Operations and incident response

Routine checks

• Envio cursor advances and remains behind head only by configured finality.
• Every raw page exists and decompresses from R2.
• Held account positions reconcile directly from Vault reads and wallet NFT UTXOs; escrowed and historical D1 rows reconcile to exact contract state.
• Live O2 source, rolling price, sample count, and updater remain healthy.
• On-chain collateral covers all principal liabilities; strategies hold only penalties or other surplus.
• USDC reserves cover promised returns under the approved policy.
• Upcoming maturity and unbonding claims have sufficient liquid assets.

Admin panel

Connect the manager wallet at /admin to fund the USDC reserve, withdraw only unencumbered surplus, manage the strategy allowlist, deploy or return surplus FUEL and stFUEL, pause or resume the Vault, and transfer manager authority. Market controls support pause/resume, fee changes and withdrawals, market-owner transfer, and proxy-owner transfer.

Every action is a wallet-signed on-chain transaction. UI gating is only a convenience; contract authorization is definitive. Strategy returns send assets already held by the connected manager wallet back to the Vault. Protected principal and promised USDC cannot be deployed or withdrawn. The Vault tracks deployed totals per asset, not per-strategy balances or profit and loss.

Six-hour usage and health reports

fuel-vault-reporter runs at 0 */6 * * * and stores every report in a Durable Object. It combines authoritative indexed protocol statistics with aggregate app telemetry, mirrors accepted telemetry into Cloudflare Analytics Engine, and reports testnet and mainnet separately. Mainnet is shown as not configured until a mainnet stats API is supplied.

Reports include lifetime and rolling 24-hour position openings, claims, early exits, deposits, reserves, market activity, wallet connections, API success/failure counts, frontend errors, and transaction outcomes. No wallet addresses, transaction payloads, or error stacks are collected. App telemetry is observational; indexed on-chain events remain authoritative.

The latest stored report and service health are available at /v1/report and /v1/health on the reporter Worker. Telegram delivery remains pending_configuration until the Fuel Alerts bot values are installed:

wrangler secret put TELEGRAM_BOT_TOKEN --config wrangler.reporter.jsonc
wrangler secret put FUEL_ALERTS_CHAT_ID --config wrangler.reporter.jsonc
# Optional Telegram topic:
wrangler secret put FUEL_ALERTS_THREAD_ID --config wrangler.reporter.jsonc
# Optional protected manual-run endpoint:
wrangler secret put REPORT_TOKEN --config wrangler.reporter.jsonc

Pause triggers

Pause new activity for stale/divergent pricing, external updater failure, reconciliation failure, unexplained asset movement, strategy loss, reserve breach, or contract exploit indicators. Pausing is not a recovery mechanism and cannot confiscate NFTs.

Response

1. Pause affected contracts with the manager multisig.
2. Escalate to the oracle operator when source or updater integrity is uncertain.
3. Preserve Worker logs and R2 evidence.
4. Reconcile contract balances and liabilities at an exact block.
5. Publish scope, affected positions, and claim implications.
6. Rotate the manager through documented controls if required.
7. Resume only after independent review and a recorded multisig decision.

Never rewrite indexed evidence or silently replace an exact-block check with latest state.