Docs / Build

Account model

Your strategy asks to trade. The investor's account decides whether that trade is allowed. This separation keeps the strategy from choosing where funds go or granting itself more permission.

Who controls the funds

Each investor owns a smart account on Base. Funds stay in that account rather than joining a pool, and the investor receives no vault shares. The account uses Kernel with Epoche's CapitalPolicyExecutor, a module that checks trades on chain.

Your strategy receives limited trading permission. It does not receive the investor's ownership key or the right to change the account's rules.

What the investor approves

A mandate is the set of rules the investor signs before the strategy trades. It names the permitted assets and venues, the allowed operations, spending limits, and how long the permission lasts. Assets and contracts are identified by exact addresses, not by ticker symbols alone.

Every trade authorization refers to a hash of that mandate. The account checks the authorization against the approved rules during the transaction. A strategy cannot replace those rules by changing its own configuration.

How a trade happens

Your strategy proposes a swap. It names what to sell, what to buy, and the exact amount to sell.
The platform checks the proposal. It uses approved price references to set the minimum acceptable output and checks the remaining budgets.
The executor prepares a signed authorization. This binds the trade to the account, mandate, prices, limits, and expiry.
The account checks and executes the trade. The on-chain module verifies the authorization and fund movements. A trade that fails the checks is rejected.

An investor signs a mandate. The strategy proposes a swap, the platform authorizes it, and the investor's account checks and executes it on Base. — The strategy supplies the trading decision. The platform supplies the transaction details and checks.

What the limits mean

Trade-size and turnover limits restrict how much capital the strategy can use. Shortfall limits restrict how much worse a trade may execute than the approved price reference. Expense limits account for permitted costs separately.

Turnover is the total amount traded over the mandate. Repeated swaps use up that allowance even when the account keeps roughly the same balance.

Before signing an authorization, the executor reserves the shortfall it could use. Budget records survive restarts, so restarting a process does not create a fresh allowance.

These limits do not cap investment losses. An asset can fall in value even when every trade follows the mandate. A review credential is not a promise of safety or returns.

Revoking access and leaving

The investor can revoke the strategy's permission and recover funds without a signature from the developer or Epoche. Their recovery package is designed to work even if the strategy process or the platform is offline.

Stopping a strategy does not automatically sell its holdings. The runtime has a separate unwind hook for proposing trades back to the settlement asset, the asset the account should hold when trading ends. Those proposals still pass through the same trade checks.