I3: Pause OPS flows (treasury_send, burn_from_pool) — admin only. Admin governance ops (caps, allowlist, role rotation, upgrades) remain available so the admin can remediate and unpause. This is the on-chain brake for an OPS-key compromise; the admin multisig is uncompromised in that scenario and can halt fund movement without touching SAC allowances.
fn pause(env: soroban_sdk::Env)Rotate ops address — admin only, new ops must co-sign.
fn set_ops(env: soroban_sdk::Env, new_ops: soroban_sdk::Address)I3: Resume OPS flows — admin only.
fn unpause(env: soroban_sdk::Env)Rotate admin address — admin only, new admin must co-sign.
fn set_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)I-01: deployment-time constructor. Runs atomically with contract creation, closing the deploy-init race window. Treasury is mutable post-deploy via L-05 propose_treasury / execute_treasury_rotation; burn pool and SAC ID remain immutable (no setters).
L-03: caps for treasury_send and burn_from_pool are admin-configurable at deploy time and via setters. Per-tx cap is a hard ceiling on any single call; daily cap rolls over at UTC midnight.
fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
ops: soroban_sdk::Address,
treasury: soroban_sdk::Address,
burn_pool: soroban_sdk::Address,
sac_contract_id: soroban_sdk::Address,
allowed_hot_wallets: soroban_sdk::Vec,
treasury_send_max_per_tx: i128,
treasury_send_daily_cap: i128,
burn_max_per_tx: i128,
burn_daily_cap: i128,
) L-03: update burn_from_pool caps — admin only.
fn set_burn_caps(env: soroban_sdk::Env, new_max_per_tx: i128, new_daily_cap: i128)Send from treasury to an allowlisted hot wallet — OPS only.
Amount must be positive, destination must be allowlisted.
Uses SAC allowance model: transfer_from(spender=this, from=treasury, to, amount).
The SAC allowance (granted by Treasury) acts as the on-chain spending ceiling.
fn treasury_send(env: soroban_sdk::Env, to: soroban_sdk::Address, amount: i128)Add a hot wallet to the allowlist — admin only.
fn add_hot_wallet(env: soroban_sdk::Env, addr: soroban_sdk::Address)Burn from the burn pool — OPS only.
Amount must be positive. Uses SAC allowance model:
burn_from(spender=this, from=burn_pool, amount).
fn burn_from_pool(env: soroban_sdk::Env, amount: i128)Cancel a pending WASM upgrade — admin only.
fn cancel_upgrade(env: soroban_sdk::Env)Execute a pending WASM upgrade — admin only.
Fails if no pending upgrade or UPGRADE_DELAY_LEDGERS has not elapsed.
fn execute_upgrade(env: soroban_sdk::Env)Propose a WASM upgrade — admin only.
Stores the hash; must wait UPGRADE_DELAY_LEDGERS before executing.
fn propose_upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)Propose a new treasury address — admin only. Starts the timelock window; executable after DELAY_LEDGERS elapsed.
fn propose_treasury(env: soroban_sdk::Env, new_treasury: soroban_sdk::Address)Propose SAC admin rotation — admin only. Stores pending admin + proposal ledger.
fn propose_sac_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)Remove a hot wallet from the allowlist — admin only.
fn remove_hot_wallet(env: soroban_sdk::Env, addr: soroban_sdk::Address)L-03: update treasury_send caps — admin only. Both new values must be positive; daily must be >= per_tx.
fn set_treasury_send_caps(
env: soroban_sdk::Env,
new_max_per_tx: i128,
new_daily_cap: i128,
)Cancel pending SAC admin handoff — admin only.
fn cancel_sac_admin_handoff(env: soroban_sdk::Env)Cancel a pending treasury rotation — admin only.
fn cancel_treasury_rotation(env: soroban_sdk::Env)Execute SAC admin handoff — admin only.
Requires pending proposal and DELAY_LEDGERS elapsed.
Calls SAC.set_admin(pending).
fn execute_sac_admin_handoff(env: soroban_sdk::Env)Execute a pending treasury rotation — admin only. Requires pending proposal, DELAY_LEDGERS elapsed, AND new_treasury co-sign.
fn execute_treasury_rotation(env: soroban_sdk::Env)