Capabilities
The admin can:- Add fee tiers and tick spacings
- Bind or rebind a fee to a spacing
- Register token decimals once
- Allow tokens for pool creation
- Open or close public pool creation
- Enable or disable a pool
- Pause globally, by token, or by pair
- Set the protocol fee share for a pool
- Collect recorded protocol fees to a chosen recipient
- Freeze and unfreeze positions
- Nominate a new admin
Admin and investigator concentration
DEPLOYER and SWAP_INVESTIGATOR_KEY are the same hardcoded address. At initial deployment this combines operational administration and compliance-record decryption under one account unless custody arrangements separate the underlying capabilities.
Admin transfer does not rotate the investigator recipient. The old investigator remains able to decrypt new records.
Misuse and compromise cases
- Venue or market denial through pause controls
- Incorrect token decimal registration, which is write-once
- Risky asset admission through the token allowlist
- Unexpected fee and spacing rebinding for future pools
- Excessive protocol fee share within the allowed range
- Protocol fee collection to an unauthorized recipient
- Position immobilization without adequate authority or review
- Loss of investigator confidentiality through key compromise
Multisig limit
The imported multisig check applies only to upgrades above edition zero. Routine admin calls requireself.caller to match the admin mapping.
Mitigations
- Use a dedicated operational control account with threshold approval.
- Separate investigator custody from admin signing.
- Require a signed manifest for decimals, tokens, fees, and pools.
- Apply dual approval for protocol fee collection and position freeze.
- Monitor every admin mapping change and transfer.
- Reconcile control transactions against a case or change record.
- Test emergency pause and recovery procedures.
- Maintain an investigator-key upgrade or redeployment plan.