PaboxoGovernance & admin
Who can change Paboxo and what they can do, read from the chain.
Everything on this page is read from Robinhood Chain mainnet (chainId 4663), with the block it was read at, so you can check it yourself with any RPC.
The protocol Safe
Admin power over Paboxo sits with one Safe multisig, the protocol Safe:
0xeA39Abc1381c6f3f54356A4A9FEE926722Ba8263
It is a 2-of-4 Safe: getThreshold() returns 2 and getOwners() returns four addresses (read at
block 114333553). No Safe module and no transaction guard is set (block 114333553), so nothing can
execute through the Safe without two owner signatures. The Safe also receives the protocol fee.
Who holds which role
Every role on every mainnet contract, grouped by kind of contract. "Protocol Safe" is the Safe above, and "Pauser key" is the key that can only pause (see the pauser).
The table is the role snapshot at block 113202590, built by replaying every role, ownership and
upgrade event of these contracts and then checking each holder on-chain with hasRole() and
owner(). No role, ownership or upgrade event was emitted by any of them between that block and
block 114329614.
| Contracts | Count | Role → holder |
|---|---|---|
| Lending pool factories | 2 | owner(): Protocol SafeDEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol SafePAUSER_ROLE: Protocol SafeMARKET_CREATOR_ROLE: Protocol Safe |
| Lending pools | 12 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol SafePAUSER_ROLE: Pauser key |
| Lending pool routers | 12 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol Safe |
| Interest rate models | 2 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol Safe, a lending pool factory |
| Health checks (IsHealthy) | 2 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol Safe |
| Price data streams | 2 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol Safe |
| Price-feed adapters | 11 | owner(): Protocol Safe |
| Market calendar | 1 | owner(): Protocol Safe |
| Earn vault (USDG) | 1 | CURATOR_ROLE: Protocol Safe |
| Earn vault factory | 1 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol SafeVAULT_CREATOR_ROLE: Protocol Safe |
| LP collateral config | 1 | owner(): Protocol Safe |
| Event emitters | 2 | DEFAULT_ADMIN_ROLE: Protocol Safe, a lending pool factoryUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol SafeADMIN_ROLE: Protocol Safe, a lending pool factory, the lending pools |
| Retired feed adapters (read by no market) | 4 | owner(): Pauser key |
| Borrower positions | 6 | DEFAULT_ADMIN_ROLE: Protocol SafeUPGRADER_ROLE: Protocol SafeOWNER_ROLE: Protocol Safe |
What the roles do:
| Role | Lets the holder |
|---|---|
DEFAULT_ADMIN_ROLE | grant and revoke the other roles on that contract |
UPGRADER_ROLE | upgrade the contract's code (they are UUPS proxies; the address stays) |
OWNER_ROLE | change the contract's settings: risk and rate parameters, price feeds, fees, caps; on a lending pool, also unpause it |
PAUSER_ROLE | pause; on a lending pool, pause only (see below) |
MARKET_CREATOR_ROLE | list a new market through the factory |
VAULT_CREATOR_ROLE | create an Earn vault through the vault factory |
CURATOR_ROLE | choose which markets the Earn vault lends to, and their caps and queues |
ADMIN_ROLE (event emitter) | emit protocol events; held by the contracts that emit them |
owner() | the single owner of a contract without roles: feed adapters, the market calendar, the LP config |
Some contracts hold roles themselves: a lending pool factory sets each new market's rate curve on its interest rate model, and it lets each new lending pool report events through the event emitter.
The Earn vault's upgrade right is not stored in the vault. It resolves on every call to the Earn
vault factory's vaultAdmin, which is the protocol Safe (read at block 114329614).
The four retired feed adapters are the launch adapters that were replaced. Neither price data
stream reads them: for every asset, tokenPriceFeed() returns one of the current adapters listed
on contracts (read at block 114329614), so they change no price
the protocol uses.
The pauser
Pausing is instant by design. A pauser key holds PAUSER_ROLE on every lending pool so that a market
can be stopped in one transaction, without waiting for two Safe signatures, if something goes wrong.
- A paused market stops supplying, withdrawing, borrowing, repaying and liquidating. Interest keeps accruing while it is paused.
- The pauser cannot unpause. Resuming a market takes the Safe (
OWNER_ROLE); the pauser key can stop a market but cannot change, move or upgrade anything.
Every other admin role moved to the Safe on 4 November 2026 (block 105757627); see contracts.
History of admin changes
The protocol Safe has executed 18 transactions (its nonce() at block 114333553). The ones that
changed something for users are recorded on status, with their blocks:
- 12 October 2026: mainnet launch, the starting parameters;
- 22 October 2026: SPCX/USDG and TSLA/USDG listed;
- 23 October 2026: per-market rate curves and listing seeds returned to the vault;
- 26 October 2026: contract upgrade;
- 27 October 2026: MSFT/USDG and AAPL/USDG listed;
- 9 November 2026: LP collateral;
- 13 November 2026: QQQ/USDG, GOOGL/USDG and AMD/USDG listed.