Skip to main content
Protocol configuration is owner-gated on the controller. In production, governance owns the controller and schedules configuration changes through timelock.

​
Authority

AuthorityScope
Controller ownerPool deploy/upgrade, hub and spoke config, market creation, pool params, oracle config, global addresses, upgrades.
Governance rolesProposal, execution, cancellation, and oracle-operation scheduling on governance.
Caller-signed maintenanceupdate_indexes, update_account_threshold, clean_bad_debt, claim_revenue, add_rewards.
The current controller does not depend on keeper, revenue, or oracle operational roles for maintenance calls.

​
Hub And Pool Setup

  1. Set the pool WASM template.
  2. Deploy the central pool once.
  3. Approve a token for listing.
  4. Create the hub-asset pool rows.
  5. Configure oracle and spoke access.
Pool rows are keyed by HubAssetKey { hub_id, asset }.

​
Spokes

Spokes define account risk policy. Accounts bind to a spoke id >= 1. Spoke asset configuration includes:
  • collateral and borrow flags;
  • paused and frozen flags;
  • LTV;
  • liquidation threshold;
  • liquidation bonus;
  • liquidation fee;
  • spoke-level supply and borrow caps;
  • optional oracle override.
Governance uses owner-gated controller calls to add spokes, deprecate spokes, and add/edit/remove SpokeAsset(spoke_id, HubAssetKey) rows.

​
Pool Params

Pool params include the interest-rate curve, reserve factor, flash-loan settings, asset address, and decimals. Updates accrue interest under the old params before applying the new params. Validation checks:
  • slope chain is monotonic;
  • max borrow rate stays within the configured safety bound;
  • utilization breakpoints are ordered;
  • reserve factor is below 100%.

​
Oracle Config

Oracle config is token-rooted under AssetOracle(asset). Configuring an oracle activates price resolution for that asset. Removing the entry disables price resolution. Spokes may provide per-spoke oracle overrides. Proposal-time validation checks source shape, decimals, staleness bounds, resolution, tolerance, and sanity bounds.

​
Pause Readiness

Before unpause:
  • central pool is deployed;
  • pool template hash is set;
  • target markets have pool rows and oracle config;
  • required spokes list the launched hub assets;
  • aggregator and accumulator addresses are set when corresponding features are enabled;
  • keeper config lists the same launched HubAssetKey markets.

​
Next

Deployment

Build, deploy, and bring-up sequence.

Security model

Trust boundaries, authorization, and upgrade model.