Executive summary

RockawayX has partnered with Tori Finance and Upshift to launch a curated stablecoin yield vault on Ethereum mainnet, the RockawayX Tori Ecosystem Vault. Phase 1 is a predeposit vault that converts depositor stablecoins into Tori's trUSD and stakes them into strUSD, harvesting Tori's institutional delta-neutral yield. Phase 2 transitions the same vault contract into a multi-strategy ecosystem allocation across Curve, Pendle, and looping overlays, without requiring any depositor migration.

This document explains, in plain terms, why we believe Tori is one of the better-positioned synthetic-dollar issuers to come out of the post-Ethena generation; what risks depositors take on by holding the vault's LP token (etrUSD); and the risk framework RockawayX applies to underwrite and continuously monitor those exposures.

What you should take away

Yield comes from Tori's institutional trading desk (money markets and pure arbitrage), not from token incentives, basis-trade funding rates, or credit. The vault inherits Tori's protocol-level risks, layered on top of Upshift's vault contracts and RockawayX's allocation decisions. We mitigate these through independent monitoring, hard concentration limits, and curator-as-signaller (not custodian) operational design.

Why we curate this vault

The setup

Most stablecoin yield available on-chain today is one of three things: a tokenized T-bill capped at ~4%; a basis-trade synthetic dollar capturing perp funding (4-6% variable, with periods of negative carry and high correlation to crypto volatility cycles); or a credit-market protocol exposed to borrower default risk. Each has a place, but each carries the trade-offs you would expect from being a single-strategy vehicle.

Tori takes a different approach. It brings on-chain a portfolio of market-neutral strategies that institutional trading desks have run for decades. Money market positioning across global jurisdictions, typically the largest allocation, is paired with classical arbitrage (cash-and-carry futures spreads, calendar spreads) and other delta-neutral overlays. The composite return is structurally less correlated to crypto market beta and to any single funding source than what most DeFi yield aggregators offer.

Why the team and structure matter

Synthetic-dollar protocols stand or fall on the operating discipline of whoever runs the underlying portfolio. Tori's founding team comes from quantitative trading and structured products, and the protocol is backed by Delphi Ventures with additional support from ScaleX Ventures and QInvest. The technical stack (Sherlock and Nethermind audits, Hypernative real-time monitoring, Accountable proof-of-solvency) reflects the same standards we look for when underwriting any new issuer.

The protocol separates concerns cleanly. trUSD is a swap-anytime synthetic dollar fully backed by trading positions. strUSD is the yield-bearing wrapper that accumulates returns through an exchange-rate accrual. Off-chain assets are held by qualified institutional custodians in segregated accounts. On-chain assets sit in audited smart contracts with multi-signature controls.

Why now, and why a curated vault

Tori has chosen to launch with a curator-led distribution model rather than building its own end-user wrappers. A curated vault gives depositors three things that direct interaction with strUSD does not: a single LP token (etrUSD) that abstracts the conversion, staking, and (in Phase 2) re-deployment steps; a non-custodial vault contract with independent governance separated from the issuer; and an active risk manager monitoring the position on a continuous basis.

In short, depositors get access to Tori's yield without taking on the operational complexity of managing the position themselves, and with an additional layer of risk oversight sitting between them and the underlying protocol.

What this vault is not

This is not a leveraged or yield-optimized product. There is no token farming or recursive looping during the predeposit phase. The yield is the underlying strUSD yield, net of (waived) fees. Phase 2 introduces additional sources of yield through DEX LP and Pendle PT strategies, but always within explicit concentration and leverage limits described later in this document.

Tori Finance protocol overview

trUSD

trUSD is Tori's base synthetic dollar. Users mint it by swapping USDC or USDT through Tori's interface, receiving trUSD at par. The peg is maintained by full backing of the circulating supply. Every trUSD outstanding is matched by reserves held either on-chain (in audited smart contracts) or off-chain (with qualified institutional custodians in segregated accounts). trUSD itself does not accrue yield. It is the redeemable, transferable unit of account.

Unlike fiat-backed stablecoins, trUSD's reserves are not 1:1 fiat dollars sitting in a single banking partner. They are working capital deployed into Tori's strategy book. This is the trade-off behind the higher yield. trUSD is a synthetic dollar, and its peg depends on the value of the strategy book remaining at or above par. Tori publishes a real-time proof-of-reserves through Accountable for independent verification.

strUSD

strUSD is the yield-bearing wrapper. Users stake trUSD 1:1 to mint strUSD; yield generated by Tori's strategies accrues by increasing the strUSD-to-trUSD exchange rate over time, rather than by rebasing the token supply. This makes strUSD composable across DeFi without breaking integrations that expect a fixed-supply ERC-20.

Unstaking strUSD back to trUSD requires a seven-day cooldown. This cooldown exists to give Tori an orderly window to reconcile off-chain positions and avoid forced liquidation of underlying trades. From this vault's perspective, the cooldown is one of the key liquidity parameters we underwrite. The vault is sized so that expected redemption flows can be served from on-chain inventory or scheduled unstaking, without relying on the instant-redeem buffer being inexhaustible.

The yield engine

Tori's public documentation identifies three primary strategy buckets:

• Money markets. Short-duration interest-rate instruments accessed across multiple jurisdictions. This is the largest allocation. Returns come from a combination of base rates and the spread between USD funding and local-currency money-market rates, with the currency leg hedged back to USD. Selected emerging-market money markets feature here because of the persistent positive carry that has historically been difficult for non-institutional players to access.
• Futures arbitrage. Classical cash-and-carry trades. When a futures contract trades at a premium to spot, the spread can be locked in as yield. This is the oldest arbitrage strategy in finance and is delta-neutral by construction.
• Calendar spreads. Trades that capture mispricings between contract expiries on the same underlying. Returns come from the relative pricing of different-tenor contracts rather than from market direction.

Returns from each strategy are accrued into the strUSD exchange rate. The portfolio's blended yield therefore varies with market conditions, but it is structurally insulated from outright price direction in any single underlying.

Security stack

Tori's smart contracts are audited by Sherlock and Nethermind. An ongoing bug-bounty program complements the formal audits. Real-time threat detection is provided by Hypernative, which monitors for anomalies in on-chain state and flags them to the protocol's response team. Independent proof-of-reserves is provided by Accountable, which attests to the match between on-chain liabilities and the combined on-chain and off-chain reserve set.

From RockawayX's perspective, this stack is necessary but not sufficient. Audits and monitoring catch a defined class of failures, while economic and operational risks (peg stress, custodian behavior, FX hedge mismatches) sit outside their scope. The risk framework described later in this document is what fills that gap.

Risk landscape: what depositors are exposed to

We have organized the risks below in roughly the order in which they would materialize in a stress scenario. None of them are unique to this vault; what is unique is the combination, and the mitigants we apply to each.

1. Strategy yield risk

Tori's strategies are market-neutral, not market-immune. Money-market spreads compress and widen with global rate cycles. Cash-and-carry basis can flip from positive to negative when futures trade below spot. Calendar-spread opportunities depend on the term structure being mispriced. In any given month, the realized yield can be materially below the headline target, and in stressed conditions can be flat or briefly negative.

Mitigant: diversified strategy mix means no single bucket dictates the headline yield. The vault's economic terms (no fees during Phase 1; high-watermark on performance fees in Phase 2) align the curator with realised, not advertised, yield.

2. Custody and counterparty risk

Off-chain positions are held by qualified institutional custodians and executed through trading counterparties (banks, brokers, prime brokers). Failure of any of these (fraud, insolvency, operational disruption) would be borne by the underlying reserves and therefore by every holder of trUSD and strUSD.

Mitigant: RockawayX has independent, read-only access to custody wallet balances, broker account positions, and proof-of-reserve attestations. These feeds are provisioned through channels that do not route through Tori's operational team, providing an independent verification path. Counterparty concentration is reported on a recurring basis and reviewed against policy bands.

3. Smart contract risk

Three layers of smart contracts are in scope: Tori's minting and staking contracts; Upshift's vault contracts and, in Phase 2, the underlying DeFi protocols the vault allocates to (Curve, Pendle). A critical bug in any of these can result in partial or total loss of deposited assets.

Mitigant: Tori's contracts are audited by Sherlock and Nethermind with an ongoing bug bounty. Upshift's vault contracts are also audited and have been deployed across multiple production vaults. Phase 2 protocol integrations are pre-vetted against the same five-dimensional framework we apply to every protocol we underwrite (see Risk framework below). All material vault parameter changes pass through a 24-hour timelock.

4. Oracle and valuation risk

The vault's net asset value depends on the strUSD-to-trUSD exchange rate, the proof-of-reserves attestations, and, in Phase 2, the price oracles used by Curve pools and Pendle markets. A failure, manipulation, or stale read of any of these can mispricing redemptions, fee accruals, or rebalancing decisions.

Mitigant: the vault uses Tori's primary oracle with a defined fallback methodology specified in the vault policy. Proof-of-reserves is independently sampled by RockawayX rather than relying on Tori's reported figures. Phase 2 oracle dependencies are reviewed before any allocation is added to the whitelist.

5. Peg and liquidity risk

Synthetic dollars trade at a soft peg, not a hard one. trUSD's value is supported by full backing, but its market price on DEXs can deviate during periods of redemption pressure or external shock. A widened peg is itself a non-fatal event (Tori's minting and redemption mechanism is designed to absorb it) but it can affect the realized exit price for depositors who choose to exit through DEX swap rather than through the vault's redemption queue.

Mitigant: in Phase 2, the vault allocates to Curve trUSD-USDC and strUSD-trUSD pools, which both deepens the on-chain liquidity for the asset and earns the vault swap fees. Pool depth thresholds and peg-deviation triggers are explicit unwind conditions for the looping overlay. The 24-hour timelock on policy changes provides a buffer for orderly response to any deviation.

6. FX hedge and rollover risk

Where Tori's money-market positions are denominated in a currency other than USD, the FX exposure is hedged back to USD through forward contracts. This hedge has a cost, a tenor, and a roll schedule. If the hedge cost rises faster than the underlying yield (carry compression), or if the hedge tenor and the position tenor become mismatched at a rollover point, net yield can fall meaningfully or briefly turn negative.

Mitigant: RockawayX receives daily FX hedge data (forward curve, hedge ratio, annualized cost, net carry spread, upcoming roll schedule) along with Tori's internal escalation thresholds for carry-compression events. This feed is part of our policy-band monitoring and triggers a review if any threshold is breached.

7. Phase transition risk

The vault transitions automatically from Phase 1 (single-strategy strUSD staking) to Phase 2 (multi-strategy) when defined readiness criteria are met. A premature transition exposes depositors to strategy components that may not yet have adequate on-chain liquidity. A delayed transition leaves capital underdeployed.

Mitigant: the transition is gated by explicit, jointly-assessed criteria (predeposit TVL milestone, minimum depth thresholds on the Curve pools, Pendle market maturity, and Tori roadmap alignment) with a calendar fallback. Once those gates are cleared, the strategy update is executed through the same governance and timelock controls as any other material change.

8. Regulatory and jurisdictional risk

trUSD is a synthetic dollar, which is a distinct product category from fiat-backed stablecoins and is regulated differently across jurisdictions. The applicable rules in any given country may change, and depositors are responsible for understanding their own jurisdiction's treatment of synthetic-dollar holdings and on-chain yield.

Mitigant: this is a risk depositors bear directly. We flag it explicitly here, and Tori publishes its own risk disclosures and terms of service that depositors should review before using either product.

How RockawayX manages risk on this vault

RockawayX has been an active liquidity provider across DeFi for over five years. The same risk framework we apply to our own balance-sheet positions, and to other curated vaults including the RockawayX ListaDAO Vault on BNB Chain, underpins this vault. The framework has four pillars: structural design, position underwriting, independent monitoring, and governance discipline.

Pillar 1: Structural design

Curator as signaller, not custodian

RockawayX has no custody of vault assets and no unilateral authority to execute transactions. We submit strategy signals (proposed allocations or rebalances) to the vault's policy mechanism. Each signal is checked against the active vault policy and is approved or rejected by the vault's governance, not by us. We hold no recovery keys and cannot override or bypass the policy.

This is the single most important structural feature of the vault. Curator misbehavior, willful or accidental, is bounded by what the policy allows. Depositor recourse runs through the vault contract and its governance, not through trust in any individual operator.

Multisig and timelock

All material vault parameter changes are executed by a 4-of-6 multisig with signers from RockawayX, Tori, and Upshift. Approved changes then pass through a 24-hour timelock before taking effect, giving depositors a window to react. The timelock is non-overridable and applies symmetrically to upgrades, fee changes, and policy modifications.

Pillar 2: Position underwriting

The five-dimensional framework

Every underlying position (Tori itself, every DeFi protocol the vault interacts with in Phase 2, every collateral asset) is scored across five dimensions before being whitelisted:

• Token maturity. How long the asset has been live, its trading history, and any prior incidents.
• Audit history. Number, recency, and quality of independent security audits, plus any known vulnerabilities and their remediation.
• DEX liquidity depth. Realised liquidity available for exit at relevant size, not headline TVL.
• Oracle reliability. The price feeds the position depends on, their fallback behavior, and their resilience to manipulation.
• Governance structure. Who controls upgradeability, what timelocks apply, and how concentrated voting power is.

Positions that don't clear the bar are not added to the whitelist. Positions already on the whitelist are re-scored continuously. A deterioration on any dimension can trigger a reduction or unwind.

Concentration caps and leverage discipline

No single market or counterparty exceeds defined exposure limits. The Phase 2 strategy mix is allocated within explicit policy bands (Curve LP, Pendle LP, strUSD staking, and the looping overlay each have target ranges, not single-point allocations). The looping overlay is conservatively governed. It is deployed only when the spread between strategy APY and borrow cost exceeds a defined net threshold, runs to a defined maximum effective leverage, maintains a health factor buffer above 1.5×, and unwinds automatically on any of borrow-cost-exceeds-yield, peg deviation, liquidity-depth breach, or manual risk override.

Pillar 3: Independent monitoring

The vault is monitored through data feeds that RockawayX accesses independently, not via Tori's operational pipeline. This is a deliberate design choice. An independent verification channel is how a curator catches issues before the issuer reports them.

Concretely, monitoring scope includes:

• On-chain contract events: mints, burns, supply, exchange-rate accruals, multisig submissions, timelock queued actions, and cross-chain transfers.
• MPC and custody-wallet flows: real-time visibility into balances and movements between on-chain and off-chain inventory.
• Off-chain position data: daily position reports from each custodian, broker, and banking counterparty, delivered through channels that do not route through the partner's operational team.
• Proof-of-reserves: real-time NAV feeds with anomaly alerts, reconciled against broker balances and on-chain strUSD rates.
• FX hedge data: forward curve, hedge ratio, hedge cost, net carry spread, and upcoming roll schedule on a daily cadence.
• DEX peg and depth: trUSD and strUSD pool prices, depth, and slippage curves.

Findings from this monitoring feed back into the underwriting process. A deterioration in any monitored series can trigger a policy review, a concentration reduction, or, in the limit, an exit signal.

Pillar 4: Governance discipline

The discipline that ties the other three pillars together is procedural. All material decisions are made against the active vault policy; the policy itself is changed only through the multisig-plus-timelock process; every change is logged on-chain. Curator recommendations are non-binding until ratified. There is no out-of-band override path.

For depositors, the practical consequence is that the vault's behavior is predictable and auditable. The set of things that can happen to your deposit is defined in advance by the policy, and the path to change that policy is visible and time-delayed.

Phase transition and operational governance

Predeposit (Phase 1)

During Phase 1, deposits are routed into trUSD (if not already in trUSD) and staked into strUSD. The vault holds a single position. Fees are waived. Scheduled redemptions are paused: depositors commit capital until phase transition (target duration ~30 days). The lock-up exists to give the vault a stable capital base to bootstrap Phase 2 allocations without forced exits, and it expires automatically at transition.

Weekly light-touch reporting is delivered during Phase 1. The vault's on-chain state (composition, exchange rate, fee accrual) is publicly visible at all times via the Upshift dashboard.

Phase transition criteria

Transition from Phase 1 to Phase 2 is jointly assessed against five criteria:

If the criteria are not met by the calendar fallback, the transition is reviewed by the multisig and either deferred (with the lock-up extended) or proceeds with reduced Phase 2 allocations. Either path requires the same 24-hour timelock.

Ecosystem vault (Phase 2)

Phase 2 deploys capital across a multi-strategy allocation. Indicative targets are:

Allocations are indicative and subject to active rebalancing within policy bands. The blended target real APY is approximately 14%; realized returns vary with market conditions, emission schedules, and pool utilization.

A conservative looping overlay may be deployed when the spread between strategy APY and borrow cost is sufficiently wide. Its parameters (activation threshold, maximum leverage, liquidation buffer, unwind triggers) are pre-defined and described in the vault policy.

Governance, signers, and contract control

The vault contract is owned by a Proxy Admin under the control of a 4-of-6 multisig with signers drawn from RockawayX, Tori Finance, and Upshift. Material parameter changes (fee changes, allocation policy updates, contract upgrades) pass through a 24-hour timelock. The curator (RockawayX) has signal authority only and is not a signer on the proxy admin.

Independent depositor-facing reporting is available through the Upshift vault dashboard (real-time composition, historical APY, fee accrual) and through Tori's proof-of-reserves portal (reserve composition and attestations).

Why RockawayX

RockawayX is an active liquidity provider across DeFi with a track record built around underwriting and market-neutral strategies. The relevant facts for prospective depositors:

• Five+ years of continuous operation as a DeFi liquidity provider.
• Market-neutral by default. Our own balance-sheet strategies center on basis, lending, and arbitrage, not directional bets.
• No defaults across the lending book since inception.
• Double-digit annual returns delivered since our first full year.
• Track record of curating other partner vaults, notably the RockawayX ListaDAO Vault on BNB Chain, using the same risk framework that underpins this vault.

We are vault-provider agnostic. Upshift was selected for this vault based on chain (Ethereum mainnet), product fit (ERC-4626), and operational track record. The framework applies regardless of vault infrastructure.

What depositors should know before depositing

This is a stablecoin yield product, not a deposit account. The following are not exhaustive and should be read alongside Tori's own risk disclosures and Upshift's vault documentation.

• Yield is variable. Headline targets are not guarantees, and there will be months where the realized yield is below target.
• trUSD is a synthetic dollar, not a fiat-backed stablecoin. Its peg is supported by full backing, not by 1:1 fiat reserves at a single banking partner.
• Phase 1 deposits are locked until phase transition. Plan capital accordingly.
• Smart contract risk is real. Audits and monitoring reduce but do not eliminate it.
• Regulatory treatment of synthetic dollars and on-chain yield varies by jurisdiction. You are responsible for understanding your own situation.
• RockawayX is a curator, not a custodian. We do not hold your funds and cannot recover them in the event of a smart contract failure outside our control.

Open communication

We treat this thesis as a living document. As Tori's protocol evolves, as Phase 2 strategies are activated, and as the risk landscape changes, this document will be updated. If anything in here is unclear, or if you want to discuss a specific risk in more detail, reach out at contact@rockawayx.com.

Resources

Tori Finance: tori.finance  ·  docs.tori.finance

Tori risk disclosures: docs.tori.finance/resources/risks

Upshift: upshift.finance

RockawayX: rockawayx.com  ·  @Rockaway_X

Disclaimer

This document is for information purposes only. It does not constitute investment, legal, tax, or financial advice. The descriptions of vault parameters, fees, strategies, and risks are accurate as of the document version date and may change. Yield targets are forward-looking and not guarantees. Depositors should conduct their own due diligence and consult independent advisors before depositing. RockawayX, Tori Finance, and Upshift make no representations or warranties as to the suitability of this product for any particular user or jurisdiction.