> For the complete documentation index, see [llms.txt](https://docs.dittonetwork.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dittonetwork.io/ditto-earn/yield-split-vault/architecture.md).

# Architecture

The system operates on a trust-minimized architecture separating **Decision Making** from **Execution**:

1. **Ditto Keeper (Off-chain)**: Watches yield opportunities across the connected protocols and proposes a new allocation.
2. **APR Oracle (On-chain)**: Snapshots realized APRs from underlying protocols to prevent manipulation.
3. **Rebalance execution (On-chain)**: The vault's own keeper-gated `executeRebalance` applies a proposed allocation. It only goes through if the on-chain estimator scores the new allocation above the current one by a configured margin, and a cooldown applies between rebalances.
4. **Vault (ERC-4626)**: Atomically executes deposits/withdrawals across strategies.

#### Security Measures

* **Non-Custodial**: User funds are held in the smart contract, never by Ditto or the integrator.
* **Atomic Execution**: Rebalances happen in a single transaction.
* **Slippage Protection**: The vault snapshots Total Value Locked (TVL) before and after every rebalance.
* **Reward Debt Model**: Protocol fees are minted exclusively from yield. The principal deposit is never touched.
* **Fail-closed guards**: A price guard and a protocol blocklist guard must hold fresh state. If that state goes stale, or a guard reports a problem, deposits and rebalances are blocked. Withdrawals are never gated by the guards.

<figure><img src="https://258555021-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0oqis4JDhDSIVRhBEmPf%2Fuploads%2FwAnEN3PYJuZOOTmglAj9%2FScreenshot%202025-12-05%20at%2011.43.36.png?alt=media&amp;token=1d0810ec-eb70-4aed-831f-9834e9536d15" alt=""><figcaption></figcaption></figure>