The token issuer acts
Some tokens give their issuer special powers. The issuer is the company that creates the token and can redeem it. On Solana's Token-2022 standard, an issuer can keep:
- a freeze authority, which can stop any account from moving its tokens;
- a permanent delegate, which can move or burn tokens from any account without the owner's signature;
- a transfer fee, which takes a share of every transfer.
Regulated stablecoins use these powers to comply with sanctions and court orders. They are also a risk: if an issuer uses them against the vault's tokens, the vault cannot stop it.
The behaviour below was checked in automated tests with two real tokens. A leg is one investment position of the vault; a token leg holds a token directly instead of a position in a protocol.
| Token | Issuer powers in the test | How the vault holds it |
|---|---|---|
| USDG (Paxos) | Freeze authority, permanent delegate and transfer fee extension | A token leg priced at par |
| PRIME (Hastra) | Freeze authority | A Hastra leg |
Table: the issuer powers present on the two tokens; "priced at par" means each USDG is valued at 1 USDC.
Example 1: the issuer freezes the leg's account
What happens. The leg still has value, but its tokens cannot move.
- The USDG token leg keeps being valued, because its value comes from the token balance and the price. Every trade on it fails, so the executor (the service that moves the vault's cash into and out of legs) cannot sell.
- The Hastra leg raises
PROTOCOL_PAUSED. Refreshing fails withAdapterFlagged, the leg goes stale, and the vault stops as in A protocol stops working.
What the guardian does. In either case the guardian decides what the frozen tokens are worth to the vault. In the test the guardian marks the leg at 0, capping its value at nothing, because the vault cannot reach any of it. The loss is booked Junior first, as in A hack the protocol has not reported. If the issuer later unfreezes the account, cash taken out of the leg is recovery and repays Senior first.
Example 2: the issuer burns tokens
What happens. The issuer burns 500 USDG from the leg through its permanent delegate. The next refresh reports 500 fewer tokens. USDG is priced at 1 USDC, so the vault books a 500 × 1 = 500 USDC loss, Junior first, as in An honest loss.
No one has to act. The vault sees the lower balance by itself.
Example 3: the issuer switches on a transfer fee
What happens. A transfer fee means the vault would receive less than the swap reports. The adapter can no longer trust a trade's output, so it raises PRICE_UNCERTAIN. Refreshing fails with AdapterFlagged, and the vault stops once the leg is stale. The guardian then suspends or marks the leg.
Summary
| Issuer action | Leg valued? | Vault keeps running? | Who acts |
|---|---|---|---|
| Freeze (USDG token leg) | Yes | Yes, but no trades | The guardian decides on a mark |
| Freeze (Hastra) | No, PROTOCOL_PAUSED | No, once the leg is stale | The guardian suspends or marks |
| Burn | Yes, lower balance | Yes, loss booked | Nobody needs to |
| Transfer fee | No, PRICE_UNCERTAIN | No, once the leg is stale | The guardian suspends or marks |
Table: an issuer action either shows up as a lower balance, which the vault books itself, or as a flag that stops the leg until the guardian acts.
Advanced details
- Token legs move money only inside a trade bracket:
begin_trade, then a swap signed by the bracket's delegate, thenend_trade. A frozen token account makes the swap fail, so the whole transaction fails and nothing changes. - A token leg's balance is read from the leg's own token account, so a burn through a permanent delegate shows up at the next
refresh_leg.