Security & Governance
Root authority is a 2-of-3 owner multisig. Validators hold none.
No operator backdoor
No validator — including the lead — can halt the chain, change a parameter, move funds, or bypass the timelock. There is no privileged path from a validator box into protocol control.
Root authority — 2-of-3 owner multisig
Every privileged change on Vordium is an OwnerOp: a structured operation signed by 2 of 3 owner keys. Nothing else can authorise a protocol change. Single-key action is not possible, and a single compromised owner key cannot move the protocol.
Validators hold zero admin power
Validators produce and vote on blocks. That is the whole of their authority. They cannot halt trading, alter fees, change caps, upgrade code, or touch the vault. The lead validator is not privileged — it holds exactly the same (zero) admin rights as every other node. Compromising a validator box yields block production, not control.
Three-speed timelock
Approved OwnerOps are queued publicly in the timelock. The delay is set by blast radius:
| Class | Delay | Examples |
|---|---|---|
| Routine | 48 hours | Parameter tuning, listing changes |
| High-impact | 7 days | Upgrades, custody or authority changes |
| Emergency halt | Instant | Halting trading to protect user funds |
Halts are deliberately the only instant action, and a halt is safety-only: it can stop activity, never move funds or change ownership. Everything that could change value or control waits out its delay in public, where anyone can watch the queue.
What this means in practice
- Every privileged change is signed 2-of-3 and publicly queued before it executes.
- There is no unilateral actor — not an owner, not a validator, not an operator.
- Observers get advance notice of every non-emergency change.