Seed TVL & Accounting Policy
Why this policy exists
Most yield protocols quietly inflate their TVL with protocol-owned deposits and call it 'institutional capital'. We do not. This page records the affirmative policy. It is in force, on-chain, and verifiable by anyone.
If you are reading this because the homepage TVL number looks small, that is the point. The number is real, the methodology is published, and any non-zero off-chain bucket is broken out individually on the public Proof of Reserves endpoint.
Affirmative policy
- Real collateral only. totalAssets() is the sum of real, verifiable collateral. Every unit is reconcilable to either an on-chain ERC-20 balance, an off-chain hedge-venue balance with a published attestation, or a verified Hyperliquid L1 bridge balance.
- Four buckets, individually disclosed. trackedOnChain (real ERC-20 balance held by the vault), offChainAssets (CEX hedge collateral), l1Assets (Hyperliquid L1 bridge balance), and hedgingReserve (on-chain hedge buffer) are each reported as their own line on /api/por and on the Transparency Dashboard. The aggregate is never the only number a reviewer can see.
- Public attestation per non-zero off-chain bucket. Each non-zero off-chain bucket is paired with a public attestation that names the venue, the wallet or account address, and the timestamp of the last reconciliation. The bot's PoR pipeline writes netDelta, exchangeEquity, and timestamp fields for this purpose.
- Bot-only updates, on-chain rate limited. The STRATEGIST_ROLE that gates updateOffChainAssets, updateL1Assets, and updateHedgingReserve is held by an automated bot under documented operational scope. The update logic is further constrained by offChainUpdateCooldown and maxOffChainChangeRateBps inside KerneVault.sol. Neither guard can be bypassed without a contract upgrade, which itself requires the 2-of-3 Safe.
- Honest copy. User-facing copy never describes protocol-owned reserves as user TVL or 'Institutional Partners'. API field naming, dashboard labels, marketing copy, and aggregator submissions use plain accounting words: vault collateral, off-chain hedge collateral, L1 bridge balance, on-chain hedge buffer. If the protocol ever deploys its own capital into the vault, that capital is labeled protocolOwnedReserves and broken out as its own bucket.
How to verify this policy is in force
Anyone, including auditors, allocators, and journalists, can verify the policy is in force at any time using only public RPC endpoints and a curl command. The four bucket reads must sum to totalAssets() on the same block. The composition object on /api/por mirrors the four cast reads.
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "offChainAssets()(uint256)" --rpc-url https://mainnet.base.org
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "l1Assets()(uint256)" --rpc-url https://mainnet.base.org
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "hedgingReserve()(uint256)" --rpc-url https://mainnet.base.org
cast call 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC "totalAssets()(uint256)" --rpc-url https://mainnet.base.org
curl -s https://kerne.fi/api/por | jq '.reserves.vault.composition'
curl -s https://app.kerne.fi/api/por | jq '.reserves.vault.composition'Change control
Any future change to this policy requires a pull request that updates the canonical doc, a corresponding PR that updates /api/por on both kerne.fi and app.kerne.fi if the change adds, removes, or renames a bucket, a 2-of-3 Safe acknowledgement transaction emitting an event whose body is the keccak hash of the new policy file (so the version in force at any block is provable), and a public announcement from the canonical @KerneProtocol handle linking to both the PR and the Safe transaction.
Last updated 2026-04-25. Owner: protocol governance, 2-of-3 Safe 0x52d3E450bA6c299B1B07298F1E87DD74732D4877.