Privileged controls
Some protocol actions are reserved for the protocol owner. This page lists them so you can judge the trust you place in BlockFinaX.
Upgrade authority
The pool and oracle contracts can be upgraded: the owner can replace their code while keeping their address and everything they store. This lets BlockFinaX fix problems and add features without moving users' funds.
New code can change any rule, including how funds move. An upgrade is the most powerful control in the protocol.
| Testnet | Mainnet | |
|---|---|---|
| Who can upgrade | BlockFinaX, for testing | A multisig owner, so several people must approve |
| Notice | Released as testing needs | A public delay before any upgrade takes effect, so users can review it and exit |
Emergency controls
| Control | Effect | What keeps working |
|---|---|---|
| Pause | Stops new pools, deposits and purchases | Withdrawals, settlement and payouts |
Other owner controls
| Control | Limit |
|---|---|
| Set fees | Each fee at most 10%, creator share at most 50%. Existing pools keep their fees. |
| Enable pairs | Only affects new pools |
| Set the pricing key | Affects new quotes only |
| Withdraw protocol fees | Only fees collected; not pool capital |
| Transfer ownership | Two steps: propose, then the new owner accepts |
Deposit addresses
Your Base deposit address is a contract with no owner and no admin:
- It can only send the real USDC it holds, and only to your own Stellar wallet, through Circle.
- BlockFinaX's server triggers that transfer, but cannot change the destination or take the funds.
- Any other token sent to it is ignored, never moved and never credited.
- The fee offered to Circle is capped at 0.1% of the amount, enforced by the contract.
The deposit contracts cannot be upgraded. A change would mean deploying new contracts and giving users new addresses.
Business accounts
A business account is controlled only by its members' passkeys, within their roles:
- BlockFinaX cannot sign for a business account, add or remove its members, or change their roles. Only the business's admins can, each change approved with an admin's passkey.
- The app and the relayer never send an upgrade of a business account's code, or an arbitrary call through it.
- The transfer allow-list policy that limits operators has no owner and no admin, and cannot be upgraded. A change would mean deploying a new policy and moving rules to it.
What the owner cannot do without an upgrade
- Settle a contract at a chosen rate.
- Change a contract after it is bought.
- Move an underwriter's capital or a business's payout.
Reporting a vulnerability
Report suspected vulnerabilities to BlockFinaX privately, not in public forums. Do not test against other users' funds.