Access Control

Administrative Roles

Protocol administrator (Market Manager admin)

Available actions

• Deploy new lending markets through the Market Manager
• Queue, apply, or cancel a market contract upgrade via time-locked queue_in_market_upgrade → apply_market_upgrade (with cancel_market_upgrade to abort a pending upgrade)
• Queue, apply, or cancel a Market Manager contract upgrade via time-locked queue_in_manager_upgrade → apply_manager_upgrade (with cancel_manager_upgrade)
• Read the list of markets and any queued upgrades (read-only)

Authentication and requirements

• Must be authenticated as the manager admin for deploys and upgrades
• Deploys and upgrades require approval from the Market Manager admin multisig (no single signer can act alone)
• Upgrades are never instantaneous: a new WASM hash must be queued and can only be applied after the upgrade queue period has elapsed. The Market Manager's own upgrades use a fixed 12-hour queue period; each market's upgrade queue period is set when that market is registered
• Reading the market list is public (no auth)

Market admin

Available actions

• Queue, apply, or cancel pool config updates and new pool creation via time-locked queue_in_pool_set → apply_pool_set (owned markets)
• Queue, apply, or cancel market config updates via queue_in_market_update → apply_market_update (owned markets)
• Change market status with update_market_status, which supports 7 statuses including *ByAdmin variants that the Insurance Fund cannot override
• Update per-pool status flags with update_pool_status (owned markets)
• Configure fee beneficiaries with set_take_rate_fees_beneficiaries, set_operation_fees_beneficiaries
• Update swap provider with update_swap_provider
• Transfer admin role via propose_new_admin → accept_proposed_admin

Authentication and requirements

• Must be authenticated as the market admin
• Pool config updates and market config updates require the market to be owned

Proposed admin

Available actions

• Accept the admin role via accept_proposed_admin (completes the 2-step admin transfer)

Authentication and requirements

• Must be authenticated as the proposed admin address

Protocol deployer (Market Manager contract)

Available actions

• Invoke upgrade on a market to swap its WASM hash

Authentication and requirements

• The deployer is not an operator address — it is the Market Manager contract that deployed the market. A market's upgrade requires the deployer's authorization, so only the Market Manager can call it
• The Market Manager only invokes upgrade from within apply_market_upgrade, which enforces the time-lock. There is no path to upgrade a market without first queuing the new WASM hash and waiting out the upgrade queue period

System Roles

Insurance Fund

Available actions

• Freeze or change market status via fund_update_market_status
• Cannot set or clear *ByAdmin status variants
• Process bad debt cover requests

Authentication and requirements

• Must be authenticated as the Insurance Fund contract address

User Roles

INFO

Lender, Borrower, Collateral manager, and Batch operator describe different capabilities of the same user account, not separate account types. A single wallet can perform all of these actions depending on the state of its obligation.

Lender

Available actions

• Deposit to earn yield (receive jTokens)
• Withdraw from any obligation type
• All user functions use ObligationKey; different seeds target different obligation types (standard, earn, looping, etc)

Authentication and requirements

• User authentication required (via ObligationKey.user)
• Sufficient balance
• Token transfer approval to the contract

Borrower

Available actions

• Borrow against existing collateral
• Repay borrowed amounts with accrued interest
• Supplied tokens that yield interest are also considered as collateral, and borrows are made against them as well

Authentication and requirements

• User authentication required
• Must have collateral to borrow
• Must have sufficient tokens to repay

Collateral manager

Available actions

• Add collateral (no interest earned)
• Remove collateral while maintaining required health/limits

Authentication and requirements

• User authentication required
• Token approval needed to add
• Existing collateral required to remove

Batch operator

Available actions

• Compose complex strategies via submit_requests_batch (e.g., flash borrow → swap → deposit → borrow in one atomic transaction)

Authentication and requirements

• User authentication required
• Oracle price must be fresh
• All operations in the batch must individually satisfy their constraints

Permissionless Roles

Liquidator

Available actions

• Repay part of an unhealthy borrower's debt
• Seize discounted collateral (subject to limits/incentive)
• Can also liquidate within batch operations via LiquidateRequest

Authentication and requirements

• Must authenticate as the liquidator address
• Cannot be the borrower (no self-liquidation)

Bad-debt coverer

Available actions

• Issue bad debt cover requests to the Insurance Fund via issue_cover_bad_debt
• Claim results from the Insurance Fund via claim_cover_bad_debt_results
• Two-phase permissionless process

Authentication and requirements

• Permissionless caller (no privileged auth)

Fee distributor

Available actions

• Distribute accumulated pool fees to beneficiaries via distribute_pool_fees or distribute_all_pools_fees

Authentication and requirements

• Permissionless caller (no privileged auth)

Reader

Available actions

• View user obligations (all types via ObligationKey)
• View pool state, utilization, fees, liquidity
• Retrieve oracle prices and decimals
• List pools and obligations
• View APR/APY
• Retrieve global market state
• View queued updates

Authentication and requirements

• Public (no authentication)

Contract Roles

Flash loan taker

Available actions

• Execute atomic flash loans for arbitrage, liquidations, collateral swaps, or refinancing

Authentication and requirements

• Contract authentication required
• Callback must implement the flash-loan client interface
• Must repay principal + fee in the same transaction