Struct Vault 

pub struct Vault {

    pub base_oracle: OracleConfig,
    pub total_assets: u64,
    pub external_assets: u64,
    pub pending_withdrawal_assets: u64,
    pub fees_payable: u64,
    pub high_watermark: u64,
    pub report_epoch: u64,
    pub requested_withdrawal_shares: u64,
    pub last_update_ts: i64,
    pub locked_profit: u64,
    pub profit_unlock_start_ts: i64,
    pub profit_unlock_end_ts: i64,
    pub tag: [u8; 32],
    pub admin: [u8; 32],
    pub strategist: [u8; 32],
    pub swap_authority: [u8; 32],
    pub nav_authority: [u8; 32],
    pub withdrawal_authority: [u8; 32],
    pub base_mint: [u8; 32],
    pub share_mint: [u8; 32],
    pub treasury: [u8; 32],
    pub last_report_hash: [u8; 32],
    pub access_merkle_root: [u8; 32],
    pub controls: VaultControls,
    pub performance_fee_bps: u16,
    pub withdrawal_buffer_bps: u16,
    pub tag_len: u8,
    pub base_decimals: u8,
    pub deposit_sub_account: u8,
    pub withdraw_sub_account: u8,
    pub bump: u8,
    /* private fields */
}

Fields

base_oracle: OracleConfig

total_assets: u64

external_assets: u64

pending_withdrawal_assets: u64

fees_payable: u64

high_watermark: u64

report_epoch: u64

requested_withdrawal_shares: u64

last_update_ts: i64

locked_profit: u64

Reported profit still locked from past gain reports; drips out linearly between the unlock timestamps. Always at most total_assets.

profit_unlock_start_ts: i64

profit_unlock_end_ts: i64

tag: [u8; 32]

admin: [u8; 32]

strategist: [u8; 32]

swap_authority: [u8; 32]

nav_authority: [u8; 32]

withdrawal_authority: [u8; 32]

base_mint: [u8; 32]

share_mint: [u8; 32]

treasury: [u8; 32]

last_report_hash: [u8; 32]

access_merkle_root: [u8; 32]

controls: VaultControls

performance_fee_bps: u16

withdrawal_buffer_bps: u16

tag_len: u8

base_decimals: u8

deposit_sub_account: u8

withdraw_sub_account: u8

bump: u8

Implementations

impl Vault

pub const SEED: &'static [u8] = b"vault"

pub const MAX_TAG_LEN: usize = 32

pub const SPACE: usize

pub fn new( tag: &[u8], admin: [u8; 32], strategist: [u8; 32], swap_authority: [u8; 32], nav_authority: [u8; 32], withdrawal_authority: [u8; 32], base_mint: [u8; 32], share_mint: [u8; 32], base_decimals: u8, base_oracle: OracleConfig, deposit_sub_account: u8, withdraw_sub_account: u8, treasury: [u8; 32], performance_fee_bps: u16, withdrawal_buffer_bps: u16, controls: VaultControls, private: bool, access_merkle_root: [u8; 32], bump: u8, ) -> Result<Self, ProgramError>

pub fn from_account_data(data: &[u8]) -> Result<Self, ProgramError>

Decode a Vault from raw Roshi account data — the wincode Account::Vault payload (a one-byte tag then the vault).

pub fn validate_config( base_mint: [u8; 32], share_mint: [u8; 32], base_decimals: u8, performance_fee_bps: u16, withdrawal_buffer_bps: u16, ) -> ProgramResult

pub fn pack_tag(tag: &[u8]) -> Result<([u8; 32], u8), ProgramError>

pub fn unpack_tag(tag: &[u8; 32], tag_len: u8) -> Result<&[u8], ProgramError>

pub fn tag_seed(&self) -> Result<&[u8], ProgramError>

pub fn find_address( tag: &[u8], base_mint: &Pubkey, ) -> Result<(Pubkey, u8), ProgramError>

pub fn authority_for_role(&self, role: Role) -> Pubkey

pub fn has_role(&self, role: Role, signer: &Pubkey) -> bool

pub fn verify_address(&self, vault_key: &Pubkey) -> ProgramResult

Verify vault_key is the canonical PDA for this vault’s tag and base mint.

pub fn economic_share_supply( &self, active_share_supply: u64, ) -> Result<u64, ProgramError>

The economic share supply: circulating shares plus the shares already burned for in-flight withdrawals.

pub fn remaining_locked_profit(&self, now: i64) -> Result<u64, ProgramError>

Reported profit still locked at now: the full locked_profit until the window starts, decaying linearly to zero at the window end.

pub fn effective_total_assets(&self, now: i64) -> Result<u64, ProgramError>

Share-pricing NAV at now: total_assets minus the profit still dripping. Every pricing read (deposit mint, redeem dust guard, ticket strike, atomic-redeem entitlement) uses this, never raw total_assets.

pub fn debit_assets_at_effective( &mut self, amount: u64, now: i64, ) -> ProgramResult

Pay amount (priced at Self::effective_total_assets) out of the vault at now. Re-anchors the unlock window at now with the still-locked remainder — the unlock line is preserved up to one atom of floor rounding, and amount <= effective keeps the static locked_profit <= total_assets invariant true after the debit.

pub fn apply_reported_nav( &mut self, net_total_assets: u64, now: i64, ) -> ProgramResult

Recognize a report’s post-fee NAV at now. A gain re-locks in full — rolling any unfinished drip forward — over the span it was earned in, clamped to controls.max_unlock_duration_secs. A loss recognizes instantly: the locked remainder absorbs it first (locked_profit = 0 with the lower total_assets means effective NAV never jumps up).

pub fn verify_report_fresh(&self, now: i64) -> ProgramResult

Staleness gate: reject when the last report is older than controls.max_report_age_secs. Applied to atomic redeems only — deposits are never staleness-gated (stale-entry capture is bounded by the drip and the gain bound; stale-high entry harms only the depositor) and queued redeems price later at strike. Pre-first-report vaults are exempt (pricing is exactly par via the virtual offset).

pub fn verify_report_interval(&self, now: i64) -> ProgramResult

Report rate limit: reject reports arriving sooner than controls.min_report_interval_secs after the previous one (the first report is exempt). Without this, a compromised NAV authority chains small in-bound reports past the gain bound.

pub fn verify_nav_gain_bound( &self, net_total_assets: u64, economic_share_supply: u64, ) -> ProgramResult

NAV gain bound: a report may not raise the net share price by more than controls.max_nav_gain_bps vs. the stored pre-report price. No downward bound — honest losses must land in one report. An over-bound honest gain is not lost: the authority reports the capped amount and rolls the remainder into subsequent reports. Skipped when supply or the stored price is zero so post-total-loss recovery cannot wedge.

pub fn verify_idle_sub_account(&self, sub_account: u8) -> ProgramResult

Base custody only ever moves through the sub-accounts whose base ATAs report_nav reads as idle — the vault’s current deposit and withdraw sub-accounts. External investment, returns, and fee collection are pinned to these so the on-chain idle read always covers base in the current custodies. The admin may repoint either sub-account, but every base movement stays consistent with whatever the vault currently designates.

Repointing while the old custody still holds base strands it: the on-chain idle read no longer sees it, so the off-chain NAV must fold that balance into the reported external_value.

pub fn verify_manage_enabled(&self) -> ProgramResult

pub fn allows_depositor(&self, depositor: &Pubkey, proof: &[[u8; 32]]) -> bool

pub fn deposits_paused(&self) -> Result<bool, ProgramError>

pub fn withdrawals_paused(&self) -> Result<bool, ProgramError>

pub fn manage_paused(&self) -> Result<bool, ProgramError>

pub fn private(&self) -> Result<bool, ProgramError>

pub fn external_enabled(&self) -> Result<bool, ProgramError>

pub fn set_deposits_paused(&mut self, deposits_paused: bool)

pub fn set_withdrawals_paused(&mut self, withdrawals_paused: bool)

pub fn set_manage_paused(&mut self, manage_paused: bool)

pub fn set_private(&mut self, private: bool)

pub fn set_external_enabled(&mut self, external_enabled: bool)

pub fn validate_state(&self) -> ProgramResult

Trait Implementations

impl Clone for Vault

fn clone(&self) -> Vault

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Vault

impl Debug for Vault

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Vault

impl PartialEq for Vault

fn eq(&self, other: &Vault) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<'de, WincodeConfig: Config> SchemaRead<'de, WincodeConfig> for Vault

const TYPE_META: TypeMeta

Metadata about the type’s serialization.

type Dst = Vault

fn read( reader: impl Reader<'de>, dst: &mut MaybeUninit<Self::Dst>, ) -> ReadResult<()>

Read into dst from reader.

fn get(reader: impl Reader<'de>) -> Result<Self::Dst, ReadError>

Read Self::Dst from reader into a new Self::Dst.

impl<WincodeConfig: Config> SchemaWrite<WincodeConfig> for Vault

const TYPE_META: TypeMeta

Metadata about the type’s serialization.

type Src = Vault

fn size_of(src: &Self::Src) -> WriteResult<usize>

Get the serialized size of Self::Src.

fn write(writer: impl Writer, src: &Self::Src) -> WriteResult<()>

Write Self::Src to writer.

impl StructuralPartialEq for Vault

impl<WincodeConfig: Config> ZeroCopy<WincodeConfig> for Vault

where for<'_wincode_internal> OracleConfig: ZeroCopy<WincodeConfig>, for<'_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal> u64: ZeroCopy<WincodeConfig>, for<'_wincode_internal, '_wincode_internal, '_wincode_internal> i64: ZeroCopy<WincodeConfig>, for<'_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal> [u8; 32]: ZeroCopy<WincodeConfig>, for<'_wincode_internal> VaultControls: ZeroCopy<WincodeConfig>, for<'_wincode_internal, '_wincode_internal> u16: ZeroCopy<WincodeConfig>, for<'_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal, '_wincode_internal> u8: ZeroCopy<WincodeConfig>, for<'_wincode_internal> [u8; 2]: ZeroCopy<WincodeConfig>, for<'_wincode_internal> Assert<{ _ }>: IsTrue,

fn from_bytes<'de>(bytes: &'de [u8], config: C) -> Result<&'de Self, ReadError>

where Self: Sized + SchemaRead<'de, C, Dst = Self>,

Like crate::ZeroCopy::from_bytes, but allows the caller to provide a custom configuration.

fn from_bytes_mut<'de>( bytes: &'de mut [u8], config: C, ) -> Result<&'de mut Self, ReadError>

where Self: Sized + SchemaRead<'de, C, Dst = Self>,

Like crate::ZeroCopy::from_bytes_mut, but allows the caller to provide a custom configuration.