Architecture overview

A Tango vault is not one contract but a small group of them. A share token takes deposits and pays withdrawals, sub-accounts hold the strategy's positions, and supporting contracts value, limit and guard them. This page shows how the pieces fit together, how money moves between them, and which contract releases are in use.

Key points

• A Tango vault is a share token plus a set of sub-accounts. The vault holds idle USDC, and the sub-accounts hold the strategy's positions.
• A NAV oracle adds up the vault's idle USDC and every sub-account's value. Deposits and withdrawals are settled at that NAV.
• One AccessManager controls every restricted function, and anything that adds risk waits behind a timelock.
• Each vault keeps the contract release it was deployed with. New strategies use release 0.12.0.

How the pieces fit

Idle USDC is cash the vault holds but has not yet sent to a sub-account. NAV (net asset value) is the total value of everything the vault holds. The diagram shows each contract and what passes between them.

Depositor -> Vault: request deposit (USDC waits in the deposit silo, outside NAV)
Vault -> Depositor: claim shares after settlement
Vault -> Tracked sub-account: send USDC (capped per sub-account, rate limited)
Tracked sub-account -> Modules: swap, lend, provide liquidity; every call checked against oracle prices
Tracked sub-account -> Asset registry and price oracle: only registered assets, priced by oracle adapters
Vault -> Attested sub-account: send USDC
Attested sub-account -> Offchain venue: approved call shapes only (for example a bridge to an exchange account)
NAV provider -> Attested sub-account: reported value, accepted only inside a deviation band
NAV oracle: vault NAV = idle USDC + sum of sub-account values
AccessManager: gates every restricted function, with timelocks by risk tier
Factory: deploys and connects every contract, then gives up all of its powers

Components

Each vault is made of the contracts below. The "One per" column shows how many of each a vault has.

Every contract is either a clone that cannot be upgraded or a plain deployment. Nothing can be upgraded in place.

How a dollar moves

1. A depositor requests a deposit, and their USDC waits in the deposit silo.
2. The vault's settler (whoever holds the role to settle requests) settles the request at the current NAV. The USDC becomes idle cash in the vault, and the vault mints the depositor's shares.
3. The manager sends USDC to a sub-account, within that sub-account's cap and rate limit.
4. The sub-account swaps, lends, provides liquidity or reaches an offchain venue, within its limits.
5. To pay redemptions, the manager brings USDC back from a sub-account to the vault. Money never moves directly from one sub-account to another.
6. A holder requests a redemption, and the settler settles it from idle cash at the current NAV. The holder then claims their USDC.

See Deposits and Withdrawals for the full flows.

How value is measured

The vault calculates NAV onchain every time it needs the figure, and never stores an old one to reuse. NAV is:

• the idle USDC in the vault, counted from the vault's own records rather than its token balance, so tokens sent to it without being asked do not move NAV;
• plus each tracked sub-account's registered tokens and positions, at oracle prices;
• plus each attested sub-account's accepted value;
• minus fees earned but not yet minted as new shares.

A price is stale when it is too old to trust. If any input is stale, the whole NAV is stale, and settlement pauses until it is fresh again. See Sub-accounts and NAV.

Contract releases

A contract release is a fixed version of the vault's contract code. Each vault is deployed from a factory for one release, and keeps that release for its whole life.

These docs describe release 0.12.0 unless a page says otherwise.