The system is split across an Accounting Chain and one or more Earning Chains. The Accounting Chain is the source of truth for user balances, the system surplus, and withdrawal accounting. Earning Chains host yield strategies and periodically publish balance snapshots back to the Accounting Chain through a Chainlink-powered oracle feed. An off-chain system monitors protocol state and submits rebalance and bridge transactions.
Accounting Chain
The Accounting Chain handles deposits, withdrawal requests, share accounting, and surplus gating. For the Aave App, the Accounting Chain is Arbitrum.
The Stable Vault is the user entrypoint. It validates asset prices through the Price Oracle on each deposit, mints shares into the user's assigned SubVault, and manages the two-step withdrawal flow. On requestWithdrawal, shares are burned and IOU tokens are minted representing a denomination currency claim. The principal portion of a position is always redeemable as IOUs; the interest portion is gated by the system's trusted surplus. On executeWithdrawal, IOUs are burned, the Withdrawal Execution Policy applies any fees, and the user receives their chosen output asset. Share positions can be transferred between users via transfer and transferAll.
The Funds Handler sits between the Stable Vault and the Allocator. It aggregates the total price-weighted asset value across local balances and registered Earning Chains by querying the Chain Balance Oracle on demand for remote chain data. Stale Earning Chain data contributes zero to the aggregation, so the system conservatively underestimates its surplus rather than overstating it. This protects depositors by not inflating the global interest pool earned by the Stable Vault's assets.
The Allocator holds idle assets and executes rebalances. It maintains an approved list of ERC-4626 strategy contracts and handles swaps through a dedicated Swapper. Swaps enforce a nominal one-to-one exchange rate, with any slippage or venue fees covered by an external Slippage Coverage Vault rather than customer deposits. User deposits land idle on the Allocator and are allocated to strategies by the off-chain manager via rebalance(), so strategy-side issues such as supply cap breaches or paused markets do not block user deposits.
The Accounting Chain Gateway routes outbound funds and messages to Earning Chains and ingests inbound messages. It validates inbound message block numbers against the Chain Balance Oracle to preserve accounting integrity.
Earning Chains
Earning Chains (Ethereum mainnet initially) host yield strategies and the infrastructure needed to exchange IOUs for local assets and return funds to the Accounting Chain.
Funds and messages move between the Accounting Chain and Earning Chains through multiple bridge providers, such as CCIP, LayerZero, Hyperlane, and Across, as well as potentially others, as long as their usage follows the protocol's security requirements.
The Earning Chain Gateway handles inbound bridge messages, exchanges IOU tokens for local assets against available liquidity, and pushes funds back to the Accounting Chain when needed. It computes price-weighted local balances using the same aggregation logic as the Funds Handler.
The Earning Chain State Provider exposes the local price-weighted balance in an encoded format that Chainlink operators read and publish to the Accounting Chain via the Chain Balance Oracle. Feed updates are triggered by specific on-chain events such as funds received or sent and asset trust status changes, by a configured deviation threshold, and by a fixed heartbeat interval. The Accounting Chain treats data older than the configured staleness threshold as zero, keeping the surplus accounting conservative.
Roles & Access Controls
The protocol separates configuration authority from operational authority through a role hierarchy. Higher roles define the boundaries; lower roles operate within them.
Integrators hold the broadest authority. They configure the total trusted surface of the vault:
Assets: which stablecoins can be deposited, swapped, or used as withdrawal outputs (via the Asset Registry)
Yield strategies: which ERC-4626 adapters are approved on the Allocator (e.g. Aave v4 markets, sGHO, or any other compliant vault)
Bridges: which cross-chain bridge contracts are permitted for moving funds between the Accounting Chain and Earning Chains
These allowlists are additive: a manager can never access a strategy, asset, or bridge that the integrator has not explicitly approved.
Managers operate within whatever the integrator has configured. A manager can:
Call rebalance() to shift allocations between approved yield strategies
Initiate bridge transfers to/from approved Earning Chains
Adjust yield allocations in response to changing market conditions
Managers cannot modify the allowlists or claim protocol revenue, those actions are reserved for the integrator role.
This separation means a fintech deploying a vault can lock down protocol-level risk (which counterparties are trusted, which assets move) while safely delegating routine yield operations to an automated off-chain system or third-party manager without exposing configuration authority.