How Does Royco Protocol Work?

Per-market isolated tranche vaults — each yield source is siloed with its own Accountant, coverage parameters and tranche accounting

Isolation limits contagion between markets and follows the established isolated-market pattern used by Euler v2 and Morpho. Six live markets observed as of mid-2026.

Perpetual Senior/Junior tranching with a coverage ratio and beta = 1 co-investment; Junior absorbs losses from the first dollar until exhausted

Risk tranching itself has DeFi precedent (BarnBridge SMART Yield, Idle Perpetual Yield Tranches, Saffron), but the perpetual co-invested form where leverage is a direct function of the coverage ratio has no widely replicated production precedent. No taxonomy leaf exists for tranching — automatic novelty signal.

Observation Period window before loss allocation, plus a Protected Exit Threshold letting Senior withdraw in the underlying asset

Temporary drawdowns that reverse inside the window do not slash Junior capital. The docs do not publish the window duration, which is the parameter that determines whether the deferral protects Junior or merely delays recognition.

Senior Liquidity Provider (SLP) tranche supplying secondary liquidity, paid a premium by Senior alongside the premium Senior pays Junior

A third tranche is unusual — prior tranching protocols used two. Senior's on-demand liquidity promise is underwritten by SLP depth, making SLP participation a dependency for Senior's redemption experience rather than merely a convenience.

Chainlink and RedStone feeds for liquid collateral; daily NAV updates for tokenized RWA rather than thin secondary market prices

Sourcing NAV instead of illiquid secondary prices is defensible and arguably safer for RWA. The limitation is granularity: daily NAV gives no intraday fallback for a protocol whose loss allocation depends on measured drawdowns.

3-of-5 multisigs; core Dawn contracts gated by OZ AccessManager with a 5-day minSetback, while the srRoyUSDC MultisigStrategy wrapper is upgradeable with no delay

Verified split: RoycoFactory enforces a 432,000s (5 day) minSetback and Royco publishes 48h upgrade / 24h oracle-swap timelocks. The no-timelock finding applies to the third-party Concrete wrapper, not core Dawn. Both statements are accurate; the risk depends on which contract holds the user's funds.

Instant pause for containment; curator (Dialectic) holds scoped operational control of vault positions, revocable by the Foundation

Curator permissions are scoped to authorised actions rather than open-ended custody at the core layer. Instant pause with no delay is standard containment practice, but it is also the precondition for the emergency-bypass path in the wrapper's valuation function.

adjustTotalAssets(int256 diff, uint256 nonce) — asset values reported by a 3-of-5 treasury multisig, constrained to 0.5% per update with 12-hour cooldowns and an emergency bypass available when paused

Belongs to the Concrete srRoyUSDC wrapper rather than Royco's own design, so it is scored as an interaction risk rather than Royco mechanism novelty to avoid double-counting. Material because it is a live access path: roughly $10.7M was admin-reported rather than independently verifiable on-chain at review time.

Because Junior holds the same underlying asset as Senior rather than a diversifying one, a drawdown hits both tranches simultaneously while Junior absorbs it at leverage inversely proportional to the coverage ratio. At ~12.4% observed coverage, an 8% underlying drawdown approaches full Junior exhaustion, after which Senior — marketed as the protected tranche — takes losses directly.

In the srRoyUSDC path the Owner multisig (3-of-5) controls the strategy ProxyAdmin and can upgrade the implementation immediately, and the Treasury multisig that takes custody of allocated funds shares the same signer set. There is no separation of powers and no delay during which an unexpected upgrade could be observed and exited ahead of.

Loss allocation between tranches and redemption pricing both depend on reported asset values. Where those values are multisig-attested rather than oracle-derived, a stale or incorrect report misallocates losses between Junior and Senior and misprices exits. The 0.5%-per-update and 12-hour cooldown constraints bound drift in normal operation but can be bypassed via the emergency path once the contract is paused.

Junior withdrawals are blocked while its capital is committed to backing Senior, and Junior deposits into illiquid sources inherit that illiquidity. Junior participants can therefore be locked in precisely while the drawdown that threatens their capital is unfolding, with no exit until utilisation falls or the underlying redemption window opens.

During the observation window losses are not yet allocated, while a Senior holder reaching the Protected Exit Threshold can withdraw in the underlying. If a drawdown proves permanent, Senior capital that exits during the deferral leaves the remaining participants — principally Junior — to absorb a loss measured after the fastest movers are gone.