Seed TVL & Accounting Policy

Why this policy exists

Protocol owned deposits are reported separately from user TVL. This page records the affirmative policy. It is in force, on chain, and verifiable by anyone.

The TVL number we publish is real, the methodology is published, and any nonzero off chain bucket is broken out individually on the public Proof of Reserves endpoint.

Affirmative policy

1. Real collateral only. totalAssets() is the sum of real, verifiable collateral. Every unit is reconcilable to either an on chain ERC 20 balance, an off chain hedge venue balance with a published attestation, or a verified Hyperliquid L1 bridge balance.
2. Four buckets, individually disclosed. trackedOnChain (real ERC 20 balance held by the vault), offChainAssets (CEX hedge collateral), l1Assets (Hyperliquid L1 bridge balance), and hedgingReserve (on chain hedge buffer) are each reported as their own line on /api/por and on the Transparency Dashboard. The aggregate is never the only number a reviewer can see.
3. Public attestation per nonzero off chain bucket. Each nonzero off chain bucket is paired with a public attestation that names the venue, the wallet or account address, and the timestamp of the last reconciliation. The bot's PoR pipeline writes netDelta, exchangeEquity, and timestamp fields for this purpose.
4. Bot only updates, on chain rate limited. The STRATEGIST_ROLE that gates updateOffChainAssets, updateL1Assets, and updateHedgingReserve is held by an automated bot under documented operational scope. The update logic is further constrained by offChainUpdateCooldown and maxOffChainChangeRateBps inside KerneVault.sol. Neither guard can be bypassed without a contract upgrade, which itself requires the 2 of 3 Safe.
5. Honest copy. User facing copy never labels protocol owned reserves as user TVL or 'Institutional Partners'. API field naming, dashboard labels, marketing copy, and aggregator submissions use plain accounting words: vault collateral, off chain hedge collateral, L1 bridge balance, on chain hedge buffer. If the protocol ever deploys its own capital into the vault, that capital is labeled protocolOwnedReserves and broken out as its own bucket.

How to verify this policy is in force

Anyone, including auditors, allocators, and journalists, can verify the policy is in force at any time using only public RPC endpoints and a curl command. The four bucket reads must sum to totalAssets() on the same block. The composition object on /api/por mirrors the four cast reads.

cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "offChainAssets()(uint256)" --rpc-url https://mainnet.base.org
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "l1Assets()(uint256)"        --rpc-url https://mainnet.base.org
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "hedgingReserve()(uint256)"  --rpc-url https://mainnet.base.org
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "totalAssets()(uint256)"     --rpc-url https://mainnet.base.org

curl -s https://kerne.fi/api/por | jq '.reserves.vault.composition'
curl -s https://app.kerne.fi/api/por | jq '.reserves.vault.composition'

# Rate limit guards live on v2, not the retired v1 vault above.
cast call 0x8ccc56B5624e2FDB592F6609d81F4c3798e3292B "offChainUpdateCooldown()(uint256)" --rpc-url https://mainnet.base.org
cast call 0x8ccc56B5624e2FDB592F6609d81F4c3798e3292B "maxOffChainChangeRateBps()(uint256)" --rpc-url https://mainnet.base.org

Change control

Any future change to this policy requires a pull request that updates the canonical doc, a corresponding PR that updates /api/por on both kerne.fi and app.kerne.fi if the change adds, removes, or renames a bucket, a 2 of 3 Safe acknowledgement transaction emitting an event whose body is the keccak hash of the new policy file (so the version in force at any block is provable), and a public announcement from the canonical @KerneProtocol handle linking to both the PR and the Safe transaction.

Last updated 25 April 2026. Owner: protocol governance, 2 of 3 Safe 0x52d3E450bA6c299B1B07298F1E87DD74732D4877.