Governance ABI

Governance owns the controller. Protocol-admin changes are scheduled as typed AdminOperation values and executed after the timelock delay.

Roles

Role	Purpose
`PROPOSER`	Schedules operations. Cannot be revoked from the last holder (`#48`).
`EXECUTOR`	Executes ready operations when execution is restricted.
`CANCELLER`	Cancels pending operations. A single account may not hold both `EXECUTOR` and `CANCELLER` (`#41`).
`GUARDIAN`	Immediate, tightening-only emergency powers: `pause`, `set_spoke_asset_flags`, `set_sanity_band`.
`ORACLE`	Oracle-related governance administration.

Entry points

Function	Purpose
`deploy_controller(wasm_hash)`	One-time controller deployment. Emits `DeployControllerEvent`.
`deploy_price_aggregator(wasm_hash)`	One-time price-aggregator deployment. Emits `DeployPriceAggregatorEvent`.
`controller()`	Returns the deployed controller address.
`price_aggregator()`	Returns the deployed price-aggregator address.
`propose(proposer, op, salt) -> BytesN<32>`	Validates and schedules an `AdminOperation`; returns the operation id.
`execute(executor, target, function, args, predecessor, salt) -> Val`	Executes a ready controller-targeted operation and returns the controller’s return value.
`execute_self(executor, op, salt)`	Executes a ready governance-self operation.
`cancel(canceller, operation_id)`	Cancels a pending operation. Recovery operations are not cancellable (`#46`).
`get_min_delay()`	Timelock delay in ledgers.
`get_operation_state(operation_id)`	Operation lifecycle state.
`get_operation_ledger(operation_id)`	Ready ledger for pending ops.
`hash_operation(target, function, args, predecessor, salt)`	Computes an operation id.
`has_role(account, role)`	Role membership check.
`resolve_asset_oracle(key, oracle)`	Read-only helper matching proposal-time oracle resolution.
`resolve_oracle_tolerance(tolerance)`	Read-only helper resolving a bps tolerance into its reciprocal pair.

Immediate (non-timelocked) entrypoints

These bypass the delay because they can only make the protocol safer, or because they repair governance itself:

Function	Auth	Effect
`pause(caller)`	`GUARDIAN`	Pauses the controller. Unpausing is timelocked (`AdminOperation::Unpause`).
`set_spoke_asset_flags(caller, spoke_id, hub_asset, paused, frozen, no_seize)`	`GUARDIAN`	Sets the three halt flags. Tightening only — clearing one is `#317`.
`set_sanity_band(caller, key, min_wad, max_wad)`	`GUARDIAN`	Tightening only — widening is `#227`.
`create_hub(caller)` / `add_spoke(caller)`	`GUARDIAN`	Creates an empty hub or spoke. Harmless until assets are listed on it.
`revoke_role_immediate(account, role)`	owner only	Emergency role revocation. Can revoke only `GUARDIAN` or `ORACLE` — any other role is `#41 InvalidRole`.
`propose_canceller_reset(new_cancellers, salt) -> BytesN<32>`	owner only	Schedules a canceller reset. Still timelocked; it is listed here because it is a recovery path, not because it is instant.
`execute_canceller_reset(executor, new_cancellers, salt)`	optional executor	Applies the reset once ready. Same executor rules as `execute`.
`accept_ownership()`	pending owner	Second step of the two-step ownership transfer.

revoke_role_immediate is not a general break-glass. It is owner-gated and can only strip GUARDIAN or ORACLE. You cannot use it to remove a PROPOSER, EXECUTOR, or CANCELLER — those go through RevokeGovRole on the timelock.

How `executor` works

execute, execute_self, and execute_canceller_reset all take executor: Option<Address>:

Some(address) — that address must authorize the call and hold EXECUTOR.
None — no executor check runs, so execution is open to anyone.

The operation still has to be ready and unexpired either way. None widens who may press the button, never what the button does.

`AdminOperation` variants

Controller-targeted:

Group	Variants
Wiring	`SetSwapAggregator`, `SetPriceAggregator`, `SetAccumulator`
Limits	`SetPositionLimits`, `SetMinBorrowCollateralUsd`
Topology	`CreateHub`, `AddSpoke`, `RemoveSpoke`, `SetSpokeLiquidationCurve`
Listings	`AddAssetToSpoke`, `EditAssetInSpoke`, `RemoveAssetFromSpoke`
Markets	`CreateLiquidityPool`, `UpgradeLiquidityPoolParams`
Deployment	`DeployPool(hash)`, `DeployPositionNft`, `UpgradePool(hash)`, `UpgradePositionNft(hash)`, `UpgradePriceAggregator(hash)`
Blend	`ApproveBlendPool`, `RevokeBlendPool`
Delegation	`SetPositionManager(address, is_active)`
Oracle	`ConfigureAssetOracle`, `EditOracleTolerance`
Emergency	`Unpause`, `ForceSocializeBadDebt(account_id)`
Lifecycle	`UpgradeController(hash)`, `MigrateController(version)`, `TransferCtrlOwnership`

Governance-self, executed through execute_self: UpgradeGov(hash), UpdateGovDelay(ledgers), GrantGovRole, RevokeGovRole, TransferGovOwnership.

There is no token-approval operation, no spoke-deprecation operation (RemoveSpoke sets the deprecation flag), and no pool-template registration — DeployPool and UpgradePool take the Wasm hash directly.

Execution model

Controller-targeted operations run through execute, which forwards the call to the controller and returns its result. Governance-self operations run through execute_self instead. They use typed inline execution because Soroban does not allow a contract to make the generic self-call that execute relies on. Testing-only immediate forwarders are gated behind #[cfg(any(test, feature = "testing"))]. They are not part of the production admin path and are not present in a deployed build.

Start here

Concepts

Integration guides

Reference

Operations

Roles

Entry points

Immediate (non-timelocked) entrypoints

How `executor` works

`AdminOperation` variants

Execution model

​Roles

​Entry points

​Immediate (non-timelocked) entrypoints

​How executor works

​AdminOperation variants

​Execution model

Roles

Entry points

Immediate (non-timelocked) entrypoints

How `executor` works

`AdminOperation` variants

Execution model