Governance

One governor contract owns every proxy in the desk. Three roles reach it on three paths, and each path trades speed against reach.

One owner, three roles

CallsideGovernor is a single non-upgradeable contract that owns every upgradeable proxy in the system. Every parameter change, every upgrade and every pause routes through it on exactly one of the paths below; there is no side door. The governor itself holds no funds and forwards calls with zero value, so it can direct the desk but never drain it.

The timelock and its classes

The Admin path is a class-delayed timelock. Every operation is scheduled publicly, and its delay depends on which way it moves risk: a change that only tightens the system matures fastest, a loosening change waits longest, and everything else sits in between.

The load-bearing rule is the default: any selector that was never registered in the class map runs on the slowest path, the 72 hours loosening delay. That covers every contract upgrade, since upgradeToAndCall is deliberately left unregistered everywhere. A forgotten registration therefore fails slow, never fast: the worst a gap in the map can do is make governance take longer.

Scheduling emits the full calldata and maturity time on chain, so the delay doubles as a public review window. The delays themselves are constructor immutables; changing them means deploying a new governor and migrating ownership through the old one.

The Risk Council fast path

The Risk Council calls a small allowlist of setters with no delay at all: the fed funds input to the interest rate, asset requirement and listing status updates, and lowering the vault deposit cap. The reason this is safe is that every one of those setters enforces its own hard bounds inside the target contract, per-call move limits, minimum intervals between calls, and floors and ceilings on every value. The governor checks who and when; the target checks what. Speed never buys reach, and widening the council allowlist is itself a timelocked operation.

The Guardian: pause, never move

The Guardian reaches only pause levers, and the allowlists are directional. When the guardian pauses something, it must provide both the pause payload and the exact unpause payload up front, and each is checked against its own separate allowlist: the pause call against the pause list, the recorded unpause against the unpause list. A pause can never be recorded as its own unpause, and nothing outside the unpause list, no rate setter, no transfer, no upgrade, can be smuggled in as the recorded inverse.

A pause expires after 72 hours. Expiry does not clear the pause by itself; it makes the recorded unpause executable by anyone, so no single role can keep the desk frozen quietly. The guardian may lift its own pause early at any time.

The pause levers themselves are narrow: vault deposits, buying power, a per-asset halt on the venue and the oracle deviation guard. There is no lever anywhere in the system that closes the desk on a schedule, because there is no schedule; a halt is per asset and must be chosen deliberately. The guardian also holds one power beyond pausing: it can cancel any still-queued admin operation, a safety veto against a compromised or mistaken schedule.

Who holds the roles

On the Robinhood Chain testnet the governor is live and owns every proxy, but all three roles collapse to the single deployer address. Mainnet takes distinct multisig signer sets for each role at the constructor; the governor treats each role as one address and expects the multisigs to stand behind them. The hosted demo chain is the exception: it resets and redeploys on every boot, so no timelock could ever mature there, and ownership stays with the admin key instead of the governor.

Role handoffs, allowlist changes and selector reclassifications all go through the governor's own timelock on the slowest delay, so not even the admin can widen its own reach in a single transaction. The concrete delay values live on the parameters page.