Invariant Definitions
In Surf, an invariant is a rule that must always remain true, no matter what the market does, what Surf proposes, or how vault logic evolves.
Invariants are not parameters. They are safety truths that the system is mathematically and programmatically forbidden to violate.
They define the line between automation and control.
If an action would break an invariant, it is rejected before execution. No exception. No override. No discretion.
Why Invariants Exist?
Autonomous systems fail when optimisation is allowed to override safety.
Surf inverts this model.
Optimisation is allowed only inside invariant boundaries. The boundaries never move unless governance explicitly upgrades them.
This ensures that:
Surf can improve yield
Vault logic can evolve
Market conditions can change
Capital can move across venues
But the fundamental safety properties of the system never degrade.
Core Invariant Classes
1. Custody Invariants
User funds must always remain:
In user-owned vaults
Withdrawable at any time
Unmovable outside vault scope
Unseizable by vault logic, operators or automation
No vault logic, operator, or contract can violate withdrawal rights.
2. Execution Scope Invariants
All capital movement must:
Remain inside allowlisted protocols
Use approved adapters and routes
Respect vault-level permissions
Follow atomic execution guarantees
No off-policy venue. No shadow routing. No hidden paths.
3. Exposure Invariants
Capital concentration must never exceed:
Per-protocol exposure caps
Per-asset allocation limits
Per-vault risk bands
Correlation and dependency thresholds
This prevents systemic loss from a single venue, oracle, or market failure.
4. Slippage and Liquidity Invariants
Every move must satisfy:
Maximum price impact thresholds
Minimum exit liquidity depth
Worst-case unwind simulation
Market stress tolerance limits
The system refuses execution if capital cannot safely exit.
5. Temporal Invariants
Execution must respect:
Cooldown periods between reallocations
Rate-of-change limits
Volatility-adjusted rebalancing frequency
Emergency freeze conditions
This prevents cascade reactions during fast-moving markets.
6. Vault Integrity Invariants
Vault behaviour must always satisfy:
Bounded leverage
No recursive exposure loops
No hidden rehypothecation
No cross-vault contamination
Vaults cannot create hidden second-order risk.
How Invariants Are Enforced?
Invariants are enforced by the Guardian Layer through:
Pre-execution simulation
State transition verification
Constraint satisfaction checks
Formal rule evaluation
Circuit-breaker escalation logic
Only actions that satisfy all invariants are allowed to reach execution.
Surf proposes. Simulation evaluates. Invariants decide.
Why This Matters?
Most DeFi systems rely on:
Parameter tuning
Human monitoring
Reactive governance
After-the-fact audits
Surf relies on invariants.
That means:
Safety is proactive, not reactive
Rules are enforced by code, not policy
Trust is replaced by verifiable constraint systems
Autonomy scales without sacrificing control
This is what allows Surf to operate on real capital while remaining non-custodial, deterministic, and institution-grade.
Invariants are the constitution of the system.
Everything else operates inside them.
Last updated