Governance
Multyr governance runs through Safes with separate roles: SAFE_GOV owns the vault and its configuration, SAFE_VETO can revoke pending changes, SAFE_GUARDIAN can pause. All Safes are deployed and verified on-chain on Arbitrum.
Governance entities
SAFE_GOV
3/5 multisig
Owner of the vault and governor of its configuration contracts (GlobalConfig, StrategyRouter, BufferManager, FeeCollector). Submits and accepts parameter changes itself.
SAFE_GUARDIAN
1/1 multisig
Vault guardian. Can pause the vault, instant withdrawals, and epoch closing and funding in one call, with a cooldown between pauses. Cannot unpause: only SAFE_GOV can.
SAFE_VETO
1/1 multisig
Vault vetoer. Can revoke a pending fee, performance-fee, delay, buffer-manager or router change before SAFE_GOV accepts it.
ROOT_TIMELOCK
Timelock
Timelock contract whose proposer, executor and canceller roles SAFE_GOV holds. It does not own the vault or its configuration contracts, which SAFE_GOV governs directly.
Capital Safes
Protocol capital is segregated by purpose. Treasury, Operations, and Safety Reserve do not share the same control path and do not hold user deposits.
Treasury Safe
Threshold: 3/5
Protocol-owned capital. Will hold 75M MTRY at TGE. Receives a portion of protocol fees.
Operations Safe
Threshold: 2/3
Operational expenses only: development, infrastructure, audits, and partnerships. Refilled from Treasury through governance proposal.
Safety Reserve Safe
Threshold: 2/3
Limited loss-absorption buffer funded from protocol fees. Currently minimal during the shadow testing phase and not an insurance mechanism.
Governance flow
SAFE_VETO can revoke a pending change until SAFE_GOV accepts it. The vault's minimum delay, which can be 0, decides whether there is a window to do so. SAFE_GUARDIAN can pause instantly; only SAFE_GOV can unpause.
Properties enforced on-chain
- Vault parameter changes are submitted, then accepted after the vault's minimum delay, read live from the vault; it can be 0
- Ownership, veto and pause authority sit with three separate Safes
- Segregated capital paths across Treasury, Operations, and Safety Reserve
- The guardian pause does not stop withdrawal requests or the payout of funded epochs; it stops epochs from closing and being funded until SAFE_GOV unpauses
- Safe signers, thresholds, and history verifiable on-chain
Stewardship
The Multyr Protocol operates under on-chain governance. Multyr coordinates development, security research, and protocol evolution, but it does not control user funds and does not have unilateral authority over protocol parameters.
Progressive decentralization
Governance is designed to evolve toward broader community participation over time. New mechanics and transitions will move through the governance framework described above.