> For the complete documentation index, see [llms.txt](https://candora.gitbook.io/whitepaper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://candora.gitbook.io/whitepaper/candora-grid/vault.md). # Vault Custody, Ledger, and Settlement System ### Custody, Ledger, and Settlement System Candora Vault is the custody, ledger, and settlement layer of Candora Grid. It serves as the authoritative financial-state system of the exchange and is responsible for asset custody, balance accounting, collateral ownership, settlement finality, reserve management, and reconciliation between internal ledger records and external reserve assets. Vault acts as the system of record for all asset ownership within the Grid. Every subsystem that depends on balances, collateral, transfers, margin support, reserve accounting, or settlement integrity ultimately derives its financial state from Vault. While other systems may consume financial information, only Vault possesses authority to create, update, or finalize ownership records. Unlike traditional exchange architectures that separate accounting systems, wallet infrastructure, and settlement processes into independent operational domains, Vault unifies these functions within a single financial-state engine. This allows custody, accounting, settlement, and reserve management to evolve from a common source of truth while preserving auditability, deterministic recovery, and systemic consistency across the broader platform. ### Financial State Model Vault is built around immutable financial-state transitions rather than mutable balance records. Every monetary operation is represented as a ledger event recorded within an append-only accounting system. The accounting framework follows a double-entry model: ``` Assets=Liabilities+Equity ``` Each financial event produces a balanced debit-credit transition: ``` T = { debit_account, credit_account, amount, asset, timestamp } ``` Balances are derived from ledger history rather than stored as independent state: ``` Balanceₐ = Σ Creditsₐ − Σ Debitsₐ ``` Because ownership is reconstructed directly from immutable transaction history, Vault maintains complete traceability of all financial activity while supporting deterministic recovery and audit reconstruction. In addition to maintaining ledger state, Vault continuously exports collateral and reserve telemetry to other Grid subsystems. Risk Engine consumes collateral-state information for solvency management, while Pulse consumes reserve and settlement telemetry to maintain synchronized awareness of broader financial conditions. ### Ledger Architecture Internally, Vault operates as an event-driven ledger engine in which every financial-state transition is recorded within a sequenced transaction stream. Financial events are represented as structured ledger records: ``` E_financial = { tx_id, account, asset, delta, seq_n } ``` The ledger is designed around atomic settlement transitions, deterministic sequencing, idempotent processing, and replay-safe recovery behavior. To support scalability, transaction processing may be partitioned across account namespaces and asset classes while preserving global accounting consistency. Vault maintains synchronized checkpoints with Orbit and Risk Engine so that execution state, collateral state, and ownership state can be reconstructed consistently during recovery operations. ### Custody Architecture Vault separates custody responsibilities across multiple operational tiers designed to balance security, settlement responsiveness, and reserve protection. Operational liquidity is maintained within hot-wallet infrastructure used for routine settlement activity. Additional liquidity may be staged through intermediate custody layers that support internal balancing and reserve routing. Long-term reserves are maintained within isolated custody environments separated from public-facing infrastructure and protected through controlled authorization procedures. Reserve movements require threshold authorization: ``` Σ ValidSignatures ≥ Quorum ``` Authorization policies may incorporate distributed approval requirements, segregated signing responsibilities, and geographically separated custody controls designed to reduce correlated operational risk. Vault continuously monitors settlement liquidity and reserve allocation to ensure sufficient operational capacity while minimizing unnecessary exposure of reserve assets. ### Settlement and Asset Movement Vault manages both inbound and outbound asset movement through controlled settlement workflows. Incoming deposits pass through a staged verification process that includes chain observation, confirmation validation, replay protection, and settlement finalization. A deposit is considered settled only after satisfying network-specific confirmation requirements: ``` confirmations(tx) ≥ k ``` The confirmation threshold may vary according to network characteristics, reorganization risk, validator concentration, and observed chain conditions. Once validated, deposits are converted into immutable settlement events and committed to ledger state. Outbound withdrawals follow a structured authorization workflow: ``` Request → Validation → Risk Review → Signing → Broadcast ``` Before settlement authorization, Vault evaluates balance integrity, withdrawal policies, address validation requirements, liquidity availability, anomaly-detection signals, and applicable platform controls. Where supported by the underlying network, settlement operations may be batched to improve efficiency and reduce congestion-related costs. Under elevated market stress or liquidity pressure, withdrawal processing may transition into controlled pacing modes designed to preserve reserve continuity while maintaining predictable settlement behavior. ### Reconciliation and Reserve Verification Vault continuously reconciles internal accounting records against observable reserve balances. Reconciliation measures divergence between internal ledger state and externally verifiable reserve state: ``` Δstate = |Sinternal − Schain| ``` If divergence exceeds predefined thresholds, reconciliation workflows are initiated and settlement activity may be restricted until consistency is restored. Vault additionally maintains reserve-verification controls designed to confirm that recorded liabilities remain supported by available reserves: ``` Σ UserBalances ≤ VerifiedReserves ``` Verification combines internal accounting records, reserve observations, custody reports, and other available validation mechanisms. These controls strengthen solvency monitoring, improve operational transparency, and help surface inconsistencies before they become systemic risks. Beyond reserve validation, Vault continuously verifies consistency between settlement activity, collateral state, execution outcomes, liquidation events, and treasury operations. This allows Vault to function not only as a custody platform, but also as the financial coordination layer of Candora Grid. ### Security and System Boundaries Vault operates within strict isolation boundaries and remains separated from public-facing infrastructure. No external service receives direct access to custody systems, signing environments, or ownership records. Financial-state mutation authority exists exclusively within Vault. Connect cannot directly access custody infrastructure. Orbit cannot independently modify balances. Risk Engine cannot authorize settlement actions. Pulse cannot alter ownership records. These boundaries ensure that compromise of any individual subsystem does not imply compromise of custody controls, reserve integrity, or authoritative ownership state. Additional protections include isolated custody networks, hardware-secured signing infrastructure, immutable audit records, threshold authorization controls, cryptographic ledger verification, and controlled reserve-access procedures. Vault also exports reserve-health telemetry to Candora's shared stress-state framework, allowing other infrastructure domains to respond coherently to withdrawal pressure, settlement congestion, or reserve fragmentation while preserving clear separation of responsibility. ### Replay and Recovery All financial-state transitions are recorded as immutable event streams and support deterministic reconstruction. Recovery follows a structured process: 1. Restore financial checkpoint. 2. Replay subsequent ledger events. 3. Reconstruct ownership state. 4. Resume settlement processing. Financial-state reconstruction follows: ``` Rrecovered = Rsnapshot + Σ Δfinancial_events ``` Because ownership is derived entirely from ordered ledger activity, reconstructed state remains consistent with the original operational state. This enables auditing, simulation, recovery, regulatory reconstruction, and forensic analysis without requiring approximation of prior ownership conditions. ### System Role Summary Candora Vault serves as the authoritative financial-state layer of Candora Grid. It provides custody management, balance accounting, collateral ownership tracking, settlement finality, reserve coordination, reconciliation, and financial-state recovery across the exchange infrastructure. All ownership records, balance integrity, settlement finality, collateral accounting, reserve verification, and custody controls ultimately originate from Vault, making it the foundational financial-state system of the entire Grid architecture.