What the admin can do#
| Power | Limit |
|---|---|
Create the pool (posl_initialize) | Once. On mainnet only the admin key written in the program, and only with the real ZEC mint. |
Change parameters (posl_update_params) | Checked by check_params, applied only after a delay (below). The epoch length can never change. |
Emergency stop (posl_set_paused) | At once, no delay. Deposits and locks are refused (Paused); withdrawals, private transfers, unlocks and claims stay open, so a pause never traps anyone. No delay is needed because the admin gains nothing from it: a pause moves nothing and locks nothing in. |
| Upgrade the program | Held by the upgrade authority. This is the strongest power. At launch it is a single key held by the founder (an accepted risk, written in the audit); a multisig comes after. |
What the admin cannot do#
- Move ZEC out. The vault pays in exactly four places in
posl.rs, all inside proof-checked instructions: a withdrawal to the proven recipient, the relayer share of a proven fee, and the proven fee of a lock or an unlock. There is no sweep and no admin withdrawal. - Spend or freeze notes. Notes are spent only with their owner's key.
- Change a fee overnight. A change waits (below), so anyone can leave first.
Limits written in code#
| Constant | Value | Build | Meaning |
|---|---|---|---|
BPS | 10_000 | all | / Instruction kinds, mixed into the ext-data hash so a proof made for one |
KIND_TRANSACT | 1 | all | instruction cannot be replayed on another. |
KIND_LOCK | 2 | all | |
KIND_UNLOCK | 3 | all | |
KIND_CLAIM_STAKE | 4 | all | |
KIND_CLAIM_VOLUME | 5 | all | / Hard caps on what the admin can set (audit 19/09): even a stolen admin key |
MAX_FEE_RATE_BPS | 100 | all | cannot turn the exit fee into a confiscation. deposit and withdrawal fee: 1 % at most |
MAX_FEE_ERROR_MARGIN_BPS | 1_000 | all | / A parameter change waits this many epochs, and at least MIN_PARAM_DELAY_SECS, |
PARAM_DELAY_EPOCHS | 2 | all | before advance_epoch applies it: people see it coming and can leave first. |
MIN_PARAM_DELAY_SECS | 48 * 3600 | mainnet build | |
MIN_PARAM_DELAY_SECS | 0 | test, localnet and devnet builds |
In short: deposit and withdrawal fees can never exceed 1 %; the volume cap stays strictly below 100 % (so volume can never be farmed); shares stay between 0 and 100 %; the fee tolerance is at most 10 %.
The delay#
posl_update_params does not change anything at once. It stores the new parameters as pending. They apply when an epoch opens at least PARAM_DELAY_EPOCHS epochs later and at least MIN_PARAM_DELAY_SECS seconds later (48 hours on mainnet). A new call replaces the pending change and starts the delay again. The pending change is public in the pool state.