Skip to main content

Governance actions

This document summarizes governance and admin flows in Olla.

All routine parameter changes flow through the OllaGovernance contract, which inherits TimelockControllerUpgradeable. The governance admin wallet holds the timelock's proposer/executor/canceller roles. Actions must be scheduled through the timelock, wait for minDelay, then executed, at which point the timelock self-calls OllaGovernance and the onlySelf setter forwards to the target contract.

The two emergency entry points (emergencyPauseAll() / emergencyUnpauseAll()) skip the timelock and are gated by an explicit governanceAdmin check.

OllaCore parameter passthrough​

OllaVault operations passthrough​

SafetyModule parameter passthrough​

Direct timelock calls (no OllaGovernance wrapper)​

A few admin actions live directly on the target contract. The governance admin schedules a timelock action whose target is the satellite, not OllaGovernance.

Treasury management​

The treasury address is held on OllaGovernance and updated through the timelock.

Governance handover (two-step)​

Handover is initiated via the timelock but accepted directly by the new admin wallet. Acceptance only swaps the timelock roles; satellite admin pointers remain on the OllaGovernance contract address.

SafetyModule circuit breaker​

The SafetyModule's circuit breakers fire automatically from OllaCore during operations. The guardian can pause/unpause directly.

Emergency pause / unpause​

The governance admin wallet can pause or unpause both OllaCore and OllaVault in a single call. These functions are not timelocked. They are callable directly by the wallet whose address is stored as governanceAdmin.

Upgrades​

All contract upgrades are timelocked. OllaGovernance exposes dedicated wrappers for upgrading OllaCore, satellite contracts, and itself. Both wrappers accept optional initialization calldata (bytes data) which is forwarded to upgradeToAndCall so post-upgrade init can run atomically.