Vault (DeFi)

Vault is a smart contract into which the user deposits funds and receives a “share” (vault-share-token); the contract autonomously runs a strategy: staking, CL position rebalancing, farming, leveraged lending.

Vault types on TON

• Staking vault (Tonstakers, bemo, Whales Pool) — user deposits TON, the vault spreads it across validators/nominators, returns yield via a liquid-staking token (tsTON, stTON, etc.).
• CL-management vault (TONCO range-managers) — user deposits USDT/USDC, the vault holds a concentrated position around the peg and rebalances.
• Yield aggregator vault — still early on TON; isolated experiments built on STON.fi/DeDust pairs.

Risks

• Smart-contract risk: a bug in the strategy = loss of funds.
• Manager-key risk: if the vault has a manager role without a timelock, the key-holder can drain the contract.
• Strategy risk: the strategy may work in normal conditions and break in edge cases (volatility, depeg).

How the share token works

A vault issues an ERC4626-like token (a jetton on TON). The price of one share grows as yield accrues:

shares = deposit_amount × total_supply / total_assets

A Tonstakers example: depositor adds 100 TON, the pool already holds 1_000_000 TON and 980_000 tsTON. They receive:

100 × 980_000 / 1_000_000 = 98 tsTON

A year later at 3.5% APR those 98 tsTON would redeem for roughly 103.5 TON — the gain shows up in the ratio, not in the number of tsTON. This is how vaults differ from rebase tokens (Lido’s stETH on Ethereum), where the balance changes and the ratio stays 1:1.

Withdrawal mechanics

Withdrawals from TON vaults are usually asynchronous:

1. Burn request. The user burns the share token; the vault registers an unstake claim with an lt number.
2. Cooldown. 36 hours to 18 days depending on the model (Tonstakers ~36 h from its liquid buffer, longer during a drawdown; bemo up to 2 epochs; Whales Pool tied to validator epochs).
3. Claim. A second transaction releases the TON freed by validator rotation or the scheduled anti-MEV window.

For users who can’t wait, there’s an instant swap via DEX (tsTON → TON on STON.fi), priced 0.1-0.5% below the on-chain ratio.

Concrete risks on TON

• Validator slashing. A staking vault routing into a weak validator set sees the ratio drop proportionally to the loss.
• Concentrated-liquidity drift. A TONCO range-manager vault sits in a tight $0.99-$1.01 USDT band. A sharp depeg moves the position “out of range” and it stops earning fees.
• Oracle risk. Vaults relying on price from a single DEX are exposed to flash-loan manipulation. Health check: does the vault use a TWAP or a multi-source oracle?
• Reward-token dump. If the vault earns in an auxiliary jetton (e.g. STON) and auto-sells it for TON, the sale price depends on liquidity — a large vault can “front-run itself”.

How to read a vault audit

The minimum scope an audit should cover:

1. Deploy permissions. Who can change the strategy? Is there a timelock?
2. Recoverable-funds path. What happens when a bug is found — can users withdraw through emergency mode?
3. Math precision. Is share rounding favourable to the user or the vault? What’s the minimum deposit before you round to zero?
4. Upgradeability. If the contract is upgradeable — who holds the upgrade key?

Without a public audit, a vault holding more than >$1M TVL carries a risk profile equivalent to a “partly-custodial team wallet”.

Related

• Liquid staking — the most mature vault category on TON.
• LP token — close cousin of the share token, minus the active strategy.
• Concentrated liquidity — the basis for range-management vaults.