> ## Documentation Index
> Fetch the complete documentation index at: https://docs.denar.markets/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance & admin powers

> Exactly what the Denar admin can do, what it can never do, the timelock protecting depositors, and the protocol's trust assumptions — the actual power map.

This page states plainly what is immutable, what the protocol admin can change, what it can never do, and which third parties Denar necessarily trusts.

## What is immutable

The lending core has **no upgrade mechanism, no pause button, no backdoor**. Each market's defining parameters — collateral asset, oracle, interest model, LLTV — are fixed forever at creation. Nobody, including the Denar team, can change the rules of a market you have already entered. Changing oracle behavior requires deploying a *new* market and letting users migrate by choice.

## What the admin can do — and the hard limits

| Role                              | Can                                                                                                                                                                                                            | Cannot                                                                                                                                               |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Protocol owner** (lending core) | Enable new interest models and LLTV options for *future* markets; set the protocol fee on interest (≤ 25%, enforced by code) and its recipient                                                                 | Touch user funds; alter existing markets; pause markets at will; block liquidations; censor anyone                                                   |
| **Vault owner / curator**         | Set per-market caps (raise = 1-day timelock, lower = instant); order the allocation queues; rebalance across approved markets; set a vault performance fee (≤ 50%); appoint curator, allocator, guardian roles | Withdraw depositors' USDG; send vault funds anywhere outside whitelisted markets; skip the timelock on risk increases; drop the timelock below 1 day |
| **Liquidation bot operator**      | Operate Denar's own liquidation bot and its approved swap venues                                                                                                                                               | Anything affecting user positions — the bot has zero protocol privilege and competes like any other liquidator                                       |

## The timelock: depositors' early warning

Every action that *increases* lender risk — raising a cap, adding a market to the vault — sits in a public pending state for **1 day** before it can take effect. Anyone watching the chain sees it coming and can exit first. Actions that *decrease* risk (cutting a cap, down to zero) execute instantly. The timelock itself cannot be set below 1 day or above 2 weeks.

## Trust assumptions

| You are trusting…            | With what                                                                                          | Bounded by                                                                            |
| ---------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| **Chainlink**                | Prices — the most safety-critical input of any money market                                        | Staleness guards, freeze-don't-guess design, per-asset feeds, independent USDG feed   |
| **Robinhood (token issuer)** | Stock tokens are issuer-operated and upgradeable; corporate-action pauses are under issuer control | Isolation + caps bound per-market exposure; monitoring; instant cap-to-zero           |
| **Robinhood Chain**          | Transaction ordering and liveness                                                                  | Conservative LLTVs absorb liquidation delays; sequencer guard ready                   |
| **The Denar team**           | Risk curation: caps, listings, fees                                                                | Hard-coded fee caps; 1-day timelock on risk increases; everything on-chain and public |

## Current administration, honestly

Admin roles are currently held by the **deploying address** — a single key, publicly identifiable on the [Contracts](/reference/contracts) page. This is a deliberate bootstrap choice for the seed phase, made viable by how little the admin can actually do (see the table above) and by the tiny caps.

The hardening path, in order: a dedicated operational key for the liquidation bot, then a **multisig** for the owner and curator roles, then a separate **guardian** with veto-only power over pending risk increases — each step planned before caps rise meaningfully.

<Note>
  The strongest guarantee is structural, not procedural: the vault is ERC-4626 non-custodial and the core is immutable. **"The admin curates risk but never custodies funds"** is a property of the code, not a promise.
</Note>

## Responsible disclosure

Found a vulnerability? Reach the team through [denar.markets](https://www.denar.markets). Good-faith reports are welcome and acted on quickly; a formal bug-bounty program is planned alongside the external audit.