Skip to content
LogoLogo

Governance & trust model

Own is admin-configured, not immutable: parameters, listings, and oracle wiring are governance-set through the ProtocolRegistry's role system. This page states plainly who can do what.

Roles

RolePowersConstraint
Protocol adminSet risk parameters, caps, listings, oracle configuration, registry wiring3-hour transfer delay; migration to a Safe multisig is a standing commitment
OperatorEmergency levers only: trading pause, asset halt, PSM guard acknowledgement, mint pauseInstant, but cannot move funds or change parameters
KeeperPush verified prices, re-stamp marksPermissionless; anyone can run one
Vault ManagerRun one collateral vault: accept LP deposits, manage the lending book, distribute yieldRegistered per vault; economics flow to that vault's LPs
Market makers / oracle signersQuote and attestSemi-trusted, fenced by bands, caps, expiry, and single-use signatures
Traders / holdersEverything permissionlessTreated as adversarial by every code path

The levers, by product

ProductLevers
eTokensUtilization cap, per-asset issuance caps, concentration caps, settle band, freshness windows, claim threshold, pause/halt
eUSDMCR and liquidation parameters, stability fee, minimum debt, debt ceiling, mint price max age, mint pause, collateral add/disable
OraclesFeed configs, bands, signer set, verifier upgrades (with rollback)

What admin cannot do

  • Mint eTokens or eUSD to itself; issuance only happens through the collateralized paths.
  • Seize user balances; eToken and eUSD balances have no admin hook.
  • Block exits: repay, close, redeem, PSM redemption, and liquidation have no pause switch by design (a halt changes the price they settle at, never their availability).

The honest trade-off

Immutability (Liquity's model) removes governance risk but freezes every parameter forever. Own chose adjustability because equity collateral, growing asset lists, and a young stablecoin need tunable caps and thresholds. The mitigations are scope (the levers above are the whole list), the operator/admin split, the transfer delay, and the standing rule that exits are ungated. Users should weigh admin-key risk as real; see Risks.