100% non-custodial
Soroban 2-of-3 vault. The client holds the keys. Nirium can never move your funds. Period.
Three keys. Two signatures.
The vault is controlled by three keys — pause/unpause needs two of them. Every other critical operation is gated to one specific signer. The agent alone can never move funds.
Founder, CEO or primary decider
CTO, Operations or Admin
Legal, Board or external advisor
What requires 2-of-3 multisig
Automatic operations
The agent can execute without additional signature under preconfigured limits:
- Move idle capital in and out of the strategy, inside your own vault
- Up to the max_execution_amount the owner set when delegating
- Reports and queries (read-only)
Critical operations
These need a human signature outside the agent's automatic limits — who exactly signs depends on the operation:
- Any withdrawal — only the vault owner can sign it
- Cosigner changes — only the admin can sign it (bootstraps the 2-of-3 setup)
- Emergency pause / unpause — 2-of-3 multisig once cosigners are registered; admin-only until then
- Vault closure — only the vault owner can sign it
What Nirium CANNOT do
Not a legal disclaimer — a technical impossibility at the Soroban contract level.
Checked directly against the contract’s live exported interface below — not yet confirmed by an independent third-party audit.
The real contract
NiriumVault is deployed on Stellar Testnet and is verifiable.
CBTWMZCG3P72EHFAQ4ZLSEBIOFYJC244H5J6DHZIJ56FHFWJ2CFAWSZUd36eba5ce2b6e7fcc93064960321b6cedc7fdde28e02c7a8a60cc0eab0d529d3Fetched directly from the live testnet ledger and inspected: 29 exported functions, none named upgrade, migrate, or set_wasm. "Cannot modify code once deployed" is not asserted — it is absent from the bytecode itself, checkable by anyone with the Stellar CLI (stellar contract fetch --id CBTWMZCG3P72EHFAQ4ZLSEBIOFYJC244H5J6DHZIJ56FHFWJ2CFAWSZU --network testnet, then stellar contract info interface --wasm). Stellar Expert still shows this contract as "unverified" — that badge requires a separate reproducible-build submission we have not completed yet; this on-chain interface check is independent of it and does not depend on that badge.
Audit
Mainnet gate for the vault
Security Status
Non-custodial nodes (settlement, audit, reporting) run on mainnet without holding funds. Payouts also runs on mainnet, invite-only while legal review closes. The treasury vault has not yet undergone a formal third-party audit and remains testnet-only until one is completed.