Public, private and fixed-term vaults
4 minDifficulty Checked 2026-11-10- A private vault takes deposits only from accounts with credentials in its permissioned domain.
- A shareholder can always redeem to their own account, even after credentials expire.
- Closed-ended vaults lock funds between fixed dates. They need LendingProtocolV1_1.
The vault owner makes three choices at creation. They cannot be changed later.
Who can deposit. A public vault takes deposits from anyone who can hold the asset. A private vault takes deposits only from approved accounts. Approval works through credentials: a trusted party attests something about an account, such as a completed identity check. The vault points at a list of accepted credentials.
There is one safety rule. If your credential expires, you cannot deposit more. You can still redeem your shares to your own account. The owner cannot lock your funds in by removing your access.
Whether shares can move. By default, shares are tokens you can send to someone else. The owner can make them non-transferable. Then they can only be redeemed. Even when shares can move, the receiver must be allowed to hold both the shares and the asset behind them.
Whether the vault runs on a calendar. An open-ended vault lets people deposit and withdraw at any time. A closed-ended vault has three phases with fixed dates:
- Subscription. Deposits and withdrawals are open.
- Investment. Funds are locked and can go out as loans.
- Redemption. Withdrawals reopen. Deposits stay closed.
The dates are public and fixed, so every depositor knows the lockup before joining. Closed-ended vaults are part of a second amendment, LendingProtocolV1_1.
The owner can also cap the vault's size. That cap can be changed later.
Set on VaultCreate only:
| Setting | Field or flag | Notes |
|---|---|---|
| Private | tfVaultPrivate (0x00010000) | Stored as lsfVaultPrivate on the Vault |
| Non-transferable shares | tfVaultShareNonTransferable (0x00020000) | Shares can only be redeemed |
| Access list | DomainID | A PermissionedDomain ID. Valid only on a private vault |
| Kind | VaultKind | 0 open-ended (default), 1 closed-ended |
| Calendar | SubscriptionDate, RedemptionDate | Seconds since the Ripple Epoch |
| Share precision | Scale | Trust-line token vaults only |
VaultSet can later change Data, AssetsMaximum or DomainID. An AssetsMaximum of 0 means no cap.
Private vaults. VaultDeposit fails with tecNO_AUTH when the depositor lacks credentials in the vault's domain. VaultWithdraw to the sender's own account does not apply the domain rules. A withdrawal to a different Destination does.
Share transfers use a normal Payment. They fail when the payee lacks credentials for a private vault or when shares are non-transferable. They also fail when the underlying asset is frozen or locked for the payer, the payee or the vault's pseudo-account.
Closed-ended vaults need the LendingProtocolV1_1 amendment. The two dates must both be in the future. They must be at least 180 seconds apart and less than 30 years apart.
| Transaction | Open-ended | Subscription | Investment | Redemption |
|---|---|---|---|---|
VaultDeposit | Yes | Yes | No | No |
VaultWithdraw | Yes | Yes | No | Yes |
VaultClawback | Yes | Yes | Yes | Yes |
A blocked deposit returns tecEXPIRED. A withdrawal during Investment returns tecTOO_SOON.
Accounting model. The owner does not choose it. A vault created after LendingProtocolV1_1 is enabled has LEVersion 1 and uses cash-basis accounting: interest counts when it is paid. A vault created before that counts all scheduled interest at loan origination, and it keeps that model permanently.
Related: Credentials, Permissioned Domains and DEX, V1_1 and the vote.
- Single Asset VaultsRead 2026-11-10
- VaultCreateRead 2026-11-10
- VaultWithdrawRead 2026-11-10
- VaultSetRead 2026-11-10
- Vault ledger entryRead 2026-11-10
