> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thaler.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Custody and policy

> Who holds the keys, who can sign on the vault's behalf, and why the rules cannot change after signing. Verifiable on chain in two minutes.

## Self-custodial by construction

A Thaler vault is a Squads smart account. The user is a co-signer on that account from the moment it is created. The protocol cannot move funds out of a vault without the policy explicitly allowing it, and cannot bypass the policy at all.

This differs from a managed product, where a custodian holds the keys and the user holds a claim against the custodian. In Thaler the user holds the keys; the protocol holds the rules.

## What the policy controls

The Squads policy extension binds the vault's behaviour. It enumerates every parameter the smart account will enforce.

| Field             | Constraint                                                                              |
| ----------------- | --------------------------------------------------------------------------------------- |
| Allowed assets    | SOL, jitoSOL, mSOL, USDC (USDC only enters via the deposit swap; never as collateral)   |
| Allowed venues    | Kamino for lending, Jito or Marinade for staking, Hyperliquid or Pacifica for the hedge |
| Leverage cap      | Maximum borrow ratio for the lending leg, well below Kamino's liquidation threshold     |
| Claim cadence     | 24-hour cooldown between yield claims                                                   |
| Closure procedure | Order of operations on close, payout destination, penalty schedule                      |

Any instruction that targets an asset, venue, or operation outside this enumeration is rejected at the smart-account level.

## Immutability

The policy extension is signed once and cannot be amended. The value of a policy comes from its predictability. A policy that can be modified after signing offers no stronger guarantee than an off-chain agreement.

Three consequences follow from immutability:

1. The user can verify the policy once and rely on it for the vault's lifetime.
2. Auditors can compare the deployed program to the signed policy without tracking ongoing amendments.
3. The protocol cannot change the rules under stress, during a drawdown, or after a market move.

If the protocol updates the rule set, it deploys a new policy version. Existing vaults continue under the policy they signed. Users who want the new version close the existing vault and open a new one.

## Recovery and continuity

The Squads smart account is independent of any single party. The user retains a co-signer key. If the protocol's worker or agent wallet becomes unreachable, the user can still execute the close procedure that the policy defines.

The deposit and any accrued yield are held by the smart account, not by the protocol. There is no path inside the policy that lets the worker route the payout elsewhere.

## Verifying a vault on chain

<Steps>
  <Step title="Locate the vault address">
    The Squads smart account address appears under the vault number on the My Vaults screen.
  </Step>

  <Step title="Open a block explorer">
    Paste the smart account address into [Solscan](https://solscan.io) or
    [Solana Explorer](https://explorer.solana.com).
  </Step>

  <Step title="Read the policy extension">
    The extension is attached to the Squads multisig. It lists the allowed assets, the allowed
    venues, the leverage cap, the claim cadence, and the closure procedure in plain on-chain
    data.
  </Step>

  <Step title="Cross-check against the strategy summary">
    The strategy summary shown in the Thaler app must match the on-chain rules exactly. Any
    discrepancy is a signal not to deposit.
  </Step>
</Steps>

## Comparison with managed products

| Property                            | Managed product               | Thaler vault                             |
| ----------------------------------- | ----------------------------- | ---------------------------------------- |
| Who holds the keys                  | Custodian                     | User and protocol (multisig)             |
| User holds                          | A claim against the custodian | A co-signer key to the smart account     |
| Rule changes                        | At the custodian's discretion | Immutable once signed                    |
| Recovery if the operator disappears | Bankruptcy proceedings        | User can still operate the smart account |
| On-chain verifiability              | Limited or none               | Full                                     |

## Next read

<Columns cols={2}>
  <Card title="Strategies" icon="line-chart" href="/strategies/index">
    The three pillars the policy authorises and how they earn together.
  </Card>

  <Card title="Risk disclosure" icon="triangle-exclamation" href="/security/risk-disclosure">
    The residual risks that no policy can fully eliminate.
  </Card>
</Columns>