The contracts are not deployed yet. The full reference lands with the testnet deployment, verified on Blockscout. What follows is the mechanism as it is specified today.
A mandate is a rule type plus parameters: basket size, a per asset weight cap and floor, a rebalance interval of at least 24 hours, a liquidity floor, and a lookback where the rule needs one. Five rule types exist and the list is immutable. If a mandate cannot be stated in one English sentence, the rule type is wrong.
Validation is a pure view function, so a proposal can be dry run from the browser before a keeper spends gas. It returns a boolean and a fail code. Fail codes are surfaced verbatim in keeper logs and on the fund sheet. There are no silent rejections.
A keeper proposes a basket and locks a bond. That opens a six hour challenge window. Any staker can challenge by posting twice the bond, which cancels the proposal on the spot. If the same basket is re proposed and executes within 48 hours, the challenger loses their bond and the original proposer is made whole from it. A bad faith challenge costs more than it can win.
Creating pulls the exact target basket, to the wei, and mints against NAV. Redeeming burns shares and pays a pro rata slice of what the fund actually holds. Creating reads a price oracle and reverts if it is stale. Redeeming reads no oracle at all. Creating may fail. Redeeming must not.
Every fee is denominated in the fund’s own shares, never in ETH. Ten basis points on create and on redeem, three for stakers, and thirty basis points a year on assets, accrued as dilution. The fund contract holds no ETH and has no code path that could receive any.
An operator can whitelist assets, set bond sizes, and pause a fund. Pausing stops creation and rebalancing. It cannot stop redemption. There is no path by which anyone can edit a basket directly, block a redemption, move a fee split, or mint shares.