Timelock on mainnet
Most protocol changes go through a ~48 hour timelock on mainnet before they take effect. Proposers schedule a change, the delay passes, then an executor applies it. The delay is intended to make scheduled changes observable on-chain before execution. Monitoring is optional; there is no on-chain community vote. Testnet uses a much shorter delay for development only.What requires governance
Typical timelocked changes include:
Your existing positions keep the risk parameters they had when you supplied, so
a parameter change does not silently reprice them. Two things do restamp them:
any leveraged or swap strategy you run on the account, and a permissionless
refresh — which is itself guarded, so it cannot push an account below a 1.05
health factor.
Listed assets, risk parameters, oracles, upgrades, and ownership can change
after the delay (or immediately for pause). There is no guarantee that current
settings remain fixed for the life of a position.
Emergency pause
The emergency model is deliberately one-directional. A guardian can make the protocol safer immediately; nobody can reopen it without the delay.
Global pause blocks risk-increasing actions (new supply, borrow, strategies,
flash loans). It is designed to leave withdraw, repay, liquidation, and
delegate revocation open, so a pause never traps a solvent user’s exit or
blocks a liquidation. A per-asset
paused flag is stricter and does block that
asset’s exits; a frozen flag blocks only entry.
Emergency pause is an admin control. It does not guarantee loss prevention or
incident resolution. It does not erase your balances. Your collateral and debt
remain on chain.