Centrifuge Launches Modular Vault Architecture for Onchain Asset Management

The architecture is an immutable base layer paired with modular extensions. The system ships ERC-7540 for asynchronous request flows, ERC-4626 for synchronous operations, and ERC-7575 for multi-asset support. The split is the right call. The wrong call is treating it as finished.

What the architecture obligates

The immutable core must hold the share-to-asset invariant and nothing else. That means totalAssets accounting, redemption queue ordering, and final settlement state. Everything else — KYC hooks, manager whitelists, fee switches — lives in the extension set. If compliance logic appears in the core, the architecture is being violated.

The ERC-7540 request lifecycle is the state to read carefully. The standard exposes a two-phase deposit/withdraw: request, then claim. Between the offchain settlement window and onchain settlement, funds sit pending. Operators can cancel pending requests. Cancellation must decrement outstanding shares deterministically and refund or revert. A reentrancy path before the share burn permits double-claim against the same pending request.

ERC-7575 multi-asset support introduces a per-asset accounting path. Confirm that totalAssets is not a single uint256 shared across assets. If it is, a single asset depeg skews the share price for the rest of the vault.

One-click deployment and admin surface

One-click deployment is a deployment convenience, not a security guarantee. The output is a new proxy or deterministic CREATE2 address. The question is who owns the upgrade function on the extension set. The question is who can pause the core. The question is who can rewire the ERC-7540 operator address. None of this is visible from the front end.

The platform supports Ethereum, Base, Arbitrum, Avalanche, Plume, and BNB Chain. Each deployment is a separate instance. Each instance carries its own admin keys. Audits cover code, not key custody. The protocol has shipped over $2 billion in tokenized asset financing across its history. That number speaks to volume. It does not speak to code safety.

Two partnerships anchor the first wave of expected usage: New York Life Investment Management and Kraken Institutional. Specific deployments through these partnerships have yet to be fully disclosed. Until they are, treat the vault system as production infrastructure without a named production user.

Hard checks before integration

• Immutable core holds only totalAssets, share math, and redemption queue ordering.
• ERC-7540 fulfillment cancels deterministically and guards reentrancy before share burn.
• ERC-7575 multi-asset support uses per-asset accounting, not a single totalAssets variable.
• Admin and pause keys sit behind a multisig with a documented timelock.
• Extension upgrades go through a transparent commit-reveal or governance vote.
• Deployment addresses across chains verify against the published registry.