Contracts Overview
The Olla protocol consists of 9 smart contracts organized into four groups. Async withdrawal request tracking and finalization live inside OllaVault itself.
Contract map
| Contract | Upgradeable | Description |
|---|---|---|
| Vault | ||
| OllaVault | UUPS proxy | User-facing vault. Accepts deposits, mints stAztec, tracks redemption requests, finalizes them in-place during rebalance. |
| StAztec | No (immutable) | ERC-20 receipt token representing shares of the staking pool. |
| Core | ||
| OllaCore | UUPS proxy | Orchestration engine. Runs rebalance, computes exchange rate, distributes fees. |
| RewardsAccumulator | UUPS proxy | Receives sequencer rewards from the rollup. |
| SafetyModule | No (replaceable) | Circuit breaker. Auto-pauses on rate drops, queue pressure, or stale accounting. |
| Staking | ||
| StakingManager | UUPS proxy | Interface to the Aztec rollup. Stakes, unstakes, tracks attester state. |
| StakingProviderRegistry | UUPS proxy | Manages attester keys and provider configuration. |
| Governance & Bridge | ||
| OllaGovernance | UUPS proxy | Timelocked governance. All parameter changes and upgrades flow through here. |
| StAztecOFTAdapter | No | LayerZero V2 bridge for cross-chain stAztec transfers. |
How they connect
Users interact with OllaVault. OllaVault delegates pricing to OllaCore, which orchestrates rebalancing through StakingManager (for rollup interactions) and RewardsAccumulator (for reward collection). SafetyModule monitors health and can pause everything. OllaGovernance owns the system and timelocks all changes.
For a visual diagram of contract interactions and role assignments, see the Architecture diagrams.
Roles
| Role | Held by | Can do |
|---|---|---|
Owner (Ownable2Step) | OllaGovernance contract | Authorise UUPS upgrades and onlyOwner setters on OllaCore and OllaVault. |
DEFAULT_ADMIN_ROLE | OllaGovernance contract | Authorise UUPS upgrades on satellites, configure SafetyModule, call removeDrainedRewardRollup on StakingManager. |
| Governance admin (proposer/executor/canceller on the timelock) | Governance multisig wallet | Schedule and execute timelocked actions, plus call emergencyPauseAll() / emergencyUnpauseAll() directly. |
GUARDIAN_ROLE | Guardian multisig | Pause/unpause OllaCore, OllaVault and SafetyModule; forceRebalanceReset(). |
CORE_ROLE | OllaCore contract | Instruct OllaVault during rebalance (transferToCore, receiveUnstaked, finalizeWithdrawals, mintFees). |
STAKING_PROVIDER_ADMIN_ROLE | Provider admin | Add attester keys, drip the queue, set rewards recipient. |
| Permissionless | Anyone | Call rebalance(), updateAccounting(), refreshAttesterState(), purgeFailedQueueEntry(). |
The governance admin is the multisig wallet that holds the timelock's proposer/executor/canceller roles. It is distinct from the OllaGovernance contract, which is the timelock itself and is the on-chain owner / admin of every other contract. Transferring governance changes the admin wallet but not the OllaGovernance contract address, so satellites do not need their DEFAULT_ADMIN_ROLE re-pointed during a transfer.