Shareholder
Own the position.
Holds vault shares and authorises a redemption directly or through an approved allowance.
Confidence starts
with clarity.
Know how capital moves, who holds the position and what the controls can do. Explore the architecture and the public security review.
A public review.
A traceable scope.
Read the findings, the fixes and the exact code behind the review. Hexens published its assessment of the automated interest rebalancing protocol in October 2025.
The published scope and remediation references give your engineering team a concrete place to start.
Open the complete report
Public security reviewOctober 2025 findings6 in total
2 MediumFixed
1 LowFixed
3 InformationalSee report
Every role
has a boundary.
Holding the position, allocating the capital and changing the configuration are distinct parts of the system.
Position ownershipWith the
shareholder.
shareholder.
Vault shares remain the ownership record as allocation changes underneath.
Executor
Manage allocation.
Moves assets between approved lending providers. Rebalancing changes the underlying allocation without reissuing customer shares.
Timelock
Control provider changes.
Changes to the provider list pass through the timelock, separating configuration changes from day-to-day allocation.
Administrator
Operate defined controls.
Manages vault parameters and separate pause controls for deposits and withdrawals. These permissions form part of the technical review.
The questions
behind the decision.
Start with the vault your customers will use: its code, assets, permissions and operating model.
What does the audit cover?
The October 2025 Hexens report covers the Thesauros automated interest rebalancing protocol at the referenced code version. It lists the scope, findings and remediation references.
How is the position represented?
The protocol uses ERC-4626 vault shares. These account for a proportional claim on the underlying assets; their value can change as the vault’s assets change.
What risks should a product team consider?
Smart contracts, lending markets, stablecoins and network conditions can affect value and liquidity. An audit helps assess a defined code scope; it does not guarantee returns or eliminate these risks.
What do we discuss before an integration?
The proposed vault and code version, supported assets, contract roles, deposits and withdrawals, fees, monitoring and responsibilities across the two teams.