How Autopilot works
Autopilot is the program that runs the vault. Every 15 minutes it reads the vault and every place the vault may lend to, then decides whether to move money.
The rules
Autopilot spreads the vault across the places that pay the most, inside these limits:
| Rule | Limit |
|---|---|
| Ready cash for instant withdrawals | 3% of savings |
| Most in one place | 40% |
| Most with one protocol, such as Morpho | 40% |
| Smallest position | 10% |
| Most places at once | 6 |
| Most of any one place's deposits | 10% |
| When it moves money | Only when that earns at least 0.1% more a year |
A place's rate falls as more money joins it, because lenders share the same interest. So Autopilot adds each next dollar where it earns the most, and stops when the limits are reached.
The rules live in code. Changing them, or adding a place, waits 48 hours in public through the timelock.
How it measures rates
- Lending vaults, such as Steakhouse or Gauntlet on Morpho, by how much their share value grew over the last three days, as a yearly rate.
- Morpho markets, by their current supply rate.
The rates in the app are after Autopilot's 10% fee. The vault's own rate is the average of its places, weighted by the money in each. Ready cash earns nothing, so it pulls the average down a little.
The share price
Each pass, Autopilot publishes the vault's share price: what one obUSD is worth in USDC. Two guards protect it.
- The price can move at most 0.1% from a daily anchor, so a wrong price can't be pushed through in one step.
- If no price arrives for an hour, the vault stops deposits and withdrawals until a fresh one does. Nobody can deposit or withdraw at a stale price.
When it pauses
Autopilot pauses the vault only on evidence of loss: a value below the allowed band, insolvency, a place it can't value, or a price the vault rejects. A second read at a later block must agree first. A network fault never pauses the vault; Autopilot retries. The Safe resumes the vault once the cause is clear.
What Autopilot can't do
Autopilot holds two keys with narrow powers. It can move money between the listed places, pay queued withdrawals, publish the price within its band, and pause. It can't send money anywhere else.
The vault calls lending places only through fixed adapters. Each adapter does one job and always returns money to the vault. How the vault is secured.