Who can do what

This chapter lists every key that can do something the public cannot, and the limit the code puts on it. No contract is behind a proxy, so none can be upgraded.

Keys at a glance

DeployRobinhood refuses to run if the hedger or keeper is the deploying key, or the owner is unless OWNER_IS_DEPLOYER=1 is set. It also refuses if the owner is a hot key, if a funder is the owner or a hot key, or if the two hedged vaults share a funder.

The owner

• ProtocolConfig. Pause the venue. Set the protocol share of every pool swap fee, at most 50 %. Name the fee collector. Set DLMM presets, for new pairs only. Create DLMM and stock vaults, name their keeper and rebalance them.
• AssetRegistry. List or delist a stock, choose its Chainlink feed and heartbeat, its fees (at most 1,000 bps), its band, the session hours and holidays.
• Fee collectors. Set conversion routes, a slippage bound of at most 20 %, and where ETH goes. Sweep a token with no route. FeeCollectorV2 can never sweep $ZKD.
• BuybackV2. configure the pool once. Set the per-call cap, a reward of at most 5 %, and the price guard. It cannot take the ETH the contract holds.
• PerpMarketRegistry. Add a market, tune it inside hard bounds, set it reduce-only or delist it, stop new opens, and list a market holiday with notice. It cannot touch a position, a margin or the money in the vault or insurance fund, change a feed, raise a maintenance margin or stop a close.
• LaunchConfigRegistry. Write launch templates inside hard bounds. A change only affects later launches, and nothing here reaches a live curve. setSealedOpeners names the sealed lane's opener list once, at deploy.
• ShieldedPool. setDepositsOpen, and nothing else. Spending, withdrawals and private actions stay open, and the fee is fixed at deploy.
• SealedMarkets. Add a market inside hard bounds, name its keepers, stop it taking new orders, and set the market a launch's batch copies. A market's terms never change once added. It cannot reach an order or move funds: claims and refunds stay open.

The pause stops swaps and liquidity adds on DAMM and stock pools, DLMM swaps, deposits and new pairs, deposits and rebalances in DLMM and stock vaults, and new DLMM limit orders. Two owner calls still reach providers indirectly: a wrong feed moves a stock pool's band, and delisting an asset stops swaps in its pools until it is listed again.

Contracts with no owner

The vaults and VaultFactory, both zaps, RangeOrders, PositionKeeper, LaunchPipeline, PreMarketPerp, FeeRouter and ReferralRegistry have no owner and no pause switch. Nor do the Router, the DLMM limit orders, LaunchPools, LaunchVault, LaunchFactory, GraduationManager, the perps engine outside its registry, the private action adapters and SealedBatches.

A vault pays out only to whoever redeems its shares, and its cap and policy are set once. Referral links are write-once. LaunchPools and LPAllocationEscrow hold launch liquidity with no function that removes it.

The hedger and the funder

A hedged vault cannot see its Lighter position, so it believes the hedger's reportHedge. The band limits each report, not a series of them, so reports inside it can walk the price. The same key can also pause a vault's exits by reporting a jump or by going quiet.

fundHedge can only post USDG to the one Lighter deposit contract fixed at creation, credited to the funder's own account. Whoever holds the funder key can withdraw whatever margin is on Lighter. See Where the margin lives.

Order keys and trading sessions

The signer signs nothing without a current mark and applies its order checks to every order type. A trading session lets a key in one browser tab sign orders and cancels for at most 24 h, and it can never withdraw or bind a key.

Relayers and sealed batch keepers

A relayer submits a proof and takes a fee from the note. The proof binds the recipient, relayer and fee, so a relayer can only send it or drop it. Anyone can run one, and each keeps its own list of what it will spend gas on: by default the adapters and tokens of the deployment, launches of the launchpad and pairs of the venue's factory. The pool has no adapter allowlist, because an adapter only receives what a valid proof from the note's owner sends it. If a relayer does not answer or refuses, you can choose to send the spend from a fresh address.

A sealed batch keeper holds a share of each order's amount and publishes only the sum. The contract checks the total, so keepers can stall but cannot lie. If they stall the batch is void, and each order can take its input back as a new note. All 3 together could read per-order amounts, not who placed them. At launch one operator runs all 3, and keys rotate by adding a new market. See Sealed batches.