I3: Pause OPS flows (treasury_send, burn_from_pool) โ admin only. Admin governance ops (caps, allowlist, role rotation, upgrades) remain available so the admin can remediate and unpause. This is the on-chain brake for an OPS-key compromise; the admin multisig is uncompromised in that scenario and can halt fund movement without touching SAC allowances.
fn pause(env: soroban_sdk::Env)Rotate ops address โ admin only, new ops must co-sign.
fn set_ops(env: soroban_sdk::Env, new_ops: soroban_sdk::Address)I3: Resume OPS flows โ admin only.
fn unpause(env: soroban_sdk::Env)Rotate admin address โ admin only, new admin must co-sign.
fn set_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)I-01: deployment-time constructor. Runs atomically with contract creation, closing the deploy-init race window. Treasury is mutable post-deploy via L-05 propose_treasury / execute_treasury_rotation; burn pool and SAC ID remain immutable (no setters).
L-03: caps for treasury_send and burn_from_pool are admin-configurable at deploy time and via setters. Per-tx cap is a hard ceiling on any single call; daily cap rolls over at UTC midnight.
fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
ops: soroban_sdk::Address,
treasury: soroban_sdk::Address,
burn_pool: soroban_sdk::Address,
sac_contract_id: soroban_sdk::Address,
allowed_hot_wallets: soroban_sdk::Vec,
treasury_send_max_per_tx: i128,
treasury_send_daily_cap: i128,
burn_max_per_tx: i128,
burn_daily_cap: i128,
) L-03: update burn_from_pool caps โ admin only.
fn set_burn_caps(env: soroban_sdk::Env, new_max_per_tx: i128, new_daily_cap: i128)Send from treasury to an allowlisted hot wallet โ OPS only.
Amount must be positive, destination must be allowlisted.
Uses SAC allowance model: transfer_from(spender=this, from=treasury, to, amount).
The SAC allowance (granted by Treasury) acts as the on-chain spending ceiling.
fn treasury_send(env: soroban_sdk::Env, to: soroban_sdk::Address, amount: i128)Add a hot wallet to the allowlist โ admin only.
fn add_hot_wallet(env: soroban_sdk::Env, addr: soroban_sdk::Address)Burn from the burn pool โ OPS only.
Amount must be positive. Uses SAC allowance model:
burn_from(spender=this, from=burn_pool, amount).
fn burn_from_pool(env: soroban_sdk::Env, amount: i128)Cancel a pending WASM upgrade โ admin only.
fn cancel_upgrade(env: soroban_sdk::Env)#127: set/rotate the vault contract authorized to call treasury_send_via_vault. Admin-only. Mainnet hardening: replace with a propose/execute timelock (deferred; see proposal ยง3.3). Greenfield: a direct admin setter is sufficient while no real money is live.
fn set_vault_addr(env: soroban_sdk::Env, vault: soroban_sdk::Address)Execute a pending WASM upgrade โ admin only.
Fails if no pending upgrade or UPGRADE_DELAY_LEDGERS has not elapsed.
fn execute_upgrade(env: soroban_sdk::Env)Propose a WASM upgrade โ admin only.
Stores the hash; must wait UPGRADE_DELAY_LEDGERS before executing.
fn propose_upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)Propose a new treasury address โ admin only. Starts the timelock window; executable after DELAY_LEDGERS elapsed.
fn propose_treasury(env: soroban_sdk::Env, new_treasury: soroban_sdk::Address)Propose SAC admin rotation โ admin only. Stores pending admin + proposal ledger.
fn propose_sac_admin(env: soroban_sdk::Env, new_admin: soroban_sdk::Address)Remove a hot wallet from the allowlist โ admin only.
fn remove_hot_wallet(env: soroban_sdk::Env, addr: soroban_sdk::Address)L-03: update treasury_send caps โ admin only. Both new values must be positive; daily must be >= per_tx.
fn set_treasury_send_caps(
env: soroban_sdk::Env,
new_max_per_tx: i128,
new_daily_cap: i128,
)#127: atomic RCAD settlement to a partner, triggered BY the vault as the
final step of vault.draw. Callable ONLY by the stored vault contract โ
Soroban's auth tree auto-includes the invoker contract address, so
vault.require_auth() is satisfied when (and only when) the vault is the
direct caller. Any other caller's address is what gets auto-included โ
require_auth panics. Partner validity is already enforced upstream by
vault.draw (require_partner_allowed); Gov trusts that pre-check.
fn treasury_send_via_vault(
env: soroban_sdk::Env,
to: soroban_sdk::Address,
amount: i128,
ref_hash: soroban_sdk::BytesN<32>,
)Cancel pending SAC admin handoff โ admin only.
fn cancel_sac_admin_handoff(env: soroban_sdk::Env)Cancel a pending treasury rotation โ admin only.
fn cancel_treasury_rotation(env: soroban_sdk::Env)Execute SAC admin handoff โ admin only.
Requires pending proposal and DELAY_LEDGERS elapsed.
Calls SAC.set_admin(pending).
fn execute_sac_admin_handoff(env: soroban_sdk::Env)Execute a pending treasury rotation โ admin only. Requires pending proposal, DELAY_LEDGERS elapsed, AND new_treasury co-sign.
fn execute_treasury_rotation(env: soroban_sdk::Env)