Protocol

Governance

A small set of roles operates the protocol. Each is listed here with what it can do and what it cannot.

Governance multisig

may change contract parameters: open-interest caps, position limits, rebate coefficients, the floor ratio and market listings. Every change goes through a timelock and is visible on chain before it takes effect.

Owner

may resume position openings after a pause.

Pause guardian

may pause new openings across all markets, and may permanently delist a market.

Admin address

may run the liquidation sweep and process the deposit queue, call harvest to settle queued claims in order, and restore a paused market once an oracle is valid again.

Keeper

fetches and signs oracle prices; the contract validates every signature.

Relayer

pays gas and batches user-signed orders. It is optional; anyone can submit directly.

What no role can do

  • Reverse, cancel or edit a trade.
  • Freeze an account or move a user's balance.
  • Mint TLP to itself or anyone else outside the rebate and deposit rules.
  • Set the equity per share, the rebate rate or the floor price by hand.
  • Pay redemptions ahead of queued winners.
Roles may act. None of them is obliged to act within any time, and the protocol has no service level for pauses, resumptions, sweeps or settlement. Parameters current at any time are those on the contract, not those in this document.
Protocol · 16 / 21

Governance

A small set of roles operates the protocol. Each is listed here with what it can do and what it cannot.

Governance multisig

may change contract parameters: open-interest caps, position limits, rebate coefficients, the floor ratio and market listings. Every change goes through a timelock and is visible on chain before it takes effect.

Owner

may resume position openings after a pause.

Pause guardian

may pause new openings across all markets, and may permanently delist a market.

Admin address

may run the liquidation sweep and process the deposit queue, call harvest to settle queued claims in order, and restore a paused market once an oracle is valid again.

Keeper

fetches and signs oracle prices; the contract validates every signature.

Relayer

pays gas and batches user-signed orders. It is optional; anyone can submit directly.

What no role can do

  • Reverse, cancel or edit a trade.
  • Freeze an account or move a user's balance.
  • Mint TLP to itself or anyone else outside the rebate and deposit rules.
  • Set the equity per share, the rebate rate or the floor price by hand.
  • Pay redemptions ahead of queued winners.
Roles may act. None of them is obliged to act within any time, and the protocol has no service level for pauses, resumptions, sweeps or settlement. Parameters current at any time are those on the contract, not those in this document.