Skip to main content
The controller authenticates lending calls and checks account risk. The pool accepts mutations only from the controller and enforces market accounting constraints. External price feeds, tokens, swap routes, and callbacks require checks at their respective boundaries.

​
Trust boundaries

​
Authorization

Governance holds the administrative roles. The controller has no role registry: its administrative entrypoints are owner-gated, and lending entrypoints authenticate the acting address. The governance contract is the controller owner; the controller owns the pool and position NFT. Account authority comes from the position NFT. Delegates must have an owner-bound grant and remain registered, active position managers. Open operations such as repayment and liquidation still authenticate the acting payer or liquidator. NFT transfer makes the previous owner’s grants inactive without erasing them. They can reactivate if the NFT returns before the grants are replaced or removed. See Accounts and risk for the permission split and Position NFT for transfer approvals. The controller starts paused. Global pause blocks supply, borrow, and strategy entrypoints while permitting withdrawal, repayment, liquidation, and bad-debt cleanup. Spoke halt flags independently restrict ordinary exits and liquidation. Bad-debt cleanup bypasses those flags while retaining price and eligibility checks. See Halt flags.

​
External execution and pricing

A shared reentry guard blocks guarded controller mutations while a flash-loan callback, strategy swap, or Blend migration call executes external code. A reentrant call fails with #400 FlashLoanOngoing. Every valuation-dependent mutation requires a complete usable price snapshot. A provider failure or invalid price reverts the operation, including an exit that needs valuation. A two-source oracle cannot fall back to its surviving leg. Read-only quote diagnostics report invalid status for resolution failures. See Oracles.
The controller checks measured swap settlement and account solvency, but the aggregator enforces route slippage. A route with an inadequate minimum output can execute at an unfavorable price while passing controller checks. See Strategies.

​
Token and accounting assumptions

Listed assets use SAC or SEP-41 token interfaces with 0 through 18 decimals. Assets below 3 decimals cannot enable borrowing or flash loans and must have zero spoke liquidation fees. Such collateral occupies the account’s only supply slot. Debt-bearing risk checks require at least 2 token base units in that leg. Inbound accounting credits the delivered amount, including when a transfer delivers less than requested. Liquidation credit and seizure follow the measured repayment. This measurement does not remove trust in the token contract. Rebasing tokens are outside the accounting assumptions: balances must change through transfers the protocol makes or observes. Token issuers and token upgrade authorities remain external dependencies. The pool uses its tracked cash for borrowable liquidity. A direct donation to the pool address does not increase that cash book. Token balance reads support measured transfers and flash-loan settlement; they do not replace per-market accounting. New position exposure requires spoke admission, while market-level operations such as flash loans use hub and pool configuration.

​
Administrative and upgrade risk

Governance can change risk settings, approved managers, oracle configuration, external contract addresses, and contract code. Timelocks provide a delay before those changes execute; they do not constrain all possible behavior of upgraded code. Immediate pause, halt-flag, and sanity-band paths only tighten their permitted restrictions. A GUARDIAN can also immediately create empty hubs or spokes; listing assets and registering pool markets remain separate operations. See Governance. Controller upgrades pause the controller before replacing its code. Pool rate-model changes accrue interest with the old parameters first. Storage-layout changes require a coordinated migration. The current migrate(version) only advances a version marker; it does not transform stored records. The Deployment guide covers operational steps. The swap aggregator and XOXNO oracle have separate ownership and upgrade authorities. The accumulator is a configured destination address for claimed revenue; its address must be verified before configuration.

​
Operational dependencies

Monitor oracle availability, market cash, spoke-cap usage, storage lifetime, external contract changes, and expiring timelock operations. The interest indexes also have a silent ceiling; its consequences are documented in Interest and revenue. Use the oracle, RPC, and indexer runbooks for incidents. These controls reduce specific failure risks without guaranteeing oracle correctness, liquidity, or loss prevention.