Governance & trust model
Own is admin-configured, not immutable: parameters, listings, and oracle wiring are governance-set through the ProtocolRegistry's role system. This page states plainly who can do what.
Roles
| Role | Powers | Constraint |
|---|---|---|
| Protocol admin | Set risk parameters, caps, listings, oracle configuration, staking APR and cap, registry wiring, upgrades | For eUSD, a 3-of-5 governance Safe (0x470f35a7e5d4Cd490D74799AC01E7bEea7F478e2) with a 3-hour transfer delay |
| Operator | Emergency levers and routine ops: mint pause, oracle signer removal, staking reserve top-ups from the treasury; on OwnX also trading pause, asset halt, PSM guard acknowledgement | Instant, but cannot change parameters or touch user funds |
| Keeper | Push signed off-hours prices, re-stamp marks, run the $MONEY buy-back | Prices must carry a valid oracle signature and stay inside the band; the buy-back amount is fixed by the contract |
| Vault Manager | Run one collateral vault: accept LP deposits, manage the lending book, distribute yield | Registered per vault; economics flow to that vault's LPs |
| Market makers / oracle signers | Quote and attest | Semi-trusted, fenced by bands, caps, expiry, and single-use signatures |
| Traders / holders | Everything permissionless | Treated as adversarial by every code path |
The levers, by product
| Product | Levers |
|---|---|
| eTokens | Utilization cap, per-asset issuance caps, concentration caps, settle band, freshness windows, claim threshold, pause/halt |
| eUSD | Per manager: MCR and liquidation parameters, stability fee, minimum debt, debt ceiling, price max age, mint pause, collateral add/disable. Staking vaults: APR, cap, reserve top-up and withdrawal of unspent rewards |
| Oracles | Feed configs, bands, signer set, verifier upgrades (with rollback) |
| Curated Funds | Fund admin role (Own's Safe), separate from eUSD's: contract upgrades, fund fee (at most 10%), yield tiers (capped at 3% a day), curator yield, mint locks, pool issuance, eligibility list, curators, basket while public curation is off, mint and launch-deposit pause, proposal veto. Redemption has no pause. See Curators & the basket |
What admin cannot do
- Mint eTokens or eUSD to itself; issuance only happens through the collateralized paths.
- Seize user balances; eToken and eUSD balances have no admin hook.
- Touch staked principal;
withdrawReservereaches only rewards that have not yet dripped. - Block exits: repay, close, redeem, unstake, PSM redemption, and liquidation have no pause switch by design.
The honest trade-off
Immutability (Liquity's model) removes governance risk but freezes every parameter forever. Own chose adjustability because equity collateral, growing asset lists, and a young stablecoin need tunable caps and thresholds. The mitigations are scope (the levers above are the whole list), the operator/admin split, the transfer delay, and the standing rule that exits are ungated. Users should weigh admin-key risk as real; see Risks.