The keeper
The keeper is an off-chain bot that does the boring work: harvesting interest and trading drift back to target. Allocating a deposit is no longer part of its job — a deposit does that itself, in the transaction that mints your shares — so nothing you put in is waiting on a bot to start earning.
It is still the part of the system most worth being paranoid about, so it is the part with the tightest leash.
What it can do
- Harvest accrued lending interest back into the vault.
- Trade toward the target split when drift crosses the band.
What it cannot do
- Send funds to any address of its choosing.
- Trade into an asset that is not on the allowlist.
- Exceed the per-transaction size cap or the slippage cap.
- Act on a stale oracle price, or act again before the cooldown expires.
- Change the target split, the fee, or any of the limits above.
The worst case if the keeper key is stolen is bounded: an attacker can waste value inside the slippage and size caps. They cannot walk off with the principal, because no code path lets them.