What is immutable
The lending core has no upgrade mechanism, no pause button, no backdoor. Each market’s defining parameters — collateral asset, oracle, interest model, LLTV — are fixed forever at creation. Nobody, including the Denar team, can change the rules of a market you have already entered. Changing oracle behavior requires deploying a new market and letting users migrate by choice.What the admin can do — and the hard limits
The table above describes the equity vault. The on-chain-native markets use a Vault V2, whose role model differs in two ways worth knowing: caps are set per id — one cap can cover every market sharing a collateral, including markets Denar did not create — and the guardian is replaced by a sentinel, a role that can only revoke pending actions, cut caps and pull funds out of a market. A sentinel can never raise a cap or add a market, so it is safe to run continuously.
The timelock: depositors’ early warning
Every action that increases lender risk — raising a cap, adding a market to the vault — sits in a public pending state for 1 day before it can take effect. Anyone watching the chain sees it coming and can exit first. Actions that decrease risk (cutting a cap, down to zero) execute instantly. The timelock itself cannot be set below 1 day or above 2 weeks. Timelocks are configured per vault. The Denar USDG vault V2 (dnUSDG2, formerly Frontier) runs without a delay on adapter additions and cap increases, so that a new market or a higher cap is a same-day decision while the vault is small; the delay is added before it takes outside deposits at scale. Cuts are instant in both vaults, always.
Trust assumptions
Current administration, honestly
Admin roles are currently held by the deploying address — a single key, publicly identifiable on the Contracts page. This is a deliberate bootstrap choice for the seed phase, made viable by how little the admin can actually do (see the table above) and by the tiny caps. The hardening path, in order: a dedicated operational key for the liquidation bot, then a multisig for the owner and curator roles, then a separate guardian with veto-only power over pending risk increases — each step planned before caps rise meaningfully.The strongest guarantee is structural, not procedural: the vault is ERC-4626 non-custodial and the core is immutable. “The admin curates risk but never custodies funds” is a property of the code, not a promise.