How your money is held
The contracts you own, what DLTX can and cannot do with them, and the one address your money can leave to.
The rule
You own the contracts that hold your money. DLTX operates them with keys the contracts limit. A DLTX key can trade, borrow, repay and move money between your own contracts, but money leaves your contracts only to your withdrawal address, and you can revoke DLTX and exit without its help.
Every arrow out of one of your contracts ends at your withdrawal address or at another of your own contracts. There is no other way out: no function a DLTX key can call takes a recipient.
What you own
- One deposit contract, at the same address on every chain DLTX supports. It holds the money that is not in a strategy: your balance.
- Two contracts per strategy. The long contract, on Arbitrum, holds the Aave position. The short contract, on HyperEVM, is the Hyperliquid account: the short is held in the contract's own name, not behind a key.
Each strategy contract's address is computed from your deposit contract and the configuration you signed (its markets and its limits). Each half computes its partner's address the same way, so no one else's contract can stand in for either half. The contract addresses page lists the factories that create them and what they are built to call.
Your credentials
You own your contracts through credentials: a passkey created on your device, or a wallet you sign with. You can hold up to four. Every owner action is a message one of them signs.
- Changes wait 24 hours. Adding or removing a credential, or changing your withdrawal address, takes effect 24 hours after you sign it. Any of your credentials can cancel it meanwhile, so a stolen credential cannot quietly bring in its own.
- DLTX cannot reset them. A reset DLTX could perform is one a compromised DLTX could perform. If you lose every credential, your money can still be paid to your withdrawal address; only the address can no longer change.
- Add a wallet if you use a passkey. A passkey only works on DLTX's website, so a DLTX that is still running but refuses to serve you could stop a passkey from signing. A wallet signs without DLTX. Everyone keeps the escape hatch if DLTX disappears; a wallet is what lets you leave against a DLTX that is still there.
Your withdrawal address
Your withdrawal address is the one place your money leaves to. You set it with a signature; it takes effect 24 hours later, and so does any change to it, with the same right to cancel. No strategy is funded before it is in effect.
What DLTX can and cannot do
DLTX decides when to supply, borrow, repay, swap or bridge, and how much, within limits. It never decides where to.
| DLTX key | Can | Cannot |
|---|---|---|
| Execution key, one per group of strategies | On the long contract: supply, borrow, repay, withdraw from Aave, swap, repay with collateral, bridge to the short contract, pay your deposit contract. On the short contract: move margin, reduce or close the short with the contract's own orders, bridge to the long contract, propose a new trading agent. | Pay anyone outside your contracts. Borrow or withdraw past the health floor. Lose more than the daily budget on the long contract. Grow a position with the contract's own orders, which only reduce. Change the agent without a public 24-hour wait. |
| Trading agent, one per strategy | Trade the strategy's Hyperliquid account. | Withdraw or send funds: Hyperliquid does not let an agent. Act once you have replaced it. |
| Transfer key, one per chain | Fund a strategy you authorised, up to the amount you signed for. Convert to USDC, and move USDC to your own deposit contract on another chain. Pay your withdrawal address. | Pay any other address. Take a fee you did not sign. Change your withdrawal address or your credentials. |
| Recovery key | Replace a compromised DLTX key. | Touch anyone's money or credentials. |
The limits written into the contracts
Each strategy's limits are set when it is created and fixed for its whole life: no function changes them, and the factory refuses values outside its bounds.
| Limit | What it stops | The contract refuses beyond | DLTX's setting |
|---|---|---|---|
| Health floor (long) | A borrow or a withdrawal that would leave Aave's health factor below the floor. Repaying and supplying are never held by it. | below 1.05 | 1.05 |
| Price bound (long) | A swap or repay with collateral priced worse than Aave's own oracle by more than the bound. | 5% | 3% |
| Daily loss budget (long) | Losing more than this share of the position in a day to swaps, repays with collateral and bridge fees. | 5% a day | 5% a day |
| Order bound (short) | A contract order more than this far from Hyperliquid's oracle price. Its orders are also immediate-or-cancel and reduce-only. | 10% | 5% |
| Fast-bridge fee cap (both) | Paying Circle more than this for a fast transfer between the halves. | 0.5% | 0.5% |
So even a stolen execution key cannot move money out, cannot borrow to within less than about 4.8% of liquidation, cannot trade more than 3% away from Aave's price, and loses at most 5% of a long contract's value a day through swaps.
Stopping DLTX
You can stop DLTX at any time, one piece at a time, with one signature each:
- Revoke execution on either contract of a strategy: the execution key loses its powers there.
- Replace the trading agent with an inert address: trading stops at once.
- Revoke the transfer key on a chain: it can no longer move money from your deposit contract there.
Or exit: one signature unwinds a strategy and pays everything to your withdrawal address.
If DLTX stops: the escape hatch
Each DLTX execution key and transfer key must check in on chain once a day. If one has not checked in for 7 days, anyone may unwind what it operates, and the money can go nowhere but your withdrawal address:
- an execution key silent for 7 days: anyone may begin the exit of its strategies and drive it to the end;
- a transfer key silent for 7 days: anyone may have a deposit contract on that chain pay out to its withdrawal address.
Replacing a key with the recovery key does not count as a check-in, so the recovery key alone cannot keep the hatch shut.
What a compromised DLTX could do
The test of the design is the worst case: every DLTX key stolen at once. The attacker can do the sum of what the keys can do: trade the Hyperliquid account badly through the agent, swap at a loss up to the daily budget, pay bridge fees, move USDC between your own contracts, and fund strategies you authorised up to what you signed for. They cannot send your money to an address you did not choose, and they cannot take over your credentials.
What remains, stated as plainly as the limits:
- The agent's trading. An agent can trade the account badly, bounded only by Hyperliquid's own price limits and DLTX's monitoring. If you distrust it, replace it and exit.
- Circle. The bridge between the halves and the messages that copy your owner record between chains are Circle's. Circle can pause them, and Circle can already freeze the USDC your contracts hold.
- A passkey against a live DLTX. Without a wallet credential, you are covered if DLTX stops entirely, not if it is running and blocking you.
- Seven days unmanaged. The escape hatch returns what is left after them.
The full argument, including what Circle's attesters could and could not do, is in whitepaper section 7.