Security model

Invariants, upgradeability and the principles that constrain the design.

Protocol invariants

These are the properties that must hold for the system to be solvent. They are intended to be enforced in code and fuzz-tested, not merely asserted in prose.

• Debt ≤ borrowing capacity
• Total debt ≤ the governance borrow cap
• Collateral ≤ asset supply cap
• An invalid oracle cannot authorize new borrowing
• The pool can only owe more than it holds by what it has recognised as bad debt
• Liquidation cannot create unaccounted debt
• Treasury cannot withdraw user collateral

Privileged control

No single EOA should control the market's policy, treasury, the oracle, collateral configuration, upgrades or governance. Critical contracts sit behind a multisig plus timelock plus governor, with a pause-only guardian for emergencies.

Upgradeability

Principles

• No unlimited admin mint
• No single-wallet treasury control
• No arbitrary collateral listing
• No borrowing against stale prices
• No instant governance execution for critical changes
• No dependence on a single liquidity venue
• No recursive leverage presented as organic TVL
• No pretending the pool cannot run dry — liquidity refusals are a stated, monitored state