Two invariants make the whole thing work. Everything else is a number somebody chose, and you can see all of them before you deposit.
A trade must route into a whitelisted AMM program and its output must land back in vault-owned accounts. Without this, "trade" would mean "send funds to any program on Solana", and there would be no custody guarantee at all. Four programs cover essentially every memecoin.
A leader cannot buy a token they deployed, or trade into a pool they provide liquidity to. This is the line between losing depositors' money and taking it, and it is the only thing standing between a vault and the drain below.
leader mints token X
creates a pool with 1 SOL and a billion X, owning both sides
vault "trades" 100 SOL into it at a catastrophic price
leader pulls 101 SOL out as the LP
vault holds worthless X
No rule was broken: the vault executed a legitimate swap and holds tokens. The second invariant, plus minimum pool liquidity and a price-impact ceiling, is what makes that transaction impossible to construct.
Say you and three others put money in. You could track percentages — but then every existing holder's number has to be rewritten whenever anyone joins or leaves. With two hundred depositors that is two hundred edits, and two hundred chances to get it wrong.
Shares fix that. You hold a count, not a percentage. Your count never changes when other people come and go — only the total does, and your percentage is derived when needed.
Which gives one rule that explains everything:
Burning is the other half. When you withdraw, your shares are deleted — because value left the vault, so the claim on it has to leave too. Without that, the remaining shares would claim money that is no longer there and everyone else's price would collapse.
| Event | Pool | Shares | Price |
|---|---|---|---|
| Alice deposits 100 | 100 | 100 | 1.00 |
| Leader: 100 → 200 | 200 | 100 | 2.00 |
| Bob deposits 200 | 400 | 200 | 2.00 |
| Leader: 400 → 500 | 500 | 200 | 2.50 |
Drag it. Every slice moves by the same percentage, the trader's included. This is the whole reason nobody needs to trust anybody about how profits get divided.
While the vault holds tokens, any share price is a guess, and a guess transfers value between whoever is entering and whoever is already in. When the vault is flat, NAV is simply the SOL balance — no pricing, no oracle, no estimate.
Memecoin positions last minutes, so a vault is flat often. Deposits queue and mint at the next flat price, which means a queued depositor is left exactly whole: they capture no gain they did not fund, and dilute nobody.
A pro-rata slice of whatever the vault currently holds needs no valuation at all — you just divide every holding by your fraction. That works mid-position, with any number of positions, priced by nobody.
So cash settlement is what everyone will want, and in-kind withdrawal is the right that makes depositing rational. It removes the only way a leader could trap you, without anyone having to price an illiquid bag.
| Line | Rate | What it is |
|---|---|---|
| Performance fee | leader-set, up to 50% | Taken on your own realised gain, above your own cost. Down, and you pay nothing. |
| Flow fee | 0.03% per side | A fraction of what the AMM itself takes. |
| Management fee | none | Paying for idle capital is misaligned, so there is no option to add one. |
| Fee on unrealised gains | none | Paper gains on memecoins evaporate. Only realised profit is charged. |
| Opening a vault | $100 | Once, by the person opening it. Your 5% stake is separate and stays your own money. |
| Launching a token with it | $1,000 | Instead of the $100, not on top. Paid once. See the launchpad. |
| Creator fee on a launched token | 0.05% in | Paid to the vault by whoever trades the token, not by you. |