KPK (karpatkey)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED ON AN UNRESOLVED ELIGIBILITY QUESTION, NOT ON FIRM QUALITY. KPK is the 2025 rebrand of karpatkey, a genuinely established operator: founded 2020, GnosisDAO’s sole treasury manager since 2022, with a multi-year public track record managing treasuries for ENS, Balancer, Aave, CoW Protocol, Lido, Uniswap, Arbitrum, Nexus Mutual, Safe, and dYdX, and a 2024 funding round backed by protocol founders including Stani Kulechov and the Gnosis co-founders. Its non-custodial Safe-plus-Zodiac-Roles architecture is a real, disclosed control model, and GnosisDAO’s 2025 approval of KPK’s spin-off into an independent Cayman Islands foundation entity is a matter of public record. This is the strongest-credentialed operator in this batch. But this review could not confirm whether KPK’s retail-facing curated vaults exclude US persons or carry any other eligibility restriction — the protocol-specific legal disclaimer pages that would answer this could not be rendered — and the one detailed incident account available, KPK’s own writeup of the April 2026 Kelp DAO/LayerZero exploit’s effect on its curated vaults, is self-published with no independent confirmation of whether any loss was realized. This registry does not record eligibility as open when it is genuinely unresolved.

Kill criteria: the events that revoke this verdict
• The protocol-specific legal disclaimer pages for each vault venue are rendered and confirmed not to exclude US persons
• Fund-product eligibility and accreditation requirements for direct end-user access are disclosed
• An independent, non-KPK-authored account of the Kelp DAO incident’s actual financial impact on KPK-curated positions is published
• A primary Cantina audit report is published and linked, resolving the discrepancy with DefiLlama’s zero-audit field

The research file

Mechanism

KPK runs three product lines on a common non-custodial architecture using Gnosis Safe plus a Zodiac Roles Modifier permissions layer: bespoke DAO Treasury mandates (the original 2020 business); curated Vaults on Morpho, Gearbox, and Euler, distributed through retail-facing aggregators including Jumper Earn, Superform, and Vaults.fyi; and tokenized Funds with per-block on-chain NAV computation aimed at institutional distribution. A depositor into Vaults holds a standard ERC-4626-style share on the underlying protocol; KPK never takes custody, holding only pre-scoped permissions to execute whitelisted rebalancing and allocation actions. Vault redemption is liquidity-dependent on the underlying lending market, and Fund shares redeem proportionally at per-block NAV, though no worst-case illiquidity disclosure was found for either path.

Legal structure and the GnosisDAO spin-off

KPK’s Terms of Service name the operator as Karpatkey Foundation, governed under Cayman Islands law — a genuine, confirmed disclosure. Per KPK’s own history, GnosisDAO formally approved karpatkey’s spin-off into this independent entity in 2025, following karpatkey’s 2020 incubation under Gnosis and its 2022 appointment as GnosisDAO’s sole treasury manager. This is a real, disclosed legal-entity transition, not an opacity gap — the strongest legal-structure finding in this curator batch.

The unresolved eligibility question

KPK’s general Terms of Service carry no explicit US-person exclusion, but protocol-specific legal disclaimer pages referenced in KPK’s own documentation for each vault venue (Morpho, Gearbox, Euler, Symbiotic) — the pages most likely to carry the actual jurisdiction and eligibility restrictions — could not be rendered in this review. Whether Funds carry accredited-investor or qualified-purchaser gating for direct end-user access, as opposed to integrator-level distribution, is similarly undisclosed on KPK’s public site. Given this registry’s treatment of every other tokenized or curated product with an unconfirmed eligibility question — Spiko, DigiFT, and others in this backlog were rejected on exactly this basis despite comparably strong regulatory profiles — the same standard applies here.

Control and the Kelp DAO incident

KPK sets risk-tiered allocation and exposure caps and runs automated rebalancing within pre-approved Zodiac Roles permissions — a genuinely disclosed control model. KPK’s own blog account of the 2026-04-18 Kelp DAO/LayerZero V2 bridge exploit (the same event this registry has already used to inform rejections of `layerzero-v2` and `aave-horizon-rwa`) describes rsETH as collateral in markets KPK curated and treasuries it managed, claiming its response contained exposure across six client DAOs. The article reads as a competence narrative rather than a loss disclosure and does not state whether any KPK-curated vault or treasury realized a loss — no independent, non-KPK-authored account of the incident’s actual impact on KPK’s book was found.

Track record and comparison

Current tracked TVL is roughly $174M, concentrated 94% on Ethereum. DefiLlama lists zero audits for the KPK entity, though KPK’s own materials claim a December 2025 Cantina audit of its smart-contract infrastructure without a linked report. Against K3 Capital and Hyperithm, both rejected in this batch, KPK is meaningfully more transparent on legal structure and carries a genuine multi-year, independently verifiable operating history predating its retail vault products — but that pedigree does not resolve the eligibility and independent-incident-verification gaps above, which are the actual basis for this rejection.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• KPK — Terms of Service · primary · accessed 2026-08-19
  Supports: Karpatkey Foundation Cayman Islands entity, general eligibility clause with no explicit US-person exclusion
• KPK — about and company history · primary · accessed 2026-08-19
  Supports: 2020 founding, GnosisDAO treasury mandate history, 2025 spin-off approval, funding round and backers
• KPK — vaults product page · primary · accessed 2026-08-19
  Supports: Morpho, Gearbox, and Euler vault deposits, retail aggregator distribution
• KPK — inside the war room, Kelp DAO incident case study · primary · accessed 2026-08-19
  Supports: April 2026 Kelp DAO LayerZero exploit response, self-published incident narrative
• DefiLlama — KPK protocol data · secondary · accessed 2026-08-19
  Supports: current TVL and chain concentration, zero audits field, previousNames karpatkey confirmation

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.