Skip to main content
Governance controls lending configuration and upgrades. It owns the controller and price aggregator; the controller owns the central pool and position NFT. Administrative changes use scheduled operations, with limited immediate powers for bootstrap and emergency response.

​
Timelock lifecycle

  1. A PROPOSER calls propose(proposer, op, salt) with an AdminOperation. Governance checks proposal authority, validates the payload, and returns an operation id. Some operations also require the proposer to be the owner.
  2. The operation waits until its ready ledger. Standard operations use get_min_delay(); sensitive and recovery operations also have delay floors. Read get_operation_ledger for the scheduled value.
  3. Execute a ready operation with execute for controller or price-aggregator targets, or execute_self for governance operations, including SetPriceAggregator.
  4. Governance applies the scheduled payload to its bound target. Execution after the grace period fails with #40 TimelockOperationExpired; propose the operation again to schedule a new execution window.
Both execution methods accept executor: Option<Address>. Some(address) requires that address to authorize and hold EXECUTOR. With None, execution is permissionless once the operation is ready.

​
Roles

Code upgrades, controller migration, ownership transfers, delay changes, oracle configuration or tolerance changes, external address changes, Blend pool approval, and role grants require both the owner and PROPOSER authority. A role grant alone does not let another proposer schedule these operations. The owner receives all five roles. Other addresses cannot hold both EXECUTOR and CANCELLER; conflicting grants return #41 InvalidRole. Ordinary governance revocation cannot remove the owner’s roles or the last proposer. Removing the last proposer fails with #48 CannotRemoveLastProposer. The owner can schedule a canceller reset through propose_canceller_reset and execute_canceller_reset. The reset remains timelocked. The owner can immediately revoke GUARDIAN or ORACLE with revoke_role_immediate; other role values are rejected.

​
Controlled settings

The one-time deploy_controller bootstrap call requires the governance owner and executes immediately. Governance and controller ownership transfers require transfer_ownership(new_owner, live_until_ledger), followed by accept_ownership() from the incoming owner.

​
Emergency controls

Read get_spoke_asset_flags_epoch(spoke_id, hub_asset) before proposing flag relaxation. Set expected_epoch to that value. A later flag change invalidates the proposal with #319 SpokeFlagsEpochMismatch; read again and propose anew. EditAssetInSpoke cannot clear a set flag. Immediate create_hub and add_spoke calls create empty containers. They do not register pool markets or list assets for lending. Fast-path relaxation fails with #317 SpokeAssetFlagRelaxation for flags or #227 SanityBandMustTighten for sanity bands. Global pause and per-listing flags have different effects on exits; see Risk parameters. For signatures and operation groups, use Governance ABI. For configuration inputs, use Configuration.