Governance
Who can change what, and how fast.
Three tiers, matched to urgency#
Different powers need different speeds. A halt has to be able to happen immediately; changing a risk parameter should not. So authority is split three ways rather than concentrated behind one switch.
| Tier | Who | What it controls |
|---|---|---|
| Permissionless | Anyone | sync(), forceSettle(), liquidate(), settleMatured() |
| Multisig | Signers, no delay | The oracle and the swap module |
| Timelock | Multisig, behind a delay | Market, LenderVault, HaltController, InterestRateModel |
Permissionless#
The actions that protect people are open to everyone. Moving a market into a halt when the oracle has paused, forcing settlement once the deadline passes, liquidating an unsafe position and settling a matured fixed-term loan all require no permission at all.
This is deliberate. A safety mechanism that depends on a privileged keeper is only as reliable as that keeper's uptime, and a guarantee that depends on the same governance that let a market get stuck is not a guarantee.
Multisig, no delay#
The oracle and the swap module sit directly behind a multisig with no timelock. These are the fast levers: if a feed needs pausing or a swap fee needs adjusting, waiting out a delay would defeat the point.
Timelock#
Everything that changes how risk is calculated sits behind a timelock, proposed by the multisig. Risk parameters, contract ownership and the rate model all take this path, so any change is visible on-chain before it takes effect.
What governance cannot do#
Several limits are constants in the contracts rather than settings, so no governance action can move them.
- It cannot block repayment. There is no state and no parameter that closes the repay path.
- It cannot remove the settlement escape hatch. The delay is bounded between 1 and 30 days. The floor stops it being set near zero; the ceiling stops an indefinite lockup being quietly restored.
- It cannot let a fixed-term loan out-borrow a variable one. Enforced in both directions, so neither raising the fixed LTV nor lowering the variable one can invert the relationship.
- It cannot exceed the hard ceilings on leverage, swap fee, settlement bounty or fixed-term length. See Risk parameters.
- It cannot skip a halt state. Transitions follow a fixed sequence; there is no override.
Testnet configuration is not a security boundary
10 minutes. Both are real contracts wired correctly, but at those parameters neither provides meaningful protection. A production deployment needs real co-signers and a delay measured in days.Upgrades#
The contracts are not proxied and cannot be upgraded in place. Changing core logic means deploying a new Market and LenderVault pair, because each holds an immutable reference to the other. Positions are unwound and liquidity migrated before the switch.
This is a deliberate trade: no upgrade key means no ability to quietly change the rules under anyone, at the cost of a heavier process for every change.