YieldVaults EarlyAccess by holyfuchs · Pull Request #4 · onflow/flow-credit-markets

holyfuchs · 2026-04-17T08:34:29Z

Flow Yield Vaults — Early Access

Overview

Problem

During the launch phase, yield vault creation must be restricted to vetted participants. An open deployment would expose the protocol to malicious actors before the system has been stress-tested in production. Participants are semi-trusted — we can reasonably assume they will not behave maliciously.

Goal

Gate yield vault creation behind an allowlist curated by us. Each approved participant receives one EarlyAccessPass with an allowance — a fixed number of yield vaults they may create. One pass equals one participant; the allowance is the cap on how many vaults that participant can open. If a participant misbehaves, the admin revokes their pass, immediately blocking any further vault creation. This limits exposure in the event of a leaked capability: the blast radius is bounded by the allowance on that specific pass and the capital permitted per vault.

Lifetime

This is a temporary restriction. FlowYieldVaultsEarlyAccess is a thin wrapper over the core vault interfaces with no state in the underlying contracts. Removing early access requires updating the contract that implements FlowYieldVaultsInterfaces without the access(account) gate on fun createYieldVault. After that, vault creation is open to anyone — no pass and no allowance required. FlowYieldVaultsEarlyAccess remains deployed but becomes a dead entrypoint; existing passes are irrelevant since users will interact with the new open contract directly.

Check /docs for further information.

AlexHentschel · 2026-04-17T21:33:23Z

@holyfuchs I am still reading the PR (also using this as an opportunity to familiarize myself with Cadence a bit more). I noticed that the high-level design intent (identity-based gating, non-transferable permission, the wrapper pattern) isn't documented anywhere in the contract code. The spec covers the formal logic but the PR description's "How it works" narrative — which has actually been the most useful explanation for me — seems to be outdated (?). But most importantly, context you are providing to a reviewer in form of PR descriptions should be part of the implementation as well.

AI can create documentation, don't skimp on it. My recommendation

Each contract should contain a high-level documentation describing it's intend.
document in the code why it adheres to the specification
call out with comments security-critical aspect, even if redundant.

Of course you are dealing with very simple logic. But let's also use this as a learning opportunity and practise the patterns like documentation that we want to employ in more complex scenarios. Clearly documenting intend and logic is one of the most valuable approaches to reduce error probability in my opinion.

AlexHentschel

First round of feedback. Mainly focused on the spec

AlexHentschel · 2026-04-17T23:04:17Z

+
+### Primitives & Notation
+* **$E$**: The set of addresses with Early Access (the "Allowlist").
+* **$s$**: The transaction signer address.


Suggested change

* **$s$**: The transaction signer address.

* **$s$**: The transaction's signer address.

AlexHentschel · 2026-04-17T23:47:11Z

+* **$Cap(s, V)$**: A boolean representing if $s$ has a valid Cadence-level right to $V$ (meaning $s$ is the **Owner** OR holds a **Capability**).
+* **$op(s, V)$**: Signer $s$ attempting an operation (Deposit/Withdraw) on $V$.


this is rendered as Latex Code, and latex interprets $Cap$ as a product of $C \cdot a \cdot p$. This generates some odd type setting. I generally recommend to set function names or variable names as \texttt, which prints them in a mono-space typewriter font, which many people intuitively associate with shell functions.

Suggested change

* **$Cap(s, V)$**: A boolean representing if $s$ has a valid Cadence-level right to $V$ (meaning $s$ is the **Owner** OR holds a **Capability**).

* **$op(s, V)$**: Signer $s$ attempting an operation (Deposit/Withdraw) on $V$.

* **$\texttt{Cap}(s, V)$**: A boolean function representing if $s$ has a valid Cadence-level right to $V$ (meaning $s$ is the **Owner** OR holds a **Capability**).

* **$\texttt{op}(s, V)$**: Signer $s$ attempting an operation (Deposit/Withdraw) on $V$.

AlexHentschel · 2026-04-18T00:04:22Z

+
+---
+
+### Case Matrix


Who need to authorize the creation of a position is fundamentally different from who is allowed to modify a position (deposit / withdraw). You may conclude that we can handle both through the same mechanism, but at the moment, you are not even discussing this fundamental difference from a security perspective.

AlexHentschel · 2026-04-18T00:06:41Z

+| $op(B, V_1)$ | **Abort** | $s \notin E \wedge \neg Cap(B, V_1)$ |
+| $op(B, V_2)$ | **Abort** | $s \notin E$ |


you have introduced the symbols $A$ and $B$ to represent actors in this section. In contrast, $s$ has no specific role here in this section and should not appear here in my oppionion.

AlexHentschel · 2026-04-18T00:09:13Z

+* **Storage:** $E$ is represented by `map: {Address: Bool}`.
+* **Entry Point:** Checked via `fun protectedFunction(signer: &Account)`.


Here, you should be providing more detail. Follow up on the fact that creation of a position requires fundamentally different authority from who is allowed to modify a position (deposit / withdraw). In each case, describe how we intend to enforce in the implementation that only the correctly authorized party is successful.

Comment or describe APIs please - they are technically part of the spec and cannot be freely chose by the implementation (without impacting other components)

turbolent

Nice work Patrick!

turbolent · 2026-04-22T22:00:09Z

+            if FlowYieldVaultsEarlyAccess.checkPass(addr: addr) {
+                let pass = FlowYieldVaultsEarlyAccess.borrowPass(addr: addr)


Maybe just have borrowPass return an optional instead of panicing, and then checking is not needed here

turbolent · 2026-04-22T22:02:06Z

+        /// Address this pass was issued to; stamped at creation and never changes.
+        access(all) let addr: Address


I guess this address is purely informational for off-chain purposes? Is it actually needed off-chain?

turbolent · 2026-04-22T22:04:11Z

+    /// Returns whether a pass is currently held for the given address.
+    ///
+    /// **Parameters**
+    /// - `addr`: Recipient to check.
+    ///
+    /// **Returns** `true` if a pass exists for `addr`, `false` otherwise.
+    view access(all) fun passExists(addr: Address): Bool {
+        return self.checkPass(addr: addr)
+    }


This function seems redundant. However, passExists is IMHO better named than checkPass (makes me wonder: what does it "check"?). So maybe just inline checkPass here and switch all existing uses of checkPass to passExists

turbolent · 2026-04-22T22:06:38Z

+    }
+
+    access(self) fun loadPass(addr: Address): @EarlyAccessPass {
+        return <- (self.account.storage.load<@EarlyAccessPass>(from: self.passStoragePath(addr: addr)) ?? panic("Pass not found"))


Here for loading and below for borrowing: I'd just return an optional and have the caller decide how to handle non-existence.

turbolent · 2026-04-22T22:07:18Z

+    }
+
+    view access(self) fun passStoragePath(addr: Address): StoragePath {
+        return StoragePath(identifier: "FlowYieldVaultsEarlyAccessPass_\(addr.toString())")!


Not sure, but I think an Address can be used directly as a string template expression:

Suggested change

return StoragePath(identifier: "FlowYieldVaultsEarlyAccessPass_\(addr.toString())")!

return StoragePath(identifier: "FlowYieldVaultsEarlyAccessPass_\(addr)")!

turbolent · 2026-04-22T22:11:27Z

+| Term | Definition |
+| :--- | :--------- |
+| **Vault** (`YieldVault`) | A Cadence resource representing a yield-generating position. |
+| **Pass** (`EarlyAccessPass`) | A Cadence resource stored in contract account storage. Represents a grant of vault-creation rights. Never held by the user directly. Keyed by recipient address: each address has at most one pass at a time. |


Maybe note here in which account these are stored. Are they first stored in the contract account, then transferred to the participant?

jribbink · 2026-04-23T15:30:38Z

+    /// Storage path where pass capabilities are stored for claiming.
+    access(all) let passCapabilityStoragePath: StoragePath
+
+    /// Held in the holder's storage; gates yield vault creation during early access.


Suggested change

/// Held in the holder's storage; gates yield vault creation during early access.

/// Held in the admin's storage; capability granted to user; gates yield vault creation during early access.

holyfuchs requested a review from a team as a code owner April 17, 2026 08:34

holyfuchs marked this pull request as draft April 17, 2026 08:38

holyfuchs force-pushed the holyfuchs/early-access-impl branch 3 times, most recently from 91e5ba0 to dc4ef93 Compare April 17, 2026 09:41

holyfuchs changed the title ~~Add FlowYieldVaultsEarlyAccess allowlist gate for Yield Vaults~~ YieldVaults EarlyAccess Apr 17, 2026

holyfuchs marked this pull request as ready for review April 17, 2026 09:42

holyfuchs force-pushed the holyfuchs/early-access-impl branch from dc4ef93 to 5caf5a9 Compare April 17, 2026 10:08

holyfuchs marked this pull request as draft April 17, 2026 18:12

AlexHentschel reviewed Apr 18, 2026

View reviewed changes

holyfuchs added 5 commits April 18, 2026 17:20

Add FlowYieldVaultsInterfaces

f9eaf9b

update tests use new cli features

42d8b68

Add FlowYieldVaultsEarlyAccess spec

63dc888

Implement FlowYieldVaultsEarlyAccess allowlist gate with tests

dd7d1ac

simplify access to use capability

7d716e9

holyfuchs force-pushed the holyfuchs/early-access-impl branch from 7a280cf to 7d716e9 Compare April 18, 2026 20:45

add context to docs

2b7ac28

holyfuchs force-pushed the holyfuchs/early-access-impl branch from 8f2ab1b to 2b7ac28 Compare April 18, 2026 22:09

holyfuchs added 2 commits April 19, 2026 00:48

rename cap to capability

8c9de31

further docs clarifications

4869dd6

holyfuchs mentioned this pull request Apr 19, 2026

YieldVaults structure #8

Draft

jribbink reviewed Apr 20, 2026

View reviewed changes

Comment thread cadence/contracts/yield_vaults/FlowYieldVaultsInterfaces.cdc Outdated

jribbink reviewed Apr 20, 2026

View reviewed changes

Comment thread cadence/contracts/yield_vaults/FlowYieldVaultsEarlyAccess.cdc Outdated

jribbink reviewed Apr 20, 2026

View reviewed changes

Comment thread cadence/contracts/yield_vaults/FlowYieldVaultsEarlyAccess.cdc

jribbink reviewed Apr 20, 2026

View reviewed changes

Comment thread cadence/contracts/yield_vaults/FlowYieldVaultsInterfaces.cdc Outdated

holyfuchs added 2 commits April 20, 2026 10:53

remove FlowActionInterfaces

66d8b5b

Early access passes by address instead of UUID

216084b

holyfuchs marked this pull request as ready for review April 20, 2026 09:43

turbolent reviewed Apr 22, 2026

View reviewed changes

jribbink reviewed Apr 23, 2026

View reviewed changes

	* $s$: The transaction signer address.
	* $s$: The transaction's signer address.

		* $Cap(s, V)$: A boolean representing if $s$ has a valid Cadence-level right to $V$ (meaning $s$ is the Owner OR holds a Capability).
		* $op(s, V)$: Signer $s$ attempting an operation (Deposit/Withdraw) on $V$.

		\| $op(B, V_1)$ \| Abort \| $s \notin E \wedge \neg Cap(B, V_1)$ \|
		\| $op(B, V_2)$ \| Abort \| $s \notin E$ \|

		* Storage: $E$ is represented by `map: {Address: Bool}`.
		* Entry Point: Checked via `fun protectedFunction(signer: &Account)`.

		if FlowYieldVaultsEarlyAccess.checkPass(addr: addr) {
		let pass = FlowYieldVaultsEarlyAccess.borrowPass(addr: addr)

		/// Address this pass was issued to; stamped at creation and never changes.
		access(all) let addr: Address

	return StoragePath(identifier: "FlowYieldVaultsEarlyAccessPass_\(addr.toString())")!
	return StoragePath(identifier: "FlowYieldVaultsEarlyAccessPass_\(addr)")!

	/// Held in the holder's storage; gates yield vault creation during early access.
	/// Held in the admin's storage; capability granted to user; gates yield vault creation during early access.


		---

		### Case Matrix

Conversation

holyfuchs commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Flow Yield Vaults — Early Access

Overview

Problem

Goal

Lifetime

Check /docs for further information.

Uh oh!

AlexHentschel commented Apr 17, 2026

Uh oh!

AlexHentschel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

turbolent left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

holyfuchs commented Apr 17, 2026 •

edited

Loading