Rate limits

A rate limit caps how much money can move along one path in a vault over a period of time. Tango vaults use them so that even a key with permission to act cannot move a strategy's whole balance at once. Each limit works like a bucket that refills: every move takes from it, it fills back up at a set rate, and a move larger than what is left is refused.

Key points

• Rate limits can cover USDC sent into sub-accounts, swaps, supplies to lending venues and changes to liquidity positions. Each has its own bucket for each sub-account, and for each asset or venue.
• Every bucket has two settings, a capacity and a refill rate. They can be set differently for each direction of each asset, so moves towards cash can be allowed more room than moves that add exposure.
• Some moves are never limited, such as withdrawing from a lending venue or bringing USDC back to the vault. Deposits and withdrawals have no rate limit.
• Raising a limit is a timelocked change. Lowering a limit, or closing it to zero, takes effect immediately.

How a bucket works

Each bucket has two settings:

• its capacity, which is the most that can move before the bucket has to refill;
• its refill rate, which is how much room comes back each second.

Say a bucket has a capacity of 100 and refills completely over a day. If a swap uses 60, there are 40 left, and room comes back steadily until the bucket is full again. A swap of 50 straight after the first one would be refused, and the whole swap would revert.

Because a full bucket can be emptied and then used again as it refills, up to twice the capacity can pass through in the time the bucket takes to refill. That is the most a limit ever allows.

Every bucket starts at zero, which refuses everything until a limit is set. A bucket can also be set to unlimited, which turns it off.

What can be limited

Swaps and liquidity changes are charged from the amounts that actually moved, not the amounts a manager asked for. A swap that spends less than its maximum only uses up what it spent.

A swap uses two buckets at once. Swapping USDC for WETH takes from the USDC outbound bucket and the WETH inbound bucket. Swapping WETH back into USDC takes from the WETH outbound bucket and the USDC inbound bucket. Both must have room, or the swap reverts.

Because each direction has its own bucket, a vault can give moves towards cash, such as selling an asset back into USDC, more room than moves that add exposure, such as buying an asset. Moves towards cash are the ones a manager needs to pay withdrawals or to leave a position that is going wrong.

Withdrawals from a lending venue are never limited, so a strategy can always leave a venue. If a venue goes bad, its supply bucket can be lowered to zero, which stops new supplies while withdrawals keep working.

A holder's forced exit does not use these buckets. When it unwinds a position through the onchain account's modules, these limits do not hold it back.

The reported value of an attested sub-account has a limit of its own. A new value can only move within its deviation band in each window, which caps how fast that account's value can change.

Deposits and withdrawals

Deposits and withdrawals have no rate limit. Other settings bound them instead:

• The deposit cap limits the total a vault accepts, after withdrawals.
• The settlement batch size limits how many requests the settler can settle in one transaction.
• The minimum deposit and minimum withdrawal set the smallest request the vault accepts.

The levers

Closing a bucket to zero is the quickest way to stop one path, such as new supplies to a lending venue, while everything else keeps working. Setting a bucket to unlimited is only possible while its refill rate is zero.

See Timelocks for how long each tier waits, and Roles and profiles for who holds each role. In the Tango app, the limits are set when a strategy is deployed, and the app does not offer raising them afterwards. See Fixed configuration.