Skip to main content
IX RWA has no ambient owner. Every privileged action is a named, least-privilege role, and the authority to change code or parameters is explicit and on-chain. This page is the single reference for who can do what, and how that control decentralizes on the way to mainnet.

​
Roles & permissions

Roles are separated by design: the key that feeds revenue cannot upgrade contracts, the keeper that processes redemptions cannot move NAV, and no single key holds everything.

​
Upgrade authority

Core contracts are UUPS proxies: implementations can be upgraded without changing addresses or migrating balances, and every _authorizeUpgrade is gated by UPGRADER_ROLE. On testnet, upgrade authority is held by the protocol admin for iteration speed. At the audited Phase-2 redeploy, UPGRADER_ROLE and DEFAULT_ADMIN_ROLE move to a multi-signature wallet behind a timelock, so upgrades require multiple signers and a public delay before they can execute. The governance-hardening test suite exercises exactly this: an upgrade reverts without the timelock and succeeds only via the timelock after its delay, the deployer renounces its standalone control, and the multisig can pause and set parameters.

​
Emergency controls

These are containment tools, not backdoors: none of them can move user funds to an arbitrary address, and all are visible on-chain.

​
Parameter changes

Fee parameters (entry, exit, management, reserve floor) and pointers (oracle, reserve, fee recipient) are admin-settable, bounded (bps capped at 100%), and emit events (ParamsSet, FeeRecipientSet, ReserveSet). The streaming management fee is settled at the old rate before any change, so parameter updates never apply retroactively. See Fees & terms.

​
Decentralization path

1

Now (testnet)

Single protocol-admin key for fast iteration; all actions on-chain and event-logged.
2

Phase-2 (audited mainnet)

Admin and upgrader roles move to a multisig behind a timelock; the deployer renounces standalone control; the AttestorRegistry becomes the sole NAV writer.
3

Beyond

Progressive decentralization of attestation and parameter governance as the asset base and operator set grow.
Governance arrangements described for mainnet (multisig, timelock, role renouncement) are the target end-state. On testnet the protocol admin retains direct control for iteration. See the roadmap.