Administrative security
The contracts are administered by a multisig wallet through a 72-hour timelock. Every administrative change is queued onchain first and can take effect only after the delay, so anyone can see it before it applies.
The risk engine’s relayer cannot upgrade the contracts, change parameters or unpause.