The Treasury Node on Mainnet: Don't Trust Us, Verify the Contract

Most "non-custodial" claims in this industry are a policy: a team says it won't move your funds, and you decide whether to believe them. Ours is a constraint enforced by a smart contract we don't control. This post walks through one real transaction that proves it, and what that proof is worth to everyone standing near it — DeFindex, Etherfuse, OtterSec, the Stellar ecosystem, the people who'd eventually trust an agent with real money, and Nirium itself.

Nothing here is a summary you have to take on faith. Every hash, contract address, and line of code below is a link — go check it.

The fact, in plain terms

On August 6, 2026 at 00:56:39 UTC, an address controlled by Nirium's agent called `rebalance()` on a live DeFindex vault on Stellar mainnet, with an `Invest` instruction, moving 1.0 CETES from the vault's idle balance into DeFindex's Etherfuse strategy. No human clicked anything. Transaction:

The address that signed this specific transaction has since rotated to a new key — routine operational hygiene, not a scandal. The vault's current RebalanceManager is itself a public, on-chain fact, readable by anyone by calling the vault's own `get_rebalance_manager()` view function — nothing about who holds this role is hidden behind our word.

Here's the part that actually matters: this isn't a policy Nirium chose to follow. It's what the vault contract's own code allows the RebalanceManager role to do, full stop. `rebalance()` accepts exactly two instructions that move value — `Unwind` and `Invest` — and neither takes a destination address as an argument. `Unwind` hardcodes the destination to `e.current_contract_address()`, the vault itself; `Invest` has no destination parameter at all, funds only ever move into a strategy the vault already trusts. Withdrawing to an arbitrary address isn't blocked by a check somewhere — there's no code path that accepts one. Every other real capability — pausing a strategy, rescuing funds, changing which address holds a role — belongs to the Manager, a role Nirium's agent does not hold.

Why this matters, beyond this one transaction

"We don't custody your funds" is the most common sentence in DeFi, and by itself it's worth nothing — it's exactly what a team about to run off with your money would also say. What changes the calculus isn't the sentence, it's whether the claim is checkable by someone with no reason to trust you. A contract's source code is checkable. A team's intentions are not.

That's the actual shift this transaction demonstrates: from "trust us" to "here's the code, here's the transaction, go verify both yourself." Nirium doesn't hold the role that could take custody even if we wanted to — DeFindex's Manager role does, and on this vault, that role belongs to the vault's owner, not to us. The agent proposes and executes rebalancing; it structurally cannot walk away with the money.

What this means, actor by actor

This isn't one story — it's a different, specific claim for each party near it, and none of them are ours to make unilaterally. Here's what each one can actually check.

One more thing, for completeness: converting USDC to CETES in this flow touches three separate regulatory regimes, not one — Circle (USDC's issuer) holds a full MiCA license in the EU and multiple licenses in the US, but no direct Banxico/CNBV authorization to operate in Mexico; Etherfuse operates under its own Mexican no-action relief and Swiss registration, also without being a licensed Mexican bank. Neither is doing anything improper — this is simply the real map of who regulates what, without flattening it.

Go check it

Every link above resolves to something you don't have to take our word for — a live block explorer, a public GitHub repository, a documentation page DeFindex controls, not us. Decode the transaction. Read the contract. If something here doesn't hold up the way this post says it does, that's worth knowing — for you and for us.