> ## Documentation Index
> Fetch the complete documentation index at: https://docs.berafarm.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin-Controls

> Every admin role in Berafarm, what admins can and cannot do to user funds, and how pauses and upgrades work on-chain.

## Admin controls

Admins **cannot** touch your share tokens or withdraw on your behalf. Admins **can** upgrade the contracts with no delay, sweep idle vault currency, and pause withdrawals. This page covers both sides plainly.

### Roles

| Role                         | Controls                                                                                   |
| ---------------------------- | ------------------------------------------------------------------------------------------ |
| Factory owner (Safe)         | Upgrades every core contract, no delay                                                     |
| `TRANCHE_VAULT_MANAGER_ROLE` | Fees (2-day delay), slippage, limits, both pause switches                                  |
| `PROTOCOL_MANAGER_ROLE`      | Strategy rotation, vault currency, **sweeping idle currency held at the strategy manager** |
| `WHITELIST_MANAGER_ROLE`     | Vault whitelist                                                                            |
| Bot key (`rewardsClaimer`)   | Triggers settlement, claims strategy rewards                                               |

All of these sit with the same Safe(s) that created the vault, per → [\[Contract addresses\].](/security-and-risk/contract-addresses)

### What admins cannot do

* **Cannot move your share tokens.** Mint and burn are owner-only, and the owner is the vault itself, never an admin address.
* **Cannot withdraw on your behalf.** `withdraw` only ever pulls from `msg.sender`.
* **Cannot rewrite a settled loss.** There's no clawback function.

### What admins can do to user funds

**Upgrades are immediate, with no timelock.** Every core contract - vault, strategy manager, fee module, oracle, each strategy - is upgradeable, and a new implementation can do anything, including move funds. This is the largest trust assumption in the protocol.

**Idle vault currency can be swept.** `PROTOCOL_MANAGER_ROLE` can move any amount of the vault's currency sitting at the strategy manager to any address, instantly - and that balance counts as vault value.

**Rotation moves capital at chosen slippage,** which may legally be set to 100%.

### Key holders

|                    |                                                      |
| ------------------ | ---------------------------------------------------- |
| WBERA owner Safe   | `0xf40a2c06F7A530ac2bA175F8DdA4ec4De97382F6`         |
| HONEY owner Safe   | `0x0E222512c4CCb7FB7773017b82981be14baFeEeA`, 2-of-2 |
| Bot key            | *(confirm)*                                          |
| Key custody policy | *(confirm)*                                          |

### Pauses

| Switch             | Role                         | Blocks                                                       |
| ------------------ | ---------------------------- | ------------------------------------------------------------ |
| Deposit pause      | `TRANCHE_VAULT_MANAGER_ROLE` | New deposits only; withdrawals unaffected                    |
| Withdrawal pause   | `TRANCHE_VAULT_MANAGER_ROLE` | **All withdrawals -** no expiry, no limit                    |
| Global pause       | Registry owner               | **Both directions, every vault**                             |
| Per-strategy pause | Registry owner               | That sleeve's withdrawals only - deposits into it still work |

The withdrawal pause and global pause are the two switches that can lock you in. Neither has an on-chain time limit.

### Upgrades and timelocks

Every core contract uses the UUPS pattern, upgradeable by its owner Safe with **no delay**. The only timelock in the system is the 2-day fee delay above - it schedules on first call and applies on a second call after 2 days; it has no cancel function and doesn't expire.

The one exception: share tokens (`TrancheToken`) are **not** upgradeable - their code can't change.

### Verify it yourself

| What                     | Where                                                                        |
| ------------------------ | ---------------------------------------------------------------------------- |
| WBERA `AccessController` | `0x47a351D2C3428767150a68BE118e2dd81fD44563`                                 |
| HONEY `AccessController` | `0x8554F6B257afDBC6117fCbd268f4Fc072b31f275`                                 |
| Check a role             | `hasRole(keccak256("ROLE_NAME"), address)` on the vault's `AccessController` |
| Last upgrade             | `[tx hash]`                                                                  |

***