Configuration

Lending configuration has three scopes: pool markets, spoke risk policies, and protocol-wide addresses and oracles. Governance owns the controller and price aggregator and controls changes through typed operations. This page describes parameter ownership and validation. Follow Deployment for setup order and readiness checks.

​

Authority

Maintenance requires caller authorization, but no privileged controller role. The caller can be a wallet or contract. Upgrades and other sensitive proposals also require the governance owner to hold PROPOSER. Governance ABI lists the immediate tightening calls and the operations that require a timelock.

​

Spokes

Spokes define account risk policy. An account binds permanently to one spoke. Spoke asset configuration includes:

• Collateral eligibility and borrowing permission.
• Halt flags: paused blocks ordinary entry and exit, frozen blocks entry, and no_seize blocks liquidation seizure. Seizure ignores the other two flags.
• LTV, liquidation threshold, liquidation bonus, and liquidation fee.
• Supply and borrow caps in raw asset units. Zero permits no new exposure.

The spoke itself also carries the liquidation curve — liquidation_target_hf_wad, hf_for_max_bonus_wad, and liquidation_bonus_factor_bps — set with SetSpokeLiquidationCurve. Governance uses owner-gated controller calls to add spokes (AddSpoke), mark them deprecated (RemoveSpoke), and add, edit, or remove SpokeAsset(spoke_id, HubAssetKey) rows. A listing with non-zero usage cannot be removed (#309 SpokeAssetInUse). Both EditAssetInSpoke and immediate set_spoke_asset_flags can keep or tighten halt flags. To clear a flag, schedule RelaxSpokeAssetFlags. Read get_spoke_asset_flags_epoch(spoke_id, hub_asset) and include that value as expected_epoch. Proposal and execution check it. A later flag change makes the proposal obsolete and raises #319 SpokeFlagsEpochMismatch. See Risk parameters for risk bounds, flag behavior, and position-refresh rules. Exact field names are in Data types.

​

Pool market parameters

Each HubAssetKey { hub_id, asset } identifies a market on the shared pool. MarketParamsRaw includes the interest-rate curve, reserve factor, flash-loan settings, asset address, and decimals. Parameter updates accrue interest under the stored parameters before applying the replacement model. Validation checks:

• Rate slopes are monotonic.
• The maximum borrow rate stays within the contract’s safety bound.
• Utilization breakpoints are ordered.
• The reserve factor is below 100%.

Markets accept 0 through 18 token decimals. Markets below 3 decimals cannot enable borrowing or flash loans, and their spoke liquidation fees must be zero. Such collateral occupies the account’s only supply slot. Debt-bearing risk checks require at least 2 token base units in that collateral leg. Field scales and limits are in MarketParamsRaw; calculation rules are in Interest and revenue.

​

Oracle configuration

Oracle config lives on the price aggregator, keyed by PriceKey::Token(address) or PriceKey::Ref(symbol). All spokes share it; there is no per-spoke override. An AssetOracle declares one or two price sources, the tolerance band between them, an independence policy, staleness and decimal bounds, and a sanity band. Both proposal and execution validation check the source configuration. Non-LP configurations require at least one smoothed or fundamental leg (#38 SpotOnlyNotProductionSafe). A sole Aquarius LP source uses separate validation and skips the feed-smoothing and tolerance checks. Adjusting only the sanity band or only the tolerance has dedicated calls (set_sanity_band, set_tolerance). The immediate governance sanity-band path requires the ORACLE role and may only tighten. Tolerance changes remain timelocked. See Oracles for provider, freshness, independence, composition, and sanity-bound validation. A successful configuration update does not prove that its providers return a usable price; verify a live quote.

​

Next