Skip to main content
Red Potion separates protocol operation, tenant control, fund day-to-day roles, strategy execution, and investors. Trust boundaries follow that split.

​
Protocol operator

The Red Potion team runs the FundManagerDeployer. It onboards tenants, publishes canonical implementations, and sets the protocol fee recipient. It does not run individual funds or hold their assets.

​
Tenant (fund house)

A tenant runs one or more funds. Each tenant has a FundManager and controls upgrade authority for its funds’ contracts. Tenants cannot touch each other’s funds.

​
Fund operator

Day-to-day fund work is a set of roles on the Fund, not one key:
  • Reporter — submits NAV reports after batch close (SUBMIT_REPORT_ROLE)
  • Report acceptor — accepts a reviewed report and settles the batch (ACCEPT_REPORT_ROLE)
  • Reviewer — vetoes a bad pending report (REJECT_REPORT_ROLE)
  • Allocator — moves capital Fund ↔ strategies (PUSH_TO_STRATEGY_ROLE / PULL_FROM_STRATEGY_ROLE) and funds settled redemptions (FUND_REDEEM_ROLE)
  • Configurators — fees, risk limits, allowed assets, price-safety bounds
Roles can sit on different parties or keys. Full table: Access control and roles.

​
Strategy operator

Capital leaves the Fund only into Strategy wallets. A strategy has its own admin and CALLER_ROLE operators, separate from fund roles. Calls must match an allowlist (caller, target, selector, optional pinned args). Strategies cannot call the Fund. The Fund can always pull assets back.

​
Investor

Investors deposit via DepositQueue, receive FundShare after settlement and claim, and redeem via RedeemQueue. Interaction surface: queues and the share token.

​
Trust boundaries

​
Where assets live

At any time, assets sit in the Fund, a Strategy, or a whitelisted external wallet (custodian, CEX deposit address, etc.). The Fund can pull from strategies. External-wallet return is operational trust — the Fund cannot pull. Cross-chain capital via StandaloneStrategy returns the same way (bridge / transfer back).