters (fees, caps) | On-chain governance — multi-signature (Gnosis Safe) where configured |
| Emergency pause / circuit breaker | Operator or multisig |
What ARKONIX keys cannot do¶
- Withdraw or transfer a user's deposit or shares.
- Move vault assets to arbitrary addresses — strategy execution is constrained to the vault's configured venues and policies.
- Change settlement terms retroactively — epochs settle at published NAV.
Key management¶
All platform signing keys are generated and held in cloud KMS hardware security modules (HSMs), FIPS 140-2 Level 3:
- Non-exportable by construction — private key material never leaves the HSM; applications submit signing requests and receive signatures.
- Sign-only service permissions — workloads are bound to identities whose IAM grants allow signing with a specific key and nothing else (no key export, no key management).
- Separation of duties — distinct keys for distinct purposes: an operator key for automated strategy execution and price updates, a deployer key for contract deployment (manually invoked by authorized personnel), and optional Gnosis Safe multisigs for governance-level changes with configurable thresholds.
- Auditability — every signing operation is an authenticated, logged API call attributable to a workload identity.
Application ──▶ KMS API (TLS) ──▶ HSM (FIPS 140-2 L3) ──▶ signature
private key never leaves the module
Risk controls around execution¶
Holding the operator key is not sufficient to execute arbitrary strategy changes:
- Simulation first — transactions are simulated before signing.
- Policy constraints — per-vault policies restrict which protocols, assets, and actions execution may touch.
- Circuit breakers — automated performance and drawdown monitors can halt execution and require explicit recovery.
What this means for due diligence¶
The trust assumption an allocator accepts with ARKONIX is operational, not custodial: the platform can manage vault holdings within disclosed strategy bounds, and it can pause activity — but it cannot abscond with deposits, because no key it holds has that power on-chain. Verifying this does not require trusting this page: the vault contracts, their role assignments, and every operator action are public on-chain.