Vault template standard

Vault templates that ACCUMULATE funds (LP-staking dividends, AI buyback, lending, etc.) follow a shared security model via the VaultBase base contract. The token creator can configure mechanism parameters but can NEVER touch the vault's funds; only the platform multisig (guardian) can emergency-withdraw as a safety backstop.

abstract contract VaultBase is IVaultSchema {
    IPlatformConfig public config;
    address public creator;            // config-only, no access to funds

    // guardian = platform multisig, single source from PlatformConfig
    function guardian() public view returns (address) { return config.guardian(); }
    modifier onlyGuardian() { require(msg.sender == guardian(), "only guardian"); _; }

    // emergency withdraw: guardian only (creator has no access)
    function emergencyWithdraw(address payable to) external onlyGuardian { ... }
    function emergencyWithdrawToken(address token, address to) external onlyGuardian { ... }

    // creator or guardian can rotate the creator (key-loss recovery)
    function transferCreator(address newCreator) external onlyCreatorOrGuardian { ... }
}

Auto-generated UI: each vault implements vaultUISchema() describing its methods/inputs on-chain. The platform reads it to auto-render the interaction form — so a developer can ship a new vault (even an unlisted one) without writing any frontend. Recommended hardening for accumulating vaults: hard reserve floor, two-layer price oracle (Portal + TWAP, no spot — anti-flashloan), bounded queues with a minimum-borrow (anti-grief), and ReentrancyGuard / SafeERC20.