Profiles and access control

Who may change a strategy, and how fast, is decided by roles. A role is the permission to call a set of the contract's functions, with a delay attached. A profile is the account that holds one or more roles, and each stock's page lists them under Maintenance. Knowing the profiles tells you who can change the strategy, and how fast.

Key points

• The curator changes settings, such as venues, stablecoins, price feeds and the fee, and every change waits the curator's delay.
• The operator runs positions day to day without delay, within what the curator has registered. On tango.finance an automated curation service holds this role.
• The admin holds every role at its holder's delay, and through two guardian roles can remove the curator or operator, and cancel their scheduled changes, at once.
• No role can upgrade the contract, set share value, or send holders' stock or stablecoins to an address of its choosing.

How access works

The vault that holds each stock (see Using a vault) is governed by an OpenZeppelin access manager, a standard contract that controls who can call each restricted function. Every restricted function of the vault and its price oracle belongs to one role. A role's holder may have an execution delay: they schedule a change, wait, and only then carry it out. See Timelocks.

Everything holders do needs no role: supplying, withdrawing, forcing a withdrawal, donating, and reading any position or quote.

Profiles

The admin holds both guardian roles. The account that deployed the contract holds no role once deployment is done.

Admin

The admin is the top authority. It holds the access manager's admin role at the curator's delay, so changing the admin role, a role's delay, which role calls a function, or the access manager that governs the contract waits that long. It also holds the curator role at the curator's delay and the operator role at none, so it can do anything either can, but no sooner.

Through the guardian roles, it can remove the curator or the operator at once, and cancel any change they have scheduled. It can appoint a new operator at once. A new curator it appoints can act only once the curator's delay has passed.

Curator

The curator configures what the strategy may use. Every one of its actions waits its delay:

• add or remove a registered stablecoin;
• add a lending venue or a borrow venue;
• abandon a borrow venue that can no longer be read;
• set or remove a price feed on the oracle;
• set the swap and harvest tolerances, each at most 5%;
• set the performance fee, at most 25%, and its recipient;
• set the Merkl distributor that rewards are claimed from;
• raise the deposit cap.

It cannot move positions, swap, harvest or lower the deposit cap.

Operator

The operator runs the strategy within what the curator has registered, without delay:

• supply and withdraw collateral, borrow and repay;
• lend to and redeem from lending venues;
• swap between registered stablecoins, harvest profit into stock, and rebuy stock after a liquidation;
• set the release order and the lending order;
• remove a lending or borrow venue once it is empty;
• claim rewards and forward them;
• lower the deposit cap.

It cannot add venues, stablecoins or price feeds, change tolerances or the fee, or raise the deposit cap.

Curator guardian and operator guardian

Each guardian role can revoke its role's holder and cancel that role's scheduled changes, without delay. It can also appoint a holder, subject to the role's own appointment delay. For every stock, the admin holds both.

The curation service

On tango.finance, an automated curation service holds the operator role for every stock. It reads each position on a short schedule, chooses at most one action at a time for each stock, simulates it and sends it. It acts in a fixed order of priority:

The service decides on interest rates alone. It does not count reward programs, since rewards arrive only once they are claimed. Its limits are settings of the service, not of the contract, and the contract still checks every action it sends.

What no role can do

No role can:

• upgrade the contract, since its code cannot be changed after deployment;
• set or change share value, which is counted from stock alone;
• send holders' stock anywhere except to a registered borrow venue as collateral or to a holder who withdraws;
• send counted stablecoins anywhere except to registered venues, the swapper, the fee recipient as a fee, or a holder as part of a forced withdrawal;
• make a borrow venue call any contract other than its own protocol;
• take a harvest larger than the book's surplus, or swap at a loss beyond the tolerance against oracle prices;
• set the performance fee above 25% or a tolerance above 5%;
• charge a deposit or withdrawal fee;
• pause deposits and withdrawals, since the contract has no pause.

Trust that remains

These limits narrow what each role can do. They do not remove the need to trust the holders of the roles:

• The operator decides how much to borrow, where to lend, the release order, swap routes and when to harvest. A poor choice can cost holders, within the contract's checks.
• Once its delay passes, the curator can add venues, stablecoins and price feeds, or raise the fee up to its cap. A badly built borrow venue could call any function of its own protocol in the contract's name.
• The admin can replace the curator and the operator. It chooses the delay a new curator works under, and the appointment is public before the new curator can act.
• Rewards reach holders only if the operator claims them and brings the proceeds back.

The addresses that hold each role, and their delays, are shown under Maintenance on each stock's page. See Risks.