Skip to main content
In production, the governance contract is the on-chain owner of the controller. The controller owns the central pool. Ownership and role holders are admin-controlled and may change via the governance surface below.

​
Timelock flow

  1. A PROPOSER builds an AdminOperation.
  2. Governance validates it at proposal time and schedules it with propose(proposer, op, salt), which returns the operation id.
  3. The operation waits until get_min_delay() ledgers pass. Track it with get_operation_state and get_operation_ledger.
  4. Someone executes it. Call execute for a controller-targeted operation, or execute_self for a governance-self one. Both take executor: Option<Address>: pass Some(address) and that address must authorize and hold EXECUTOR; pass None and anyone may execute.
  5. Governance forwards the call to the controller and returns its result, or applies the self operation inline. (Soroban does not allow the generic self-call that execute uses, which is why the two paths differ.)

​
Roles

Governance roles are PROPOSER, EXECUTOR, CANCELLER, GUARDIAN, and ORACLE. Three rules keep the role set from deadlocking:
  • No account holds both EXECUTOR and CANCELLER. The grant is rejected with #41 InvalidRole, so nobody can both schedule past a cancel and cancel.
  • The last PROPOSER cannot be revoked (#48 CannotRemoveLastProposer). Losing every proposer would make governance permanently unable to act.
  • A canceller reset path exists (propose_canceller_reset / execute_canceller_reset), so a lost canceller role does not block governance forever. It is owner-gated and still timelocked.
One narrow exception to the timelock: the owner may call revoke_role_immediate(account, role) to strip a role without waiting. It works on GUARDIAN and ORACLE only — any other role is #41 InvalidRole.

​
Operation scope

Governance controls:
  • hub, spoke, spoke-asset configuration, and the per-spoke liquidation curve;
  • market creation and rate-model updates;
  • pool and position-NFT deployment and upgrades;
  • oracle configuration, tolerance, and sanity bands;
  • swap-aggregator, price-aggregator, and accumulator addresses;
  • position limits, the minimum-borrow floor, and position-manager registration;
  • the Blend pool allow-list;
  • force_socialize_bad_debt, unpause, controller upgrade, migration, and ownership;
  • governance roles, delay, ownership, and upgrade.

​
Emergency controls

The emergency model is deliberately asymmetric: the guardian can make the protocol safer immediately, but cannot reopen it. Attempting to relax through the fast path is rejected: #317 SpokeAssetFlagRelaxation for flags, #227 SanityBandMustTighten for sanity bands. Operations are validated at proposal time, delayed, and bound to their scheduled payload. A scheduled operation whose grace period elapses expires (#40 TimelockOperationExpired) and must be proposed again.

​
Next

Governance ABI

Entry points and AdminOperation groups.

Configuration

Controller configuration surface.