Admin controls
Admins cannot touch your share tokens or withdraw on your behalf. Admins can upgrade the contracts with no delay, sweep idle vault currency, and pause withdrawals. This page covers both sides plainly.Roles
All of these sit with the same Safe(s) that created the vault, per → [Contract addresses].
What admins cannot do
- Cannot move your share tokens. Mint and burn are owner-only, and the owner is the vault itself, never an admin address.
- Cannot withdraw on your behalf.
withdrawonly ever pulls frommsg.sender. - Cannot rewrite a settled loss. There’s no clawback function.
What admins can do to user funds
Upgrades are immediate, with no timelock. Every core contract - vault, strategy manager, fee module, oracle, each strategy - is upgradeable, and a new implementation can do anything, including move funds. This is the largest trust assumption in the protocol. Idle vault currency can be swept.PROTOCOL_MANAGER_ROLE can move any amount of the vault’s currency sitting at the strategy manager to any address, instantly - and that balance counts as vault value.
Rotation moves capital at chosen slippage, which may legally be set to 100%.
Key holders
Pauses
The withdrawal pause and global pause are the two switches that can lock you in. Neither has an on-chain time limit.
Upgrades and timelocks
Every core contract uses the UUPS pattern, upgradeable by its owner Safe with no delay. The only timelock in the system is the 2-day fee delay above - it schedules on first call and applies on a second call after 2 days; it has no cancel function and doesn’t expire. The one exception: share tokens (TrancheToken) are not upgradeable - their code can’t change.