Governance ABI

Governance owns the controller and administers the price aggregator. Propose a typed AdminOperation, wait for its delay, then execute the scheduled call. Signatures omit the Soroban-injected Env argument. Construction uses __constructor(admin: Address, min_delay: u32). It sets the owner and grants that address all five roles. min_delay must be nonzero. Types are defined in Data types. Errors are listed in Errors.

Roles

Role	Purpose
`PROPOSER`	Schedules operations. Cannot be revoked from the last holder (`#48`).
`EXECUTOR`	Executes ready operations when execution is restricted.
`CANCELLER`	Cancels pending operations. Non-owner accounts may not hold both `EXECUTOR` and `CANCELLER` (`#41`); the owner is exempt and receives all five roles.
`GUARDIAN`	Immediate emergency powers: `pause`, tightening-only `set_spoke_asset_flags`, and empty hub/spoke creation.
`ORACLE`	Immediate, tightening-only `set_sanity_band`. Scheduling oracle changes still requires `PROPOSER`.

Deployment, scheduling, and views

Function	Purpose
`deploy_controller(wasm_hash: BytesN<32>) -> Address`	Owner-only, one-time controller deployment. Emits `DeployControllerEvent`.
`deploy_price_aggregator(wasm_hash: BytesN<32>) -> Address`	Owner-only, one-time price-aggregator deployment. Emits `DeployPriceAggregatorEvent`.
`controller() -> Address`	Returns the deployed controller address.
`price_aggregator() -> Address`	Returns the deployed price-aggregator address.
`propose(proposer: Address, op: AdminOperation, salt: BytesN<32>) -> BytesN<32>`	Requires `PROPOSER`; some operations also require that proposer to be the owner. Validates and schedules the operation.
`execute(executor: Option<Address>, target: Address, function: Symbol, args: Vec<Val>, predecessor: BytesN<32>, salt: BytesN<32>) -> Val`	Executes a ready operation targeting the controller or price aggregator and returns the target’s result.
`execute_self(executor: Option<Address>, op: AdminOperation, salt: BytesN<32>)`	Executes a ready governance-self operation.
`cancel(canceller: Address, operation_id: BytesN<32>)`	Cancels a pending operation. Recovery operations are not cancellable (`#46`).
`get_min_delay() -> u32`	Timelock delay in ledgers.
`get_operation_state(operation_id: BytesN<32>) -> OperationState`	Operation lifecycle state.
`get_operation_ledger(operation_id: BytesN<32>) -> u32`	Ready ledger for pending ops.
`hash_operation(target: Address, function: Symbol, args: Vec<Val>, predecessor: BytesN<32>, salt: BytesN<32>) -> BytesN<32>`	Computes an operation id.
`has_role(account: Address, role: Symbol) -> bool`	Role membership check.
`resolve_asset_oracle(key: PriceKey, oracle: AssetOracle) -> AssetOracle`	Read-only helper matching proposal-time oracle resolution.
`resolve_oracle_tolerance(tolerance: u32) -> OracleTolerance`	Read-only helper resolving a bps tolerance into its reciprocal pair.

Proposal authorization

Every propose call requires PROPOSER. These variants also require the same proposer address to be the current owner (#44 NotAuthorized):

TransferGovOwnership, TransferCtrlOwnership
UpgradeGov, UpgradeController, UpgradePool, UpgradePositionNft, UpgradePriceAggregator, MigrateController
UpdateGovDelay, SetPriceAggregator, ConfigureAssetOracle, EditOracleTolerance, SetSwapAggregator
ApproveBlendPool, SetAccumulator, GrantGovRole

RevokeGovRole cannot target the owner or the proposing address (#44). Its target cannot cancel its own revocation (#46). Revocation also rejects the last proposer (#48).

Immediate emergency calls

These calls bypass the timelock within the limits shown below.

Function	Auth	Effect
`pause(caller: Address)`	`GUARDIAN`	Pauses the controller. Unpausing is timelocked (`AdminOperation::Unpause`).
`set_spoke_asset_flags(caller: Address, spoke_id: u32, hub_asset: HubAssetKey, paused: bool, frozen: bool, no_seize: bool)`	`GUARDIAN`	Sets the three halt flags. Tightening only — clearing one is `#317`.
`set_sanity_band(caller: Address, key: PriceKey, min_wad: i128, max_wad: i128)`	`ORACLE`	Tightening only — widening is `#227`.
`create_hub(caller: Address) -> u32` / `add_spoke(caller: Address) -> u32`	`GUARDIAN`	Creates an empty hub or spoke. Asset listings still require the timelock.
`revoke_role_immediate(account: Address, role: Symbol)`	owner only	Emergency role revocation. Can revoke only `GUARDIAN` or `ORACLE` — any other role is `#41 InvalidRole`.

Revoking PROPOSER, EXECUTOR, or CANCELLER requires the timelocked RevokeGovRole operation.

Clear listing flags

EditAssetInSpoke can retain or tighten flags. It cannot clear paused, frozen, or no_seize (#317). To clear flags:

Read the controller’s get_spoke_asset_flags_epoch(spoke_id, hub_asset).
Propose RelaxSpokeAssetFlags(RelaxSpokeAssetFlagsArgs) with that expected_epoch and the intended three flag values.
Execute the scheduled controller call after the standard delay.

The proposal checks the epoch. Execution checks it again. A later flag write, including an explicit write of unchanged flags, invalidates the old proposal (#319). Read the current flags and epoch, then propose a new operation. A risk-only edit that keeps the flags does not change the epoch. Removing and relisting an asset preserves and advances the epoch, respectively.

struct RelaxSpokeAssetFlagsArgs {
    spoke_id: u32,
    hub_asset: HubAssetKey,
    expected_epoch: u64,
    paused: bool,
    frozen: bool,
    no_seize: bool,
}

Recovery and ownership

Function	Auth	Effect
`propose_canceller_reset(new_cancellers: Vec<Address>, salt: BytesN<32>) -> BytesN<32>`	owner	Schedules a timelocked, non-cancellable reset.
`execute_canceller_reset(executor: Option<Address>, new_cancellers: Vec<Address>, salt: BytesN<32>)`	optional executor	Applies the reset once ready. Same executor rules as `execute`.
`accept_ownership()`	pending owner	Completes the two-step ownership transfer.

Executor authorization

execute, execute_self, and execute_canceller_reset all take executor: Option<Address>:

Some(address) — that address must authorize the call and hold EXECUTOR.
None — no executor check runs, so execution is open to anyone.

The operation must be ready and unexpired in either case. None permits any caller to execute the scheduled operation without changing its target or arguments.

`AdminOperation` variants

Controller-targeted:

Group	Variants
Wiring	`SetSwapAggregator`, `SetAccumulator`
Limits	`SetPositionLimits`, `SetMinBorrowCollateralUsd`
Topology	`CreateHub`, `AddSpoke`, `RemoveSpoke`, `SetSpokeLiquidationCurve`
Listings	`AddAssetToSpoke`, `EditAssetInSpoke`, `RemoveAssetFromSpoke`, `RelaxSpokeAssetFlags`
Markets	`CreateLiquidityPool`, `UpgradeLiquidityPoolParams`
Deployment	`DeployPool(hash)`, `DeployPositionNft`, `UpgradePool(hash)`, `UpgradePositionNft(hash)`
Blend	`ApproveBlendPool`, `RevokeBlendPool`
Delegation	`SetPositionManager(address, is_active)`
Emergency	`Unpause`, `ForceSocializeBadDebt(account_id)`
Lifecycle	`UpgradeController(hash)`, `MigrateController(version)`, `TransferCtrlOwnership`

Price-aggregator-targeted, executed through execute: ConfigureAssetOracle, EditOracleTolerance, UpgradePriceAggregator(hash). Governance-self, executed through execute_self: UpgradeGov(hash), UpdateGovDelay(ledgers), GrantGovRole, RevokeGovRole, TransferGovOwnership, SetPriceAggregator. The latter updates governance’s stored price-aggregator address and forwards that address to the controller. RemoveSpoke sets the deprecation flag. DeployPool and UpgradePool take the Wasm hash directly. No token-approval or pool-template registration is required.

Variant payload types

enum AdminOperation {
    SetSwapAggregator(Address),
    SetPriceAggregator(Address),
    SetAccumulator(Address),
    SetPositionLimits(PositionLimits),
    SetMinBorrowCollateralUsd(i128),
    CreateHub,
    AddSpoke,
    RemoveSpoke(u32),
    AddAssetToSpoke(SpokeAssetArgs),
    EditAssetInSpoke(SpokeAssetArgs),
    RemoveAssetFromSpoke(RemoveAssetFromSpokeArgs),
    ApproveBlendPool(Address),
    RevokeBlendPool(Address),
    CreateLiquidityPool(CreatePoolArgs),
    UpgradeLiquidityPoolParams(UpgradePoolParamsArgs),
    DeployPool(BytesN<32>),
    DeployPositionNft(DeployPositionNftArgs),
    UpgradePool(BytesN<32>),
    UpgradePositionNft(BytesN<32>),
    UpgradePriceAggregator(BytesN<32>),
    SetPositionManager(Address, bool),
    UpgradeController(BytesN<32>),
    MigrateController(u32),
    TransferCtrlOwnership(TransferOwnershipArgs),
    EditOracleTolerance(EditToleranceArgs),
    SetSpokeLiquidationCurve(SpokeLiquidationCurveArgs),
    ForceSocializeBadDebt(u64),
    Unpause,
    UpgradeGov(BytesN<32>),
    UpdateGovDelay(u32),
    GrantGovRole(RoleArgs),
    RevokeGovRole(RoleArgs),
    TransferGovOwnership(TransferOwnershipArgs),
    ConfigureAssetOracle(ConfigureAssetOracleArgs),
    RelaxSpokeAssetFlags(RelaxSpokeAssetFlagsArgs),
}

Operation argument maps

These named structs encode as maps. SpokeAssetArgs and PositionLimits are defined in Data types. RelaxSpokeAssetFlagsArgs is defined in Clear listing flags.

struct RemoveAssetFromSpokeArgs {
    hub_asset: HubAssetKey,
    spoke_id: u32,
}

struct CreatePoolArgs {
    hub_id: u32,
    asset: Address,
    params: MarketParamsRaw,
}

struct UpgradePoolParamsArgs {
    hub_asset: HubAssetKey,
    params: InterestRateModel,
}

struct DeployPositionNftArgs {
    wasm_hash: BytesN<32>,
    uri: String,
    name: String,
    symbol: String,
}

struct TransferOwnershipArgs {
    new_owner: Address,
    live_until_ledger: u32,
}

struct ConfigureAssetOracleArgs {
    key: PriceKey,
    oracle: AssetOracle,
}

struct EditToleranceArgs {
    key: PriceKey,
    tolerance: u32,
}

struct SpokeLiquidationCurveArgs {
    spoke_id: u32,
    target_hf_wad: i128,
    hf_for_max_bonus_wad: i128,
    liquidation_bonus_factor_bps: u32,
}

struct RoleArgs {
    account: Address,
    role: Symbol,
}

Execution model

Controller- and price-aggregator-targeted operations run through execute, which forwards the scheduled call to that target and returns its result. Governance-self operations run through execute_self instead. They use typed inline execution because Soroban does not allow a contract to make the generic self-call that execute relies on. propose uses a zero predecessor. For external execution, use the same target, function, encoded arguments, zero predecessor, and salt as the scheduled call. ConfigureAssetOracle resolves asset decimals before scheduling; EditOracleTolerance converts the width into reciprocal ratio bounds. Use resolve_asset_oracle and resolve_oracle_tolerance to check those values.

Delay tier	Delay in ledgers
Standard	Configured `get_min_delay()`
Sensitive	`max(get_min_delay(), 12)` in the verified revision
Recovery	`max(get_min_delay(), 518400)`

Sensitive operations are UpgradeGov, UpgradeController, UpgradePool, UpgradePositionNft, UpgradePriceAggregator, GrantGovRole, RevokeGovRole, TransferGovOwnership, TransferCtrlOwnership, SetSwapAggregator, SetPriceAggregator, SetPositionManager, and ForceSocializeBadDebt. Other AdminOperation variants use the standard delay. Canceller reset uses the recovery delay. The sensitive floor is an audit-period value at contract revision a2486b25. Read the deployed delay and verify its code before planning execution. A ready operation expires after 120960 additional ledgers (#40). UpdateGovDelay cannot reduce the configured delay and cannot exceed 241920 ledgers (#39). Successful execution clears the scheduled state. Testing-only immediate forwarders are excluded from production builds.

Start here

Core concepts

Lending actions

Strategies and integrations

System behavior

Reference

Operations

Roles

Deployment, scheduling, and views

Proposal authorization

Immediate emergency calls

Clear listing flags

Recovery and ownership

Executor authorization

`AdminOperation` variants

Variant payload types

Operation argument maps

Execution model

​Roles

​Deployment, scheduling, and views

​Proposal authorization

​Immediate emergency calls

​Clear listing flags

​Recovery and ownership

​Executor authorization

​AdminOperation variants

​Variant payload types

​Operation argument maps

​Execution model

Roles

Deployment, scheduling, and views

Proposal authorization

Immediate emergency calls

Clear listing flags

Recovery and ownership

Executor authorization

`AdminOperation` variants

Variant payload types

Operation argument maps

Execution model