Price is a lagging signal, so every automated defence in DeFi fires after the damage. RIPCORD fires on the transaction that causes the damage, before it executes — and the chain re-checks the trigger itself before a single lamport moves.
Four states, in the order they actually happened on devnet. The panel is the vault’s recorded state at each step.
The owner arms a policy against a deployed program. The baseline upgrade authority is read by the program, from the chain — not handed to it by the keeper. Both sides of the later comparison are the chain’s own.
The keeper proposes an exit. The program re-reads the authority, finds it unchanged, and aborts. The keeper was wrong, or lying, or compromised — it never mattered which. No transaction, no movement.
The upgrade authority is genuinely transferred, with the ordinary loader instruction any team would use. This is the real trigger, fired against a program we deployed and say out loud that we own.
The identical exit is proposed again. This time the chain agrees, and the funds go to the owner — the only address they can ever go to. Same transaction as step 02; one fact apart.
Same guardian, same signature scheme, same destination, same amount, same policy. Run on devnet on 20 September 2026. The only thing that changed between them was a fact on chain — and the program read that fact itself.
The keeper proposed an exit. The program re-read the target’s upgrade authority, found it unchanged, and aborted. No transaction, no movement. The keeper was wrong, or lying, or compromised — it did not matter which.
The program’s upgrade authority was genuinely transferred with the ordinary loader instruction. The identical exit was then proposed again, the chain agreed, and the funds went to the owner — the only address they can ever go to.
Every signature below is real. Open them.
With the predicate genuinely true, an exit aimed at a third party was refused as well. The guardian never names the destination; it is the owner recorded in the vault, enforced by the program.
execute_exit does not accept an assertion that a policy fired. It accepts evidence, and re-evaluates the predicate on-chain against live state. The keeper degrades from a trusted actor to an untrusted relayer.
This is the answer to Summer.fi’s automated vaults losing $6M in July.
The destination is not a parameter. It is the owner recorded in the vault, so a fully compromised guardian can neither redirect nor spend. Revocation is one transaction, with no delay and no quorum.
Proven by a test against the compiled program, and again on devnet.
The same policy code reads historical transactions, confirmed transactions, and pre-execution simulated ones. The backtest is not a separate codebase written to impress anyone — it is the production engine on a different input.
37 tests across the workspace.
Not one of them moves a depositor’s funds. So depositors do it by hand, badly, at the worst possible moment — or they do not get the chance at all.
$130M+
marginfi, April 2024
Withdrawn in 24 hours after the CEO resigned. No hack, no exploit. Humans racing for the exit.
$285M
Drift, April 2026
Drained over roughly two and a half hours. Depositors never got to run: withdrawals were paused.
9,372
Kamino, October 2025
Liquidations across 1,895 wallets, seizing $25.5M of collateral.
Stated here rather than discovered in Q&A.