> For the complete documentation index, see [llms.txt](https://docs.lagoon.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lagoon.finance/developer-hub/smart-contract-reference.md).

# Smart Contract Reference

Full ABI reference for the v0.6.0 vault implementation, grouped by who can call each function. Inherited OpenZeppelin ERC20 functions (`balanceOf`, `totalSupply`, `approve`, `allowance`, `name`, `symbol`) are not repeated unless the vault overrides their behaviour. `transfer` and `transferFrom` are listed because v0.6.0 adds extra access checks on both sides.

## Jump to a role

* [Anyone (user-facing)](#anyone-user-facing) — deposit / redeem / sync flows, operators, views, ERC20 overrides.
* [Curator](#curator) — settlement, claim-on-behalf, sync mode, HWM, close.
* [Valuation Manager](#valuation-manager) — propose new total assets (gated by guardrails).
* [Security Council](#security-council) — emergency valuation, guardrails policy.
* [Access Manager](#access-manager-former-whitelist-manager) — whitelist / blacklist / external sanctions list.
* [Owner (Admin)](#owner-admin) — lifecycle, roles, access mode, fees, metadata.
* [Super Operator](#super-operator) — global operator that bypasses whitelist / blacklist.
* [GuardRailsManager](#guardrailsmanager-read) — compliance check used by the vault.
* [Silo](#silo-separate-contract) — pending-funds helper contract.

***

## Anyone (user-facing)

### Deposit flow (async)

#### requestDeposit

```solidity
function requestDeposit(
    uint256 assets,
    address controller,
    address owner
) public payable returns (uint256 requestId);
```

Submit assets to the pending silo, queued for the next settlement. Auto-claims any previously claimable amount for `controller`. The caller must be the `owner` or an approved operator of `owner`.

**Parameters:**

| Name         | Type      | Description                                                                                       |
| ------------ | --------- | ------------------------------------------------------------------------------------------------- |
| `assets`     | `uint256` | Amount of underlying assets to deposit.                                                           |
| `controller` | `address` | Address that will own the request and claim the resulting shares.                                 |
| `owner`      | `address` | Address whose assets are pulled. Must equal `msg.sender` or have approved the caller as operator. |

**Return values:**

| Name        | Type      | Description                     |
| ----------- | --------- | ------------------------------- |
| `requestId` | `uint256` | Epoch-based request identifier. |

***

#### requestDeposit (with referral)

```solidity
function requestDeposit(
    uint256 assets,
    address controller,
    address owner,
    address referral
) public payable returns (uint256 requestId);
```

Same as `requestDeposit` above, but emits a `Referral` event tagging `referral`.

**Parameters:**

| Name         | Type      | Description                                                       |
| ------------ | --------- | ----------------------------------------------------------------- |
| `assets`     | `uint256` | Amount of underlying assets to deposit.                           |
| `controller` | `address` | Address that will own the request and claim the resulting shares. |
| `owner`      | `address` | Address whose assets are pulled.                                  |
| `referral`   | `address` | Address logged as the referrer.                                   |

**Return values:**

| Name        | Type      | Description                     |
| ----------- | --------- | ------------------------------- |
| `requestId` | `uint256` | Epoch-based request identifier. |

***

#### cancelRequestDeposit

```solidity
function cancelRequestDeposit() external;
```

Pull pending assets back from the silo. Only valid in the same epoch as the request. Cancels the caller's own pending deposit.

***

#### cancelRequestDeposit (on behalf)

```solidity
function cancelRequestDeposit(address controller) external;
```

Cancel a pending deposit on behalf of another controller. The caller must be an operator or super operator of `controller`. *(Operator variant new in v0.6.0.)*

**Parameters:**

| Name         | Type      | Description                                          |
| ------------ | --------- | ---------------------------------------------------- |
| `controller` | `address` | Controller whose pending deposit is being cancelled. |

***

#### deposit

```solidity
function deposit(
    uint256 assets,
    address receiver
) public returns (uint256 shares);
```

Claim shares after settlement. Uses `msg.sender` as the request controller.

**Parameters:**

| Name       | Type      | Description                               |
| ---------- | --------- | ----------------------------------------- |
| `assets`   | `uint256` | Amount of assets to claim shares against. |
| `receiver` | `address` | Address receiving the shares.             |

**Return values:**

| Name     | Type      | Description                  |
| -------- | --------- | ---------------------------- |
| `shares` | `uint256` | Shares minted to `receiver`. |

***

#### deposit (with controller)

```solidity
function deposit(
    uint256 assets,
    address receiver,
    address controller
) external returns (uint256 shares);
```

Claim shares from a settled request owned by `controller`. The caller must be an operator or super operator of `controller`.

**Parameters:**

| Name         | Type      | Description                               |
| ------------ | --------- | ----------------------------------------- |
| `assets`     | `uint256` | Amount of assets to claim shares against. |
| `receiver`   | `address` | Address receiving the shares.             |
| `controller` | `address` | Controller that owns the deposit request. |

**Return values:**

| Name     | Type      | Description                  |
| -------- | --------- | ---------------------------- |
| `shares` | `uint256` | Shares minted to `receiver`. |

***

#### mint

```solidity
function mint(
    uint256 shares,
    address receiver
) public returns (uint256 assets);
```

Same as `deposit` but the caller specifies the share amount instead of the asset amount.

**Parameters:**

| Name       | Type      | Description                   |
| ---------- | --------- | ----------------------------- |
| `shares`   | `uint256` | Shares to claim.              |
| `receiver` | `address` | Address receiving the shares. |

**Return values:**

| Name     | Type      | Description                                 |
| -------- | --------- | ------------------------------------------- |
| `assets` | `uint256` | Assets consumed from the claimable balance. |

***

#### mint (with controller)

```solidity
function mint(
    uint256 shares,
    address receiver,
    address controller
) external returns (uint256 assets);
```

Same as `mint` above, on behalf of `controller`. The caller must be an operator or super operator of `controller`.

**Parameters:**

| Name         | Type      | Description                               |
| ------------ | --------- | ----------------------------------------- |
| `shares`     | `uint256` | Shares to claim.                          |
| `receiver`   | `address` | Address receiving the shares.             |
| `controller` | `address` | Controller that owns the deposit request. |

**Return values:**

| Name     | Type      | Description                                 |
| -------- | --------- | ------------------------------------------- |
| `assets` | `uint256` | Assets consumed from the claimable balance. |

***

### Deposit flow (sync, when `SyncMode` allows)

#### syncDeposit

```solidity
function syncDeposit(
    uint256 assets,
    address receiver,
    address referral
) public payable returns (uint256 shares);
```

Atomic deposit — mints shares immediately at the current price per share. Reverts if the vault is async-only or if sync deposits are disabled by the current `SyncMode`.

**Parameters:**

| Name       | Type      | Description                                                 |
| ---------- | --------- | ----------------------------------------------------------- |
| `assets`   | `uint256` | Amount of underlying assets to deposit.                     |
| `receiver` | `address` | Address receiving the shares.                               |
| `referral` | `address` | Address logged as the referrer (use `address(0)` for none). |

**Return values:**

| Name     | Type      | Description                                                |
| -------- | --------- | ---------------------------------------------------------- |
| `shares` | `uint256` | Shares minted at the current valuation, net of entry fees. |

***

### Redeem flow (async)

#### requestRedeem

```solidity
function requestRedeem(
    uint256 shares,
    address controller,
    address owner
) public returns (uint256 requestId);
```

Transfer shares to the pending silo, queued for the next redeem settlement.

**Parameters:**

| Name         | Type      | Description                                                                                       |
| ------------ | --------- | ------------------------------------------------------------------------------------------------- |
| `shares`     | `uint256` | Number of shares to redeem.                                                                       |
| `controller` | `address` | Address that will own the request and claim the resulting assets.                                 |
| `owner`      | `address` | Address whose shares are pulled. Must equal `msg.sender` or have approved the caller as operator. |

**Return values:**

| Name        | Type      | Description                     |
| ----------- | --------- | ------------------------------- |
| `requestId` | `uint256` | Epoch-based request identifier. |

***

#### cancelRequestRedeem

```solidity
function cancelRequestRedeem(address controller) external;
```

Pull pending shares back from the silo. The caller must be an operator or super operator of `controller`. *(New in v0.6.0.)*

**Parameters:**

| Name         | Type      | Description                                         |
| ------------ | --------- | --------------------------------------------------- |
| `controller` | `address` | Controller whose pending redeem is being cancelled. |

***

#### claimSharesAndRequestRedeem

```solidity
function claimSharesAndRequestRedeem(
    uint256 sharesToRedeem
) public returns (uint40 requestId);
```

UX bundle: claim any pending deposit shares first, then immediately request a redeem for them. If there is nothing claimable, behaves like `requestRedeem`.

**Parameters:**

| Name             | Type      | Description                                |
| ---------------- | --------- | ------------------------------------------ |
| `sharesToRedeem` | `uint256` | Number of shares to redeem after claiming. |

**Return values:**

| Name        | Type     | Description                                               |
| ----------- | -------- | --------------------------------------------------------- |
| `requestId` | `uint40` | Epoch-based request identifier of the new redeem request. |

***

#### redeem

```solidity
function redeem(
    uint256 shares,
    address receiver,
    address controller
) public returns (uint256 assets);
```

Claim assets after redeem settlement (or in sync if the vault is closed). When called by an operator or super operator of `controller`, the operator check is bypassed appropriately.

**Parameters:**

| Name         | Type      | Description                                                                     |
| ------------ | --------- | ------------------------------------------------------------------------------- |
| `shares`     | `uint256` | Shares to convert into assets.                                                  |
| `receiver`   | `address` | Address receiving the assets.                                                   |
| `controller` | `address` | Controller that owns the redeem request (or share balance, if vault is closed). |

**Return values:**

| Name     | Type      | Description                       |
| -------- | --------- | --------------------------------- |
| `assets` | `uint256` | Assets transferred to `receiver`. |

***

#### withdraw

```solidity
function withdraw(
    uint256 assets,
    address receiver,
    address controller
) public returns (uint256 shares);
```

Same as `redeem` but specified by asset amount.

**Parameters:**

| Name         | Type      | Description                                                                     |
| ------------ | --------- | ------------------------------------------------------------------------------- |
| `assets`     | `uint256` | Amount of assets to withdraw.                                                   |
| `receiver`   | `address` | Address receiving the assets.                                                   |
| `controller` | `address` | Controller that owns the redeem request (or share balance, if vault is closed). |

**Return values:**

| Name     | Type      | Description    |
| -------- | --------- | -------------- |
| `shares` | `uint256` | Shares burned. |

***

### Redeem flow (sync, when `SyncMode` allows)

#### syncRedeem

```solidity
function syncRedeem(
    uint256 shares,
    address receiver,
    uint256 minimumAssets
) public returns (uint256 assets);
```

Atomic redeem with slippage protection. Burns shares immediately and pays assets directly from the Curator address.

**Parameters:**

| Name            | Type      | Description                                                                                |
| --------------- | --------- | ------------------------------------------------------------------------------------------ |
| `shares`        | `uint256` | Shares to redeem.                                                                          |
| `receiver`      | `address` | Address receiving the assets.                                                              |
| `minimumAssets` | `uint256` | Minimum assets expected after exit fee and haircut. Reverts if the actual output is lower. |

**Return values:**

| Name     | Type      | Description                                                    |
| -------- | --------- | -------------------------------------------------------------- |
| `assets` | `uint256` | Assets transferred to `receiver`, net of exit fee and haircut. |

***

### Operators

#### setOperator

```solidity
function setOperator(
    address operator,
    bool approved
) external returns (bool success);
```

Authorize or revoke an operator that can request and claim on the caller's behalf.

**Parameters:**

| Name       | Type      | Description                           |
| ---------- | --------- | ------------------------------------- |
| `operator` | `address` | Operator address.                     |
| `approved` | `bool`    | `true` to approve, `false` to revoke. |

**Return values:**

| Name      | Type   | Description    |
| --------- | ------ | -------------- |
| `success` | `bool` | Always `true`. |

***

### ERC20 (with extra access checks)

In v0.6.0 the vault overrides `transfer` and `transferFrom` to enforce the `isAllowed` check on both sender and recipient.

#### transfer

```solidity
function transfer(
    address to,
    uint256 value
) public returns (bool);
```

Standard ERC20 transfer, plus an `isAllowed(msg.sender)` and `isAllowed(to)` check.

**Parameters:**

| Name    | Type      | Description                       |
| ------- | --------- | --------------------------------- |
| `to`    | `address` | Recipient. Must pass `isAllowed`. |
| `value` | `uint256` | Amount of shares to transfer.     |

**Return values:**

| Name      | Type   | Description               |
| --------- | ------ | ------------------------- |
| (unnamed) | `bool` | Always `true` on success. |

***

#### transferFrom

```solidity
function transferFrom(
    address from,
    address to,
    uint256 value
) public returns (bool);
```

Standard ERC20 `transferFrom`, plus an `isAllowed(from)` and `isAllowed(to)` check.

**Parameters:**

| Name    | Type      | Description                       |
| ------- | --------- | --------------------------------- |
| `from`  | `address` | Sender. Must pass `isAllowed`.    |
| `to`    | `address` | Recipient. Must pass `isAllowed`. |
| `value` | `uint256` | Amount of shares to transfer.     |

**Return values:**

| Name      | Type   | Description               |
| --------- | ------ | ------------------------- |
| (unnamed) | `bool` | Always `true` on success. |

***

### Views

#### totalAssets

```solidity
function totalAssets() public view returns (uint256);
```

Total assets currently managed by the vault, as last committed by the Curator at settlement.

**Return values:**

| Name      | Type      | Description                       |
| --------- | --------- | --------------------------------- |
| (unnamed) | `uint256` | Total assets in underlying units. |

***

#### decimals

```solidity
function decimals() public view returns (uint8);
```

ERC20 decimals — matches the underlying asset's decimals plus the vault's decimal offset.

**Return values:**

| Name      | Type    | Description                        |
| --------- | ------- | ---------------------------------- |
| (unnamed) | `uint8` | Decimals of the vault share token. |

***

#### version

```solidity
function version() public pure returns (string memory);
```

Implementation version string.

**Return values:**

| Name      | Type     | Description |
| --------- | -------- | ----------- |
| (unnamed) | `string` | `"v0.6.0"`. |

***

#### safe

```solidity
function safe() public view returns (address);
```

Address bound to the Curator role — vault assets flow into this address at settlement, and out of it on redeems. Named `safe` in the source code by convention; can be any address.

**Return values:**

| Name      | Type      | Description          |
| --------- | --------- | -------------------- |
| (unnamed) | `address` | The Curator address. |

***

#### share

```solidity
function share() external view returns (address);
```

ERC-7575 share token address — always returns `address(this)` for this vault.

**Return values:**

| Name      | Type      | Description                         |
| --------- | --------- | ----------------------------------- |
| (unnamed) | `address` | The share token (the vault itself). |

***

#### supportsInterface

```solidity
function supportsInterface(bytes4 interfaceId) public view returns (bool);
```

ERC-165 interface support check.

**Parameters:**

| Name          | Type     | Description           |
| ------------- | -------- | --------------------- |
| `interfaceId` | `bytes4` | Interface identifier. |

**Return values:**

| Name      | Type   | Description                           |
| --------- | ------ | ------------------------------------- |
| (unnamed) | `bool` | `true` if the interface is supported. |

***

#### maxDeposit

```solidity
function maxDeposit(address controller) public view returns (uint256);
```

Maximum assets `controller` can claim through `deposit`. Zero when paused.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name      | Type      | Description               |
| --------- | --------- | ------------------------- |
| (unnamed) | `uint256` | Maximum claimable assets. |

***

#### maxMint

```solidity
function maxMint(address controller) public view returns (uint256);
```

Maximum shares `controller` can mint by claiming a settled deposit request.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name      | Type      | Description               |
| --------- | --------- | ------------------------- |
| (unnamed) | `uint256` | Maximum claimable shares. |

***

#### maxRedeem

```solidity
function maxRedeem(address controller) public view returns (uint256);
```

Maximum redeemable shares for `controller`. When the vault is closed and nothing is claimable, returns the share balance instead (sync redeem path).

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name     | Type      | Description                |
| -------- | --------- | -------------------------- |
| `shares` | `uint256` | Maximum redeemable shares. |

***

#### maxWithdraw

```solidity
function maxWithdraw(address controller) public view returns (uint256 assets);
```

Asset-denominated counterpart of `maxRedeem`.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name     | Type      | Description                  |
| -------- | --------- | ---------------------------- |
| `assets` | `uint256` | Maximum withdrawable assets. |

***

#### previewSyncDeposit

```solidity
function previewSyncDeposit(uint256 assets) public view returns (uint256 shares);
```

Shares a depositor would receive for `assets` via `syncDeposit`, net of entry fee.

**Parameters:**

| Name     | Type      | Description        |
| -------- | --------- | ------------------ |
| `assets` | `uint256` | Assets to deposit. |

**Return values:**

| Name     | Type      | Description                   |
| -------- | --------- | ----------------------------- |
| `shares` | `uint256` | Shares the caller would mint. |

***

#### previewSyncRedeem

```solidity
function previewSyncRedeem(uint256 shares) public view returns (uint256 assets);
```

Assets a redeemer would receive for `shares` via `syncRedeem`, net of exit fee and haircut.

**Parameters:**

| Name     | Type      | Description       |
| -------- | --------- | ----------------- |
| `shares` | `uint256` | Shares to redeem. |

**Return values:**

| Name     | Type      | Description                      |
| -------- | --------- | -------------------------------- |
| `assets` | `uint256` | Assets the caller would receive. |

***

#### previewDeposit / previewMint / previewRedeem / previewWithdraw

```solidity
function previewDeposit(uint256) public pure returns (uint256);
function previewMint(uint256) public pure returns (uint256);
function previewRedeem(uint256) public pure returns (uint256);
function previewWithdraw(uint256) public pure returns (uint256);
```

**All four revert.** ERC-7540 mandates that synchronous previews are disabled for asynchronous flows. Use `convertToShares` / `convertToAssets` with a specific `requestId` for settled epochs, or `previewSyncDeposit` / `previewSyncRedeem` for the sync flow.

***

#### convertToShares

```solidity
function convertToShares(
    uint256 assets,
    uint256 requestId
) public view returns (uint256);
```

Assets → shares conversion at the settlement price of `requestId`'s epoch.

**Parameters:**

| Name        | Type      | Description                                       |
| ----------- | --------- | ------------------------------------------------- |
| `assets`    | `uint256` | Assets to convert.                                |
| `requestId` | `uint256` | Request / epoch ID whose settlement price to use. |

**Return values:**

| Name      | Type      | Description                              |
| --------- | --------- | ---------------------------------------- |
| (unnamed) | `uint256` | Equivalent shares at that epoch's price. |

***

#### convertToAssets

```solidity
function convertToAssets(
    uint256 shares,
    uint256 requestId
) public view returns (uint256);
```

Shares → assets conversion at the settlement price of `requestId`'s epoch.

**Parameters:**

| Name        | Type      | Description                                       |
| ----------- | --------- | ------------------------------------------------- |
| `shares`    | `uint256` | Shares to convert.                                |
| `requestId` | `uint256` | Request / epoch ID whose settlement price to use. |

**Return values:**

| Name      | Type      | Description                              |
| --------- | --------- | ---------------------------------------- |
| (unnamed) | `uint256` | Equivalent assets at that epoch's price. |

***

#### pendingDepositRequest

```solidity
function pendingDepositRequest(
    uint256 requestId,
    address controller
) public view returns (uint256 assets);
```

Assets currently waiting to be settled for `controller` at `requestId`.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `requestId`  | `uint256` | Request / epoch ID.  |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name     | Type      | Description     |
| -------- | --------- | --------------- |
| `assets` | `uint256` | Pending assets. |

***

#### claimableDepositRequest

```solidity
function claimableDepositRequest(
    uint256 requestId,
    address controller
) public view returns (uint256 assets);
```

Assets at `requestId` that have been settled and are now claimable by `controller`.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `requestId`  | `uint256` | Request / epoch ID.  |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name     | Type      | Description       |
| -------- | --------- | ----------------- |
| `assets` | `uint256` | Claimable assets. |

***

#### pendingRedeemRequest

```solidity
function pendingRedeemRequest(
    uint256 requestId,
    address controller
) public view returns (uint256 shares);
```

Shares currently waiting to be settled for `controller` at `requestId`.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `requestId`  | `uint256` | Request / epoch ID.  |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name     | Type      | Description     |
| -------- | --------- | --------------- |
| `shares` | `uint256` | Pending shares. |

***

#### claimableRedeemRequest

```solidity
function claimableRedeemRequest(
    uint256 requestId,
    address controller
) public view returns (uint256 shares);
```

Shares at `requestId` that have been settled and whose assets are now claimable.

**Parameters:**

| Name         | Type      | Description          |
| ------------ | --------- | -------------------- |
| `requestId`  | `uint256` | Request / epoch ID.  |
| `controller` | `address` | Controller to check. |

**Return values:**

| Name     | Type      | Description       |
| -------- | --------- | ----------------- |
| `shares` | `uint256` | Claimable shares. |

***

#### isOperator

```solidity
function isOperator(
    address controller,
    address operator
) public view returns (bool);
```

Returns `true` if `operator` is approved by `controller` via `setOperator`.

**Parameters:**

| Name         | Type      | Description        |
| ------------ | --------- | ------------------ |
| `controller` | `address` | Controller.        |
| `operator`   | `address` | Operator to check. |

**Return values:**

| Name      | Type   | Description         |
| --------- | ------ | ------------------- |
| (unnamed) | `bool` | `true` if approved. |

***

#### isAllowed

```solidity
function isAllowed(address account) public view returns (bool);
```

Composite access check — passes the current access mode (whitelist or blacklist) and the external sanctions list, if configured.

**Parameters:**

| Name      | Type      | Description       |
| --------- | --------- | ----------------- |
| `account` | `address` | Address to check. |

**Return values:**

| Name      | Type   | Description                                        |
| --------- | ------ | -------------------------------------------------- |
| (unnamed) | `bool` | `true` if the account can interact with the vault. |

***

#### isTotalAssetsValid

```solidity
function isTotalAssetsValid() public view returns (bool);
```

Returns `true` while the currently posted valuation is still within its `totalAssetsLifespan`. Sync operations require this to be `true`.

**Return values:**

| Name      | Type   | Description                             |
| --------- | ------ | --------------------------------------- |
| (unnamed) | `bool` | `true` if the valuation is still valid. |

***

#### syncMode

```solidity
function syncMode() public view returns (SyncMode);
```

Returns the current sync configuration.

```solidity
enum SyncMode { Both, SyncDeposit, SyncRedeem, None }
```

**Return values:**

| Name      | Type       | Description   |
| --------- | ---------- | ------------- |
| (unnamed) | `SyncMode` | Current mode. |

***

#### isAsyncOnly

```solidity
function isAsyncOnly() public view returns (bool);
```

Returns `true` if `activateAsyncOnly` has been called — the vault has irreversibly given up sync capability. When `true`, `totalAssets` is always treated as invalid.

**Return values:**

| Name      | Type   | Description                                    |
| --------- | ------ | ---------------------------------------------- |
| (unnamed) | `bool` | `true` if the vault is permanently async-only. |

***

#### maxCap

```solidity
function maxCap() external view returns (uint256);
```

Returns the per-vault total-assets cap.

**Return values:**

| Name      | Type      | Description                        |
| --------- | --------- | ---------------------------------- |
| (unnamed) | `uint256` | Max cap in underlying asset units. |

***

#### feeRates

```solidity
function feeRates() public view returns (Rates memory);
```

Returns the current fee rates struct.

```solidity
struct Rates {
    uint16 managementRate;
    uint16 performanceRate;
    uint16 entryRate;     // new in v0.6.0
    uint16 exitRate;      // new in v0.6.0
    uint16 haircutRate;   // new in v0.6.0
}
```

All rates are in basis points. The protocol cut is read separately from the `FeeRegistry`.

**Return values:**

| Name      | Type    | Description                                                      |
| --------- | ------- | ---------------------------------------------------------------- |
| (unnamed) | `Rates` | Current management / performance / entry / exit / haircut rates. |

***

## Curator

The Curator role is bound to a single on-chain address — referred to as the `safe` in the source code (hence the `onlySafe` modifier and the `safe()` view function). The name reflects the common deployment pattern of using a Gnosis-Safe multi-sig, but **no Safe-specific behaviour is enforced**: any address can hold the role, including an EOA, an MPC wallet, or a custom contract. The Curator manages strategy allocation, executes settlements, and toggles operational parameters like the sync mode and the max cap.

#### settleDeposit

```solidity
function settleDeposit(uint256 _newTotalAssets) public;
```

Commit a valuation, take fees, mint shares to the silo, and pull silo assets into the Curator address. Opportunistically also calls `settleRedeem` when possible.

**Parameters:**

| Name              | Type      | Description                                                                                                                              |
| ----------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| `_newTotalAssets` | `uint256` | Confirmed total assets at the moment of settlement. Must equal the value previously posted by the valuation manager or security council. |

***

#### settleRedeem

```solidity
function settleRedeem(uint256 _newTotalAssets) public;
```

Commit a valuation, take fees, burn pending shares from the silo, and pull assets from the Curator address to the vault for claim.

**Parameters:**

| Name              | Type      | Description                                         |
| ----------------- | --------- | --------------------------------------------------- |
| `_newTotalAssets` | `uint256` | Confirmed total assets at the moment of settlement. |

***

#### claimSharesOnBehalf

```solidity
function claimSharesOnBehalf(address[] memory controllers) external;
```

UX helper — push claimable deposit shares to a list of controllers.

**Parameters:**

| Name          | Type        | Description                                                               |
| ------------- | ----------- | ------------------------------------------------------------------------- |
| `controllers` | `address[]` | Controllers to claim for. Controllers with nothing claimable are skipped. |

***

#### claimAssetsOnBehalf

```solidity
function claimAssetsOnBehalf(address[] memory controllers) external;
```

UX helper — push claimable redeem assets to a list of controllers. *(New in v0.6.0.)*

**Parameters:**

| Name          | Type        | Description                                                               |
| ------------- | ----------- | ------------------------------------------------------------------------- |
| `controllers` | `address[]` | Controllers to claim for. Controllers with nothing claimable are skipped. |

***

#### updateTotalAssetsLifespan

```solidity
function updateTotalAssetsLifespan(uint128 lifespan) external;
```

Set how long a posted valuation stays valid for sync operations.

**Parameters:**

| Name       | Type      | Description          |
| ---------- | --------- | -------------------- |
| `lifespan` | `uint128` | Lifespan in seconds. |

***

#### expireTotalAssets

```solidity
function expireTotalAssets() public;
```

Invalidate the currently posted valuation immediately. After this call, sync operations revert until a new valuation is posted and confirmed.

***

#### updateMaxCap

```solidity
function updateMaxCap(uint256 _maxCap) external;
```

Set the deposit cap (in underlying assets).

**Parameters:**

| Name      | Type      | Description                                                  |
| --------- | --------- | ------------------------------------------------------------ |
| `_maxCap` | `uint256` | New max cap. Use `type(uint256).max` to effectively disable. |

***

#### setSyncMode

```solidity
function setSyncMode(SyncMode _mode) external;
```

Switch between async-only, sync-deposit-only, sync-redeem-only, or both. Reverts if the vault is in async-only mode. *(New in v0.6.0.)*

**Parameters:**

| Name    | Type       | Description                                     |
| ------- | ---------- | ----------------------------------------------- |
| `_mode` | `SyncMode` | `Both`, `SyncDeposit`, `SyncRedeem`, or `None`. |

***

#### resetHighWaterMark

```solidity
function resetHighWaterMark() external;
```

Reset the high-water mark to the current price per share — used after a known-loss event so the performance fee re-engages from a fresh baseline. Reverts unless `allowHighWaterMarkReset` was set to `true` at vault initialization. *(New in v0.6.0.)*

***

#### close

```solidity
function close(uint256 _newTotalAssets) external;
```

Finalize closing the vault. The Owner (Admin) must first call `initiateClosing`. After `close`, only redemption / withdrawal paths remain available.

**Parameters:**

| Name              | Type      | Description                  |
| ----------------- | --------- | ---------------------------- |
| `_newTotalAssets` | `uint256` | Final total assets at close. |

***

## Valuation Manager

#### updateNewTotalAssets

```solidity
function updateNewTotalAssets(uint256 _newTotalAssets) public;
```

Propose a new vault valuation. Must satisfy `GuardRailsManager.isCompliant` if guardrails are active.

**Parameters:**

| Name              | Type      | Description            |
| ----------------- | --------- | ---------------------- |
| `_newTotalAssets` | `uint256` | Proposed total assets. |

***

## Security Council

#### securityCouncilUpdateTotalAssets

```solidity
function securityCouncilUpdateTotalAssets(uint256 _newTotalAssets) public;
```

Same as `updateNewTotalAssets` but **bypasses guardrails**. Used to recover from valuation events that legitimately exceed the configured bounds. *(New in v0.6.0.)*

**Parameters:**

| Name              | Type      | Description            |
| ----------------- | --------- | ---------------------- |
| `_newTotalAssets` | `uint256` | Proposed total assets. |

***

#### updateGuardrails

```solidity
function updateGuardrails(Guardrails calldata guardrails_) external;
```

Update the price-per-share bounds policy.

```solidity
struct Guardrails {
    uint256 upperRate;  // maximum annualised PPS increase in bps
    int256  lowerRate;  // minimum annualised PPS change in bps (signed: can be negative)
}
```

**Parameters:**

| Name          | Type         | Description                                      |
| ------------- | ------------ | ------------------------------------------------ |
| `guardrails_` | `Guardrails` | New upper / lower annual bounds in basis points. |

***

#### updateActivated

```solidity
function updateActivated(bool activated_) external;
```

Enable or disable guardrail enforcement.

**Parameters:**

| Name         | Type   | Description                            |
| ------------ | ------ | -------------------------------------- |
| `activated_` | `bool` | `true` to enforce, `false` to disable. |

***

## Access Manager (former Whitelist Manager)

#### addToWhitelist

```solidity
function addToWhitelist(address[] memory accounts) external;
```

Add accounts to the whitelist.

**Parameters:**

| Name       | Type        | Description            |
| ---------- | ----------- | ---------------------- |
| `accounts` | `address[]` | Accounts to whitelist. |

***

#### revokeFromWhitelist

```solidity
function revokeFromWhitelist(address[] memory accounts) external;
```

Remove accounts from the whitelist.

**Parameters:**

| Name       | Type        | Description         |
| ---------- | ----------- | ------------------- |
| `accounts` | `address[]` | Accounts to remove. |

***

#### addToBlacklist

```solidity
function addToBlacklist(address[] memory accounts) external;
```

Add accounts to the blacklist. *(New in v0.6.0.)*

**Parameters:**

| Name       | Type        | Description            |
| ---------- | ----------- | ---------------------- |
| `accounts` | `address[]` | Accounts to blacklist. |

***

#### revokeFromBlacklist

```solidity
function revokeFromBlacklist(address[] memory accounts) external;
```

Remove accounts from the blacklist. *(New in v0.6.0.)*

**Parameters:**

| Name       | Type        | Description                            |
| ---------- | ----------- | -------------------------------------- |
| `accounts` | `address[]` | Accounts to remove from the blacklist. |

***

#### setExternalSanctionsList

```solidity
function setExternalSanctionsList(SanctionsList sanctionsList) external;
```

Wire an external sanctions oracle that the vault will query on **every** `isAllowed` check — i.e. on every deposit, redeem, request, share transfer, and operator-triggered claim. If the oracle returns `true` for the address, the call reverts. The hook is intended for the [Chainalysis Sanctions Oracle](https://go.chainalysis.com/chainalysis-oracle-docs.html), a free on-chain registry of OFAC-sanctioned addresses, but any contract that implements the one-method interface below works. Pass `address(0)` to disable the check entirely. *(New in v0.6.0.)*

```solidity
interface SanctionsList {
    function isSanctioned(address addr) external view returns (bool);
}
```

The sanctions check stacks on top of the active access mode (whitelist or blacklist) — an address must pass both to interact with the vault.

**Parameters:**

| Name            | Type            | Description                                                                                                                                                                                                                                                |
| --------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `sanctionsList` | `SanctionsList` | Oracle address. Use the Chainalysis-deployed contract for the target chain (see [their docs](https://go.chainalysis.com/chainalysis-oracle-docs.html) for per-network addresses), a custom oracle implementing `isSanctioned`, or `address(0)` to disable. |

***

## Owner (Admin)

The Owner (Admin) is the governance role — it does not run the strategy, but it controls vault configuration, critical safety switches, and role assignments. Enforced on-chain by the standard `onlyOwner` modifier (`Ownable2StepUpgradeable`).

### Lifecycle & emergency

#### initialize

```solidity
function initialize(
    bytes memory data,
    address feeRegistry,
    address wrappedNativeToken
) public;
```

Proxy-time initializer. `data` is an ABI-encoded `InitStruct` containing the vault's full configuration.

**Parameters:**

| Name                 | Type      | Description                                                                         |
| -------------------- | --------- | ----------------------------------------------------------------------------------- |
| `data`               | `bytes`   | ABI-encoded `InitStruct` (underlying, name, symbol, roles, rates, sync mode, etc.). |
| `feeRegistry`        | `address` | Protocol fee registry address.                                                      |
| `wrappedNativeToken` | `address` | Wrapped native token (e.g. WETH) — used by `Silo.depositEth`.                       |

***

#### pause

```solidity
function pause() public;
```

Halt all core user operations (deposit, redeem, withdraw, requests, settlements, valuation updates).

***

#### unpause

```solidity
function unpause() public;
```

Resume operations after a pause.

***

#### initiateClosing

```solidity
function initiateClosing() external;
```

Start the vault wind-down. After this, the Curator finalises via `close(_newTotalAssets)`.

***

#### activateAsyncOnly

```solidity
function activateAsyncOnly() external;
```

**Irreversible.** Permanently disable sync deposits and sync redeems. After this call, `isAsyncOnly()` returns `true` and `totalAssets` is always treated as invalid. *(New in v0.6.0.)*

***

### Roles

#### updateWhitelistManager

```solidity
function updateWhitelistManager(address _whitelistManager) external;
```

Replace the Access Manager address (the role formerly known as Whitelist Manager — kept under its original name in the source for storage-layout compatibility).

**Parameters:**

| Name                | Type      | Description                 |
| ------------------- | --------- | --------------------------- |
| `_whitelistManager` | `address` | New Access Manager address. |

***

#### updateValuationManager

```solidity
function updateValuationManager(address _valuationManager) external;
```

Replace the Valuation Manager address (the role authorised to call `updateNewTotalAssets`).

**Parameters:**

| Name                | Type      | Description                    |
| ------------------- | --------- | ------------------------------ |
| `_valuationManager` | `address` | New Valuation Manager address. |

***

#### updateFeeReceiver

```solidity
function updateFeeReceiver(address _feeReceiver) external;
```

Replace the address that receives the share-denominated fees minted at settlement.

**Parameters:**

| Name           | Type      | Description               |
| -------------- | --------- | ------------------------- |
| `_feeReceiver` | `address` | New fee receiver address. |

***

#### updateSafe

```solidity
function updateSafe(address _safe) external;
```

Replace the address bound to the Curator role (called `safe` in the source for historical reasons — see the [Curator](#curator) section). *(New in v0.6.0.)* Reverts if `lockUpdateSafe` has been called.

**Parameters:**

| Name    | Type      | Description                                                                                         |
| ------- | --------- | --------------------------------------------------------------------------------------------------- |
| `_safe` | `address` | New address for the Curator role. Can be any address (multi-sig, EOA, MPC wallet, custom contract). |

***

#### updateSecurityCouncil

```solidity
function updateSecurityCouncil(address _securityCouncil) external;
```

Replace the Security Council address (the role that manages guardrails and can bypass them via `securityCouncilUpdateTotalAssets`). *(New in v0.6.0.)*

**Parameters:**

| Name               | Type      | Description                   |
| ------------------ | --------- | ----------------------------- |
| `_securityCouncil` | `address` | New Security Council address. |

***

#### updateSuperOperator

```solidity
function updateSuperOperator(address _superOperator) external;
```

Replace the Super Operator address (the global operator that can act on behalf of any controller and bypasses whitelist / blacklist checks — see [Super Operator](#super-operator) for the full scope). *(New in v0.6.0.)* Reverts if `lockSuperOperator` has been called.

**Parameters:**

| Name             | Type      | Description                                             |
| ---------------- | --------- | ------------------------------------------------------- |
| `_superOperator` | `address` | New Super Operator address. Use `address(0)` to remove. |

***

#### lockUpdateSafe

```solidity
function lockUpdateSafe() external;
```

**Irreversible.** Permanently disable `updateSafe`. *(New in v0.6.0.)*

***

#### lockSuperOperator

```solidity
function lockSuperOperator() external;
```

**Irreversible.** Permanently disable `updateSuperOperator`. *(New in v0.6.0.)*

***

#### transferOwnership / acceptOwnership

```solidity
function transferOwnership(address newOwner) public;
function acceptOwnership() public;
```

Two-step transfer of the Owner (Admin) role (`Ownable2StepUpgradeable`). `newOwner` must call `acceptOwnership` for the transfer to take effect.

***

### Access control

#### switchAccessMode

```solidity
function switchAccessMode(AccessMode newMode) public;
```

Switch between whitelist and blacklist mode. *(New in v0.6.0.)*

```solidity
enum AccessMode { Blacklist, Whitelist }
```

**Parameters:**

| Name      | Type         | Description                 |
| --------- | ------------ | --------------------------- |
| `newMode` | `AccessMode` | `Whitelist` or `Blacklist`. |

***

### Fees & metadata

#### updateRates

```solidity
function updateRates(Rates memory newRates) external;
```

Update fee rates. Max bounds are enforced on-chain (entry/exit ≤ 2%, haircut ≤ 20%, management/performance per protocol policy). The protocol cut is not part of this struct — it is read from the `FeeRegistry`.

**Parameters:**

| Name       | Type    | Description                                                                       |
| ---------- | ------- | --------------------------------------------------------------------------------- |
| `newRates` | `Rates` | New management / performance / entry / exit / haircut rates, all in basis points. |

***

#### updateName

```solidity
function updateName(string memory newName) external;
```

Update the ERC20 `name`. *(New in v0.6.0.)*

**Parameters:**

| Name      | Type     | Description |
| --------- | -------- | ----------- |
| `newName` | `string` | New name.   |

***

#### updateSymbol

```solidity
function updateSymbol(string memory newSymbol) external;
```

Update the ERC20 `symbol`. *(New in v0.6.0.)*

**Parameters:**

| Name        | Type     | Description |
| ----------- | -------- | ----------- |
| `newSymbol` | `string` | New symbol. |

***

## Super Operator

The Super Operator is a single global address that satisfies the operator check for any controller on **every user op except `requestDeposit` and `syncDeposit`**, and additionally **bypasses whitelist / blacklist checks**. There is no dedicated function — it works by passing the `isOperatorOrSuperOperator` check in `deposit`, `mint`, `redeem`, `withdraw`, `cancelRequestDeposit(address)`, and `cancelRequestRedeem`.

The address is set by the Owner (Admin) via `updateSuperOperator(address)` and can be permanently locked via `lockSuperOperator()`. Use `address(0)` to disable.

***

## GuardRailsManager (read)

#### isCompliant

```solidity
function isCompliant(
    uint256 currentPps,
    uint256 nextPps,
    uint256 timePast
) public view returns (bool);
```

Pure check used by the vault on every `updateNewTotalAssets` call. Returns `true` if the proposed PPS change stays within the configured upper/lower annual bounds for the elapsed time.

**Parameters:**

| Name         | Type      | Description                            |
| ------------ | --------- | -------------------------------------- |
| `currentPps` | `uint256` | Current price per share.               |
| `nextPps`    | `uint256` | Proposed new price per share.          |
| `timePast`   | `uint256` | Seconds elapsed since the last update. |

**Return values:**

| Name      | Type   | Description          |
| --------- | ------ | -------------------- |
| (unnamed) | `bool` | `true` if compliant. |

***

## Silo (separate contract)

The Silo is a minimal helper contract paired with each vault. It holds pending assets (during async deposits) and pending shares (during async redeems). The vault's constructor configures `IERC20(underlying).forceApprove(vault, max)` so the vault can pull from the silo; no other entry points exist beyond the one below.

#### depositEth

```solidity
function depositEth() external payable;
```

Wrap received ETH into WETH. Called by the vault when a user `requestDeposit`s native ETH and the underlying is WETH.