[2601 Grant] SwaptoX Aggregator – Milestone 1

Grants & Incentives
78

Hi @Tane,

Following your feedback regarding centralized ownership risk, I’ve redesigned the admin model for SwaptoX to improve decentralization and security.

Background

Originally, SwaptoXRouter used a single owner model.
I initially considered adding multi-admin logic directly into SwaptoXRouter.

However, this approach caused the contract size to exceed the 24KB limit, making deployment impossible.
In fact, the current Router is already close to the limit, and I had to remove some view functions to fit within constraints.

Design Decision

Instead of embedding admin logic into the Router, I introduced a separate governance contract:

SwaptoXTimelock

  • SwaptoXRouter remains unchanged (logic + storage)
  • SwaptoXTimelock becomes the sole admin of the Router
  • All admin operations must go through the Timelock

This separation:

  • avoids contract size limits
  • improves modularity
  • follows established governance patterns

Governance Model (SwaptoXTimelock)

Multi-owner control (3 owners)

All admin actions follow:

  1. Propose (by owner A)
  2. Timelock delay (3 days)
  3. Execute (by owner B, must be different from proposer)

Cancellation rules:

  • Proposer can cancel anytime
  • Other owners can cancel after 6 days

This ensures:

  • no single owner can execute actions
  • operations are transparent and delayed

Guardian mechanism (failsafe only)

The guardian is NOT part of normal governance.

It is only designed for extreme scenarios, such as:

  • 2 out of 3 owners permanently unavailable (lost keys, inactivity)

Activation

  • Any owner can propose activation
  • Requires a 10-day delay
  • During this period, ANY active owner can cancel

Implication:

  • If governance is functional (≥2 active owners), guardian CANNOT be activated

Guardian capabilities

Once activated:

  • Guardian can ONLY propose ownership replacement
  • These proposals are:
    • delayed by 30 days
    • cancellable by any owner during the entire period
    • executable only by an owner

Additionally:

  • Guardian is automatically disabled after execution

Security Properties

  • Guardian cannot execute actions
  • Guardian cannot bypass timelock
  • Guardian cannot override active governance
  • Guardian only restores liveness when governance is stalled

Trust Assumptions

  • Under normal conditions, at least 2 owners are honest and responsive
  • If 2 owners collude maliciously, they can control the system (same as standard multisig)
  • Guardian only activates when governance is no longer operational

Summary

This design:

  • removes single-owner risk
  • introduces delayed, multi-party governance
  • adds a bounded recovery mechanism without introducing backdoors

Please let me know if you have any concerns or suggestions.

Code:

2 Likes