Governance and administration
No token. One key, for now, and a list of what it cannot do.
Elysta has no governance token and promises none. This page says who administers the protocol today, exactly what the contracts let an administrator do and refuse, and how that changes before any real collateral.
There is no governance token
Elysta has no token, no points, no airdrop and no plan for any of them in the delivered scope. The thesis lists “governance, if adopted” under Phase 8, ecosystem expansion, as a possibility to be decided after mainnet, not a commitment. Anything claiming to be an Elysta token is not from Elysta.
Current administration
The role holders recorded in the deployment this build was compiled with.
No deployment is recorded for chain 99901 in this build.
Addresses, explorer links and role holders appear here once the contracts are deployed to the configured network and the deployment record is generated (pnpm abi). Nothing is shown in their place.
This build is configured for chain 99901, for which no deployment record exists, so no role holder can be named here. On a deployed network this section lists the administrator, the keeper and the deployer with explorer links.
What an administrator can do
Every administrative action in the five contracts, the function behind it and what it does to traders.
| Action | Function | Role | Effect |
|---|---|---|---|
| Pause deposits | vault.pause() / unpause() | PAUSER_ROLE | Deposits revert with EnforcedPause. Withdrawals, trading and settlement continue. |
| Pause withdrawals, bounded | vault.pauseWithdrawals(until), until ≤ now + 3 days | PAUSER_ROLE | Withdrawals revert with WithdrawalsPaused(until). The bound is MAX_WITHDRAWAL_PAUSE in the code; a longer pause reverts with PauseTooLong. |
| Pause new orders and matching | orderBook.pause() / unpause() | PAUSER_ROLE | placeOrder and replaceOrder revert; cancelOrder, cancelOrders and cancelExpired keep working so reservations can always be released. |
| Pause a market | registry.setMarketStatus(id, Paused, Admin) | PAUSER_ROLE or MARKET_MANAGER_ROLE | No orders or matching in that market; liquidation stays possible while the index is valid, so an under-margined position is not protected by a pause. |
| List a market | registry.addMarket(input) | MARKET_MANAGER_ROLE | The market starts Inactive and is activated only once its oracle has produced a valid price (Activate.s.sol does this on a public network). |
| Change parameters | setExecutionParams, setRiskParams, setFeeParams, setSession, setHoliday; setOracleParams | MARKET_MANAGER_ROLE; ORACLE_MANAGER_ROLE | Within the bounds the registry validates. Every change is an event. See the parameter change policy below for what each one does to open positions. |
| Set a market's status | setMarketStatus to Inactive, Active, ReduceOnly or Paused | MARKET_MANAGER_ROLE | ReduceOnly lets positions close without new exposure. Setting Active also lifts a bad-debt halt, which is the deliberate manual step after the insurance fund is replenished. |
| Clear an oracle halt | registry.clearOracleHalt(id, acceptPending) | ORACLE_MANAGER_ROLE | Lifts a halt caused by a stale or deviating feed after review; may adopt the pending adapter price but cannot write one. |
| Adjust matching limits | orderBook.setMatchingLimits(limits) | DEFAULT_ADMIN_ROLE | Fills and levels per transaction, open orders per account. Non-zero only. |
| Sweep protocol fees | vault.sweepProtocolFees(to) | TREASURY_ROLE | Transfers the protocol share of trading fees. Reads only protocolFees; cannot touch collateral or the insurance fund. |
| Fund the insurance fund | vault.fundInsurance(tokenAmount) | anyone | The only way the fund grows other than fee shares and penalties. Not an administrative power, but the one used to lift a bad-debt halt. |
| Grant and revoke roles | grantRole / revokeRole / renounceRole | DEFAULT_ADMIN_ROLE | The hand-over to a multisig is done this way: grant every role to the new administrator, then renounce from the deployer. |
What it cannot do
Per the Solidity, not per policy. Each line names the code that enforces it.
Change any account's available, reserved or locked collateral
The ledger functions are callable only by the risk engine contract, and each moves value between two terms of the vault equation. No function sets a balance.
Place, fill or cancel another account's orders
placeOrder, cancelOrder and replaceOrder act on msg.sender's orders; applyFill is callable only by the order book during matching.
Write an index price or settle at a chosen price
Prices enter only through refreshIndex reading an adapter and passing validation. Fills settle at the resting order's price; liquidation and funding at the mark the engine derives.
Withdraw from the insurance fund
No function exists. It can be funded and it can cover losses; it cannot be paid out in this version.
Hold withdrawals for longer than three days per call
pauseWithdrawals reverts with PauseTooLong beyond MAX_WITHDRAWAL_PAUSE. Deposits can be paused outright; withdrawals cannot.
Set a market to Halted
Only the risk engine may, and only when bad debt is recorded. Administrators pause; the protocol halts.
Rebind the order book to the risk engine
setOrderEngine reverts once an engine is set (OrderEngineAlreadySet).
Mint settlement collateral
The vault counts only tokens it received. The test token's MINTER_ROLE can mint tUSD, which has no value; a deployment that settles in a real token does not include it.
The one real power, stated plainly
The planned path
From a single administrator key to a multisig with a timelock. The code for the hand-over exists; the multisig does not yet.
Today, on Elysium mainnet
One administrator key holds DEFAULT_ADMIN_ROLE and every administrative role on all five contracts; the keeper key holds UPDATER_ROLE on the keeper adapter. The deploy script leaves the deployer in charge when no ADMIN_ADDRESS is given, which is acceptable only while the collateral has no value.
Hand-over
Deploy.s.sol's hand-over grants DEFAULT_ADMIN_ROLE, PAUSER_ROLE and TREASURY_ROLE on the vault, every registry role, and the admin and pauser roles on the engines to ADMIN_ADDRESS, then renounces each of them from the deployer in the same run.
Before real collateral (Phase 3)
A multisig as ADMIN_ADDRESS, with a timelock in front of parameter changes so that a change is visible before it takes effect; a decentralised oracle adapter replacing the single-updater keeper adapter; controlled activation of markets; production risk parameters; and operational incident procedures.
Later (Phase 8), if adopted
Governance is listed in the thesis as a possible ecosystem expansion. It is not designed, not scheduled and not promised.
Phase 3 on the roadmap is in progress with no calendar date. Its administration deliverable, “Multisig and timelock administration”, is not yet done.
Parameter changes
What a change does to open positions, and the gap between what the code enforces today and what a timelock will add.
The registry validates every parameter set (fees at most 1%, funding cap at most 5% per interval, liquidation fee below the initial margin fraction, intervals between one minute and one day, heartbeat at most a day, reopening deviation at least the normal deviation) and records every change as an event: ExecutionParamsUpdated, RiskParamsUpdated, FeeParamsUpdated, OracleParamsUpdated, SessionUpdated, HolidaySet. A change takes effect in the block that includes it; there is no notice period in the code today. That is the gap the timelock in Phase 3 closes, and until then collateral of no value is the mitigation.
| Parameter | What a change does |
|---|---|
| Initial margin fraction | Applies to the next fill that opens or increases exposure, to removeMargin, and to the partial-liquidation target. Existing positions are not re-margined. |
| Maintenance margin fraction | Applies to the next liquidation check. Raising it can make an open position liquidatable immediately. |
| Maker and taker fees, insurance share | Apply to the next fill. Resting orders reserved the old taker fee; the fill charges the new one, and the risk engine checks the maker can still afford it. |
| Funding interval and cap | Apply at the next settlement; the current window continues to accrue. |
| Liquidation fee and liquidator share | Apply to the next liquidation. |
| Tick, lot, order size limits, price band, impact, mark band | Apply to the next placement. Resting orders keep their price; the book's tick grid is per market and unchanged in practice. |
| Position and open-interest caps | Apply to the next fill that would increase a position or a side's open interest. Positions already above a lowered cap are not closed; they can only be reduced. |
| Oracle parameters | Apply to the next refreshIndex. A tighter heartbeat can halt a market at the next refresh. |
| Session and holidays | Apply to the next isSessionOpen check, which every placement makes. |
The launch parameters and the policy behind them are documented on the markets and sessions page. They are launch values chosen per asset class, not a claim about production risk limits.
Incident process
What the protocol does by itself, what an operator can do, and where to look.
Automatic responses
- Stale or deviating price: the registry halts the market at the next refresh (
MarketStatusChanged, reasonOracleStaleorOracleDeviation) and lifts the halt itself when a valid price returns (OracleRecovered). No orders, matching, liquidation or funding settlement happen in between; cancellation still works. - Bad debt: the risk engine halts the market (
BadDebt) in the transaction that recorded the shortfall. The halt is not lifted automatically. - A revert anywhere in a fill: the whole transaction reverts, so the book never shows a trade that did not settle.
Operator responses, bounded by the code
- Pause new orders and matching, pause deposits, pause a market, or set it reduce-only, while an issue is investigated. Cancellation and (outside a bounded withdrawal pause) withdrawal remain available throughout.
- Pause withdrawals for at most 3 days per call, the bound the thesis asked for so that an investigation can fit but user funds cannot be held indefinitely.
- Review and clear an oracle halt, or leave it to recover on its own.
- After bad debt: replenish the insurance fund with
fundInsurance, then set the market Active again. Nothing erases the recorded bad debt figure.
Where to look
The status page shows every market’s status and oracle health, the vault’s balance check and bad debt, and the health of the indexer, keeper, API and WebSocket, refreshed every ten seconds. The reasons for every status change and every settlement are events anyone can read; the event specification says which.
What does not exist yet