Skip to main content
Red Potion coordinates several distinct actors. Knowing who does what — and what each one can and cannot do — is the clearest way to understand the protocol’s trust model.

​
The protocol operator

The Red Potion team deploys and runs the FundManagerDeployer, the single protocol root. The protocol operator onboards tenants, publishes the canonical contract implementations, and sets the protocol-wide fee recipient. It does not run individual funds or hold their assets.

​
The tenant (fund house)

A tenant is an organization that runs one or more funds. Each tenant gets its own FundManager and controls the upgrade authority for all of its funds’ contracts. Tenants are isolated: one tenant cannot touch another’s funds.

​
The fund operator

Within a tenant, the fund operator is the party that actually manages a fund day to day. This is not a single role but a set of them, all granted on the Fund:
  • Reporter submits NAV price reports after each batch closes (SUBMIT_REPORT_ROLE).
  • Report acceptor accepts a reviewed report and settles the batch (ACCEPT_REPORT_ROLE).
  • Reviewer can veto a suspicious or wrong report before it settles (REJECT_REPORT_ROLE).
  • Allocator moves capital between the Fund and its strategies (PUSH_TO_STRATEGY_ROLE / PULL_FROM_STRATEGY_ROLE) and funds settled redemptions (FUND_REDEEM_ROLE).
  • Configurators set fees, risk limits, allowed assets, and price-safety bounds through their respective roles.
Crucially, these roles can be split across different parties or keys — the reporter need not be the acceptor, and neither need be the allocator. See Access Control & Roles for the full table.

​
The strategy operator

Capital leaves the Fund only into Strategy wallets. A strategy has its own admin and its own CALLER_ROLE operators, separate from the fund’s roles — so the party executing trades can be different from the party running the fund. A strategy operator can only make calls that have been explicitly allowlisted (by exact caller, target contract, function selector, and optionally pinned arguments), and can never call the Fund itself. The Fund can always pull assets back from a Strategy, so an operator can deploy capital but can never lock the fund out of it.

​
The investor

Investors deposit assets into a fund’s DepositQueue, receive FundShare tokens once their batch settles, and redeem those shares through the RedeemQueue. Investors interact only with the queues and the share token — everything else happens behind the scenes.

​
Trust boundaries at a glance

​
Where assets live

At any moment a fund’s assets are in one of a few places: idle in the Fund contract, deployed in a Strategy wallet, or pushed to a whitelisted external wallet (for example a custodian or CEX deposit address). Strategy assets can always be pulled back on-chain; external-wallet assets are returned by the wallet’s controller (operational trust) — the Fund cannot pull them. Capital deployed cross-chain via a StandaloneStrategy is bridged back the same way.