Qualified mandates
Select a mandate. The desk prepares a reference for identity checks and vault onboarding.
No regulated MPC custody partner is in use. Operator roles and contract pause exist in code. A multi-sig policy is not bound to a custody contract yet.
Corporate KYB dossier
Encrypted intakeThis intake is for institutions outside Turkey. Documents are posted to the gateway over the Karma API rewrite and stored encrypted there. You confirm you are not a resident of Turkey and that you apply as a professional investor. Turkey is not an offered jurisdiction.
How Institutional Capital is Safeguarded: The 5-Layer Anti-Hack Matrix
Pool capital sits in the non-custodial MudarabahVault. No regulated MPC custody partner is in use. Contract pause exists for operator and oracle divergence. An independent audit is planned.
Non-custodial vault
Q: Can Karma or ShariaCo operators arbitrarily withdraw and drain pool assets?
MudarabahVault has no function for operators to send capital to an arbitrary address. That is not a substitute for an independent audit.
Capital can ONLY exit the vault upon the generation of a verified MurabahaNFT trade note and direct settlement to authenticated physical goods suppliers. Even protocol architects cannot divert funds.
Institutional key policy (planned)
Q: How is institutional size managed? What happens if a key is compromised?
Smart Contract Exploit Shield (ReentrancyGuard & SafeERC20)
Q: Can attackers exploit flash-loans or re-entrancy vectors to drain pool liquidity?
Automated Circuit Breaker (RegimeGate Fast-Freeze)
Q: What happens during a market flash-crash, oracle divergence, or anomalous flow?
Takaful first-loss reserve
Q: What protects LP principal against operational bottlenecks or merchant defaults?
Traditional DeFi Risk vs. ShariaCo Institutional Architecture
Addressing the 5 critical security questions evaluated by LP Treasuries and CFOs:
| Attack / Risk Vector | Conventional Crypto / DeFi | ShariaCo Institutional Matrix |
|---|---|---|
| Operator Rug-Pull / Insider Drain | ✕High Risk — Admin private keys can drain liquidity pools | ✓Non-custodial vault — no admin drain function; independent audit planned. |
| Single Private Key Theft | ✕Critical Risk — Compromise of one key results in total loss | ✓No custody partner; pause exists on the contract. |
| Flash-Loan & Exploit Loops | ✕Prevalent — Billions lost in unaudited smart contracts | ✓OpenZeppelin libraries; independent audit planned. |
| Market Flash-Crash & Oracle Drift | ✕Severe Loss — Cascading liquidations dissolve capital | ✓Contract pause on operator or oracle divergence; no millisecond SLA. |
| Counterparty Default & Loss | ✕100% Absorbed by Investor — Zero remediation layer | ✓Takaful is defined on the contract and closed in the product. There is no principal guarantee. |
How portfolios are managed today
Retail and institutional exits follow the vault and gateway that are actually shipped. There is no licensed bank off-ramp, no named MPC custodian, and no hardware quorum in this release.
Retail: vault shares and a queued redeem
ERC-4626 · FIFO queue · no bank wireAccount access
Retail Karma sessions use the checkout identity already on the product. A seedless Face ID bank login is not part of this release.
Portfolio figures
Share value and pool totals come from protocol telemetry. Design-band weights are labelled as configuration, not as a live yield.
Redeem request
A redeem is a vault request. If cash is not sitting in the vault, the request joins the FIFO queue as receivables settle.
Settlement rail
There is no licensed Turkish FAST payout to a named domestic bank in this product. Fiat off-ramp partners are not contracted.