An onboarding guide for signers, engineers, reviewers and everyone who needs the picture.
Technical adds contract addresses, exact permissions, function signatures and implementation notes.
Hypothetical draft. This page shows a design under discussion for an active treasury vault of the Lido DAO. Nothing is deployed, and nothing is ratified: no Lido body has approved it, and it authorises no action. Every number, address and parameter is a draft that can change. It is not financial, legal or investment advice. Every element carries its status, and every claim links to its source in the public repository.
After this guide you can
Name who can move the vault's funds, and who can stop them.
Walk any emergency to its first action, and say how long it takes.
Tell what Clutch reuses from audited code and platforms, what it adds, and why.
Find the source of any claim on this page.
The system on one page
Arrows point from the account that acts to the account it acts on. Colour shows who it is, the border shows whether it is new, and the icon shows its kind. Aragon Voting also owns the boxes marked "Voting owns it"; only the Asset Safe's ownership has an arrow. Select a box to see its actors, or play a flow to watch it move.
Lido DAO governance
Multisigs held by people
The vault's contracts
External protocols and services
Solid border: exists today
Dashed border: new, or partly new
Governance body
Multisig Safe
Contract
Off-chain service
External protocol
Owns, holds, uses or has a role (solid)
Governs, pays or creates motions (thin grey)
Screens or watches (dotted)
Safety action (dash-dot)
Same signers (round dots)
The map as a list
Boxes
Box
Status
What it is
Committee Safe
Exists today
The committee's existing Safe. It holds the operator role and is the trusted caller of every factory. Two of its signers sit on the emergency Safe.
Lido DAO
Exists today
The final authority. Aragon Voting is the only owner of the Asset Safe; the Aragon Agent, the treasury, receives every recovered asset.
Funding path
Existing and new parts
Moves money from the DAO treasury to the Asset Safe through Easy Track top-up motions, within monthly limits.
Easy Track
Existing and new parts
Lido's optimistic governance. A motion enacts unless LDO holders object within 72 hours. It holds the governance role.
Emergency Safe
New instance of existing code
Holds the emergency role and the switch. Two committee members, two Emergency Brakes members and one member of neither body sign it, so the committee cannot use it alone. It can only reduce exposure: revoke, switch off, exit, sell into stablecoins and send assets home.
Screening guard
New instance of existing code
A transaction guard on the committee's Safe (OD-83). It refuses any transaction that the vendor has not approved once. It is set after the launch; the launch cap lifts once it is live (OD-54).
Operator modifier
New instance of existing code
A Zodiac Roles modifier. It lets the operator do only what the policy lists, within budgets.
Safety modifier
New instance of existing code
A second Roles modifier for the emergency role, the switch included. Nothing screens it, so recovery never waits on a vendor. Its exit-governance role, which is specified, lets the motion that onboards a protocol add its emergency exit here.
Policy pipeline
Existing and new parts
The permission policy as a Zodiac constellation, compiled by Clutch's own compiler into a committed artifact that votes and tests use.
Asset Safe
New instance of existing code
The vault. A Safe that holds the assets. Only Aragon Voting owns it; the roles act through the two modifiers.
First-loss Safe
New instance of existing code
A Safe that Aragon Voting owns. It holds only the DAO's first-loss Earn shares. On the Earn team's written instruction, an Easy Track motion burns them, or a role of the committee's Safe redeems them to the Agent.
Approved protocols
Exists today
Where the vault puts assets to work: stETH and wstETH, earnETH and earnUSD, and Sky's sUSDS and converter.
Orders account
Existing and new parts
A Safe that Aragon Voting owns, with one modifier of its own. The roles place CoW orders from it: the operator's orders pay the Asset Safe, and recovery orders pay the Aragon Agent.
Monitoring
Existing and new parts
Watches the vault, the liquidity buffer, the orders, the motions and the Safes, and pages the right body when something is wrong.
Reporting
Existing and new parts
Monthly reports and fortnightly cap readings, published on IPFS and cited on the forum. Each report shows the caps and the liquidity buffer; no contract checks them.
Arrows
From
To
What it means
Lido DAO
Asset Safe
Aragon Voting is the Asset Safe's only owner, at 1 of 1. In an emergency, assets go back to the Aragon Agent, the DAO's treasury, a fixed address.
Asset Safe
Operator modifier
The Asset Safe owns the operator modifier and enables it as a module. A permitted call runs as the Asset Safe.
Asset Safe
Safety modifier
The Asset Safe owns the safety modifier and enables it as a module. A permitted call runs as the Asset Safe.
Committee Safe
Operator modifier
The committee's Safe holds the operator role on the operator modifier.
Emergency Safe
Safety modifier
The emergency Safe holds the emergency role on the safety modifier.
Easy Track
Operator modifier
Easy Track's script executor holds the governance role on the operator modifier. An enacted motion acts through it.
Committee Safe
Easy Track
The committee's Safe is the trusted caller of every Clutch factory: it creates the motions.
Lido DAO
Easy Track
LDO holders can object to any motion within 72 hours. An objection of 0.5% of the supply stops it.
Committee Safe
Emergency Safe
Two of the committee's signers sit on the emergency Safe. The committee cannot act alone there.
Screening guard
Committee Safe
From the lift of the launch cap, the vendor's guard on the committee's Safe refuses a transaction that the vendor has not approved, once and exactly.
Safety modifier
Operator modifier
The emergency role can revoke the operator's permissions, and its switch can disable the operator modifier.
Asset Safe
Approved protocols
The Asset Safe deposits, stakes, converts and redeems in the approved protocols. Receivers are pinned to the Asset Safe.
Asset Safe
Orders account
To swap, a role sends a token to the orders account and places a CoW order there. The operator's transfers spend its orders budgets. The operator's orders pay the Asset Safe; recovery orders pay the Aragon Agent.
First-loss Safe
Approved protocols
The first-loss Safe holds the DAO's first-loss shares in earnETH and earnUSD. Only an enacted motion burns them, and only the committee's narrow role redeems them to the Agent.
Easy Track
Funding path
A top-up is an Easy Track motion created by the committee's Safe.
Lido DAO
Funding path
Aragon Finance pays from the DAO treasury held by the Aragon Agent.
Funding path
Asset Safe
A top-up pays the Asset Safe only, within a monthly limit per funding registry.
Monitoring
Asset Safe
Monitoring watches the vault: drift from the policy, approvals, budget burn, the liquidity buffer, orders and fills, owners, modules and motions.
Monitoring
Emergency Safe
Monitoring pages the emergency Safe when the cap-breach trigger is met, for a defect in the permission layer, or for a financial emergency.
Asset Safe
Reporting
Reports start from snapshots of the Asset Safe's holdings at a pinned block.
Guided tour
Scene 1 of 10
The vault, and who owns it
Clutch puts a bounded part of the DAO treasury to work in approved protocols. The assets sit in one new Safe, the Asset Safe.
The Asset Safe has exactly one owner: Aragon Voting, the DAO's vote. The DAO keeps custody. In an emergency, assets go back to the Aragon Agent, the DAO's treasury, a fixed address.
Aragon Voting also owns two smaller Safes: the orders account, which places swap orders, and the first-loss Safe, which holds the DAO's first-loss shares apart.
The Asset Safe is a Safe v1.5.0 proxy. Aragon Voting is its only owner, at a threshold of one, and it has no guard and no fallback handler. Voting approves each transaction by approveHash, or sends it itself, without Dual Governance (INV-001, OD-73).
The Asset Safe switches on two Roles modifiers from Zodiac. Each holder of a role calls a modifier. The modifier checks the call against the policy and, if it is allowed, runs it as the Asset Safe.
The policy is default-deny: a call that the policy does not list is refused.
The modifiers are EIP-1167 proxies of the deployed, locked Roles mastercopy. The Asset Safe is their owner, avatar and target.
The Treasury Management Committee runs the vault through its existing Safe, at 4 of 7, which holds the operator role. The operator can enter and leave approved protocols, within budgets.
It cannot move assets out: every receiver, owner and beneficiary in its operator permissions is the Asset Safe. Its one other role, on the first-loss Safe, redeems the first-loss shares to the Aragon Agent. A burn of them is an Easy Track motion that it creates.
The committee's Safe, on Safe v1.3.0, calls execTransactionWithRole on the operator modifier with the role key bytes32("operator"); a batch goes through Safe's MultiSendCallOnly v1.3.0. Every receiver, owner and beneficiary is pinned with EqualToAvatar (INV-003).
[the screening vendor]'s guard sits on the committee's Safe. It refuses any transaction that the vendor has not approved, once and exactly, the committee's other duties included (OD-83).
If the vendor stops, the operator stops too: the guard fails closed. Recovery does not change, because no guard sits on the emergency path.
At launch the guard is not set yet. The vault starts under a launch cap of one million dollars, and the cap lifts once the guard is live (OD-54).
A transaction guard on the committee's Safe. The vendor's key approves each exact transaction on chain, once, before it runs; a transaction without an approval reverts. The owners can remove the guard only through a 10-day timelock. Its bypass mode stays off: turning it on needs the vendor's approval and a 10-day timelock (INV-010).
The committee can widen its own permissions only through Easy Track motions, each built by a fixed template. LDO holders have 72 hours to object, and 0.5% of LDO stops a motion. This window is the timelock for every structural increase of exposure, such as a new target or a higher budget.
At enactment, the governance role writes the change. The modifier checks that write again: no role change, no delegatecall, and no administrative target. The Asset Safe and its modifiers are refused as targets. The same motion gives the emergency role an exit from what it onboards.
The governance role may call six functions on the operator modifier: scopeTarget, revokeTarget, allowFunction, revokeFunction, scopeFunction and setAllowance. The role key is pinned to operator, and a Nor condition refuses the Asset Safe and its modules as targets. The execution option must be below 2, so no delegatecall. setAllowance takes only the operator's budget keys, with a refill period of at least 30 days (INV-004, INV-012).
Every swap is a CoW order placed from the orders account. The operator sends a token there under a budget, then places a market, limit or TWAP order that pays the Asset Safe. A recovery order buys USDC or USDT and pays the Aragon Agent.
Nothing on chain bounds an order's price. CoW's competition rules, screening, the budgets and monitoring of each fill take its place.
Market and limit orders: a delegatecall from the orders account to CoW's order signer, signOrder, with tokens from the lists, the Asset Safe as receiver and a validDuration of at most 90 days. TWAP orders go through ComposableCoW, with only the TWAP handler; a TWAP order is created with createWithContext, so it starts at its creation. These permissions are ADR 007's proposed direction (INV-022, INV-024).
Funding comes from the DAO treasury through the existing payment path. The vault holds up to the mandate size. After the seed, the committee's Safe creates a top-up motion only when the mandate's published conditions allow one. LDO holders can object for 72 hours.
Two funding registries pay only the Asset Safe, each within a monthly limit. The objection is the control; the limit is the backstop.
Two allowed-recipients registries from Easy Track's registry factories, with Aragon Voting as their admin (OD-92), each with the Asset Safe as its only recipient and a one-month period. Two top-up factories create the motions, with the committee's Safe as their trusted caller (INV-017).
The emergency Safe has five signers: two committee members, two members of the Emergency Brakes multisig and one member of neither body. Three must sign, so the committee cannot use it alone. Through the safety modifier it revokes the operator, switches the operator modifier off, exits positions and sends assets to the Aragon Agent.
The Emergency Brakes multisig keeps only the Easy Track pause, and touches no funds. No emergency body restarts what it stopped: only a DAO vote does, in days.
Target: initiate any emergency action within six hours. Drills on a fork must prove it before launch. The switch is disableModule on the Asset Safe, pinned to the operator modifier (INV-009); the emergency role holds no call that restores authority (INV-027).
No contract reverts on a cap or on the liquidity buffer. Monitoring watches the buffer all the time and publishes the cap reading to IPFS every two weeks, and the policy provider publishes its own reading of the vault; a breach in either counts. The Zodiac UI refuses an operator transaction that would breach a cap, but only in its own interface. Each month, the committee publishes a report that anyone can reproduce.
If a breach is not fixed within two working days and is larger at the next reading, monitoring pages the emergency Safe, which switches the operator off. The control matrix lists each rule's controls on every layer.
The cap reading is the report generator's output at the fortnightly snapshot's pinned block, published to IPFS. The alert that pages the emergency Safe links it (OD-32, OD-58). The two readings use the same rule data from this repository (OD-84, OD-86, OD-87).
Clutch reuses deployed code that already runs: Safe, Zodiac Roles, Easy Track, CoW's order contracts and Lido's monitoring. It adds Easy Track factories, the permission policy with its compiler, the vault's detectors and a report generator.
Today the design is in phase 0. Nothing is deployed, no audit is done and no runbook is written. The Built or reused and Status tabs show each part.
New code: the Easy Track factories, Clutch's TypeScript policy compiler, the detectors and the report generator. CoW's order signer counts as new code too, because it has no known audit (OD-96). Reused as deployed: Safe v1.5.0, the locked Roles mastercopy, Easy Track and CoW's other contracts.
Every account, body and service, grouped as on the map. The roles also show their exact permissions, read from the compiled policy when this page is built.
Committee Safe Exists today
The committee's existing Safe. It holds the operator role and is the trusted caller of every factory. Two of its signers sit on the emergency Safe.
Treasury Management Committee and its Safe
● Existing on mainnet
The people who run the mandate day to day, and their existing Safe, which holds the operator role (OD-80). Two of the seven signers also sit on the emergency Safe. Once the launch cap lifts, every transaction of the Safe needs [the screening vendor]'s approval first, the committee's other duties included (OD-83). Until then the launch cap applies (OD-54, OD-55).
Controlled by Seven signers, at 4 of 7. Safe v1.3.0.
Can
Hold the operator role: change positions in approved protocols, within budgets.
Create motions as the trusted caller of every Clutch factory, and cancel its own motions.
Hold the operator role on the orders account: place CoW market, limit and TWAP orders that pay the Asset Safe.
Execute the first-loss terms on the Earn team's written instruction: propose a burn of the first-loss shares as an Easy Track motion, or redeem them to the Aragon Agent through its first-loss role (OD-60, OD-67).
Act in an emergency through its two seats on the emergency Safe, at 3 of 5 with two Emergency Brakes members and one member of neither body (OD-58).
Configure the vault's rules in [the screening vendor]'s monitoring service.
Review and publish the monthly report, and fix a cap breach within two working days.
Explain on the forum a difference above the band between Lido's reading and the policy provider's; no top-up starts until they agree (OD-84).
Restore the liquidity buffer within the mandate's window when it falls below its floor (OD-40).
Unlock a matured Lido product by a forum post and a budget motion (OD-41).
Accept decision records as the permanent acceptor, after EM's interim period.
Remove the screening guard, once set, but only through a fixed 10-day timelock.
Cannot
Run a transaction without [the screening vendor]'s single-use approval, once the guard is set. The guard fails closed.
Enable a module on its Safe while the guard is set: a module's transaction would not be screened (INV-010).
Burn the first-loss shares at once. It only creates the burn motion, which waits for the objection window (OD-67).
Relax a screening rule quietly. A relaxation is a reviewed change, with a notice on the forum (OD-45, OD-64).
Act alone in an emergency. Every quorum of the emergency Safe needs a signer from outside the committee (OD-58).
Restart what an emergency body stopped. Only the DAO restarts (OD-59).
Lose the operator role without a DAO vote. Moving it to another Safe also needs every factory deployed and registered again.
Numbers Safe v1.3.0 · 4 of 7 · rebalancing window: 2 working days · two seats on the emergency Safe · guard removal: 10-day timelock
The final authority. Aragon Voting is the only owner of the Asset Safe; the Aragon Agent, the treasury, receives every recovered asset.
LDO holders
Exists today
The owners of Lido DAO governance. They vote on every change that only the DAO may make, and they can stop any Easy Track motion.
Controlled by Token holders.
Can
Vote in Aragon Voting: the enabling vote, a policy replacement, a role membership change, a registry limit, and every restart after an emergency stop (OD-59).
Appoint the emergency Safe's fifth signer by Snapshot: a member of neither the committee nor the Emergency Brakes multisig (OD-58).
Object to any Easy Track motion in its objection window. An objection of 0.5% of LDO stops it.
Approve the mandate in a Snapshot vote before the on-chain vote.
Cannot
Act on the vault without a vote. A vote on the vault is a direct Aragon Voting item, about five days, without Dual Governance (OD-73).
Shorten a motion's objection window.
Numbers objection threshold: 0.5% of LDO · objection window: 72 h
The DAO's on-chain voting contract. It is the only owner of the Asset Safe, the orders account and the first-loss Safe, and the admin of the vault's funding registries, so a vote acts on the vault directly, in about five days, without Dual Governance (OD-73).
Controlled by LDO holders.
Can
Do anything on the vault's Safes as their only owner: replace the policy, change a role's members, turn a module on or off, move any asset.
Restart after the switch, as a Voting item: enable the operator modifier again, and grant again the operator's permissions on the orders account and any relayer approval set to zero. This is the only restart (OD-59).
Change or remove the two first-loss roles and the burn factory (OD-60, OD-67).
Add a token to the orders account, with its relayer approval, because no motion writes there (OD-36, OD-46, OD-78).
Grant the operator delegatecall. Only a DAO vote can do this (OD-36).
Set a limit or a period on either of the vault's two funding registries, as their admin.
Manage the shared payment permission of the Easy Track executor, and rewrite it as one unit, and administer the shared stablecoin token list.
Hold Easy Track's admin, pause, unpause and cancel roles itself. A vote item that unpauses Easy Track or cancels a queued motion runs when the vote runs.
Approve the hash of each Safe batch in the enabling vote. Anyone then sends the batch, with that approval as Voting's signature (OD-92).
Cannot
Approve a vault transaction with a contract signature. It uses only approveHash, or it sends the transaction itself.
Gain power over the treasury from owning the vault: it already pays out of the Aragon Agent through Finance.
Numbers owns the Asset Safe, the orders account and the first-loss Safe, each at 1 of 1 · a vote: about 5 days
The layer between a DAO vote and the Aragon Agent's own scripts and calls. It adds a delay. The vault does not pass through it, because Aragon Voting owns the vault's Safes (OD-73).
Controlled by The results of Aragon Voting, through the Dual Governance timelock.
Can
Run scripts as the Aragon Agent. Its admin executor is the only holder of the Agent's RUN_SCRIPT_ROLE and EXECUTE_ROLE.
Cannot
Skip its own delay.
Hold up a vote on the vault. A vote on the vault is a direct Voting item (OD-73).
The DAO treasury. Every recovered asset comes back to it, and Aragon Finance pays the vault's funding out of it. It owns none of the vault's Safes: Aragon Voting does (OD-73).
Controlled by The Dual Governance admin executor runs its scripts and calls. Aragon Finance pays out of it.
Can
Receive recovered assets: every emergency transfer out of the vault's accounts, and every recovery order, pays it.
Fund the vault through Aragon Finance, under the shared payment permission.
Cannot
Act on the vault's Safes. Aragon Voting owns them (OD-73).
Be reached by an Easy Track motion. Easy Track has no authority over it.
Moves money from the DAO treasury to the Asset Safe through Easy Track top-up motions, within monthly limits.
Aragon Finance and the shared payment permission
● Existing on mainnet
The DAO's payment app. Easy Track pays from the treasury through it. One shared permission sets which tokens the Easy Track executor may pay, with a ceiling per payment for each token.
Controlled by Aragon Voting manages the permission. The Easy Track executor holds it.
Can
Pay out of the Aragon Agent. The permission binds the token and the amount of each payment.
Pay USDS after a DAO vote rewrites the permission. The vote keeps every other entry as it is.
Cannot
Bind the receiver. The funding registry and the factory do that.
Cap a whole motion. A ceiling applies to one payment, so one motion can carry several payments.
New instance of existing code◐ Specified, not built
Two new registries from Easy Track's registry factories, with Aragon Voting as their admin, one for stablecoins and one for stETH. Each has one recipient, the Asset Safe, and a limit per month of one mandate size, as a backstop.
Controlled by Aragon Voting is the admin (OD-73). The Easy Track executor spends the limit.
Can
Pay only the Asset Safe.
Check the remaining limit when a motion starts, and again at enactment.
Cannot
Take a new recipient from the executor. Only the DAO changes a recipient, a limit or a period.
Enforce the mandate's rule that a Snapshot vote follows an objection.
Stop two full monthly limits within about 72 hours around a month boundary.
Keep a role with the deployer. It sets each registry up and gives up its roles, and a check before the vote proves every role (OD-92).
Numbers period: one calendar month · limit: one mandate size each, from the attested computation
The Safe that holds the DAO's first-loss shares in earnETH and earnUSD, from the March 2026 Earn allocation.
Controlled by Nine owners, at 5 of 9. Safe v1.4.1, with no modules and no guard.
Can
Transfer the first-loss shares to the first-loss Safe once, after the enabling vote. The seed motion follows.
Cannot
Execute the first-loss terms after the move. The committee takes that over: a burn by Easy Track motion, an exit through the first-loss role (OD-60, OD-67).
Lido's optimistic governance. A motion enacts unless LDO holders object within 72 hours. It holds the governance role.
Easy Track
● Existing on mainnet
Lido's optimistic governance. A motion enacts after its window unless LDO holders object. Clutch adds factories to it and changes none of its settings.
Controlled by The DAO sets its settings and its factory list. The Emergency Brakes multisig can pause it. Only the DAO can unpause it.
Can
Run a motion from a registered factory, with the global objection window.
Rebuild the motion's script at enactment and require the hash stored at creation.
Let anyone enact a motion when its window ends without an objection.
Act as the timelock for every structural increase of exposure: a new target or a higher budget waits for the objection window (OD-45).
Cannot
Shorten a motion's window. The global window can never go below 48 hours.
Expire a motion. After a pause or the switch, a queued motion can still enact, so the DAO's restart vote cancels the queued motions first (OD-59).
Reach the Aragon Agent.
Hold more than 20 open motions at once. Every committee shares the limit, so monitoring warns when few slots are free (OD-94).
Numbers window: 72 h · objection: 0.5% of LDO · window floor: 48 h · open motions: at most 20, shared
The contract that runs an enacted motion's script. In Clutch it holds the governance role on the operator modifier, the exit-governance role on the safety modifier and the first-loss burn role on the first-loss modifier.
Controlled by Easy Track. Only an enacted motion makes it act.
Can
Act as the governance role: write the operator's permissions and budgets, inside the limits that the policy sets.
Act as the exit-governance role on the safety modifier: add the emergency exit for a protocol that a motion onboards (OD-49).
Act as the first-loss burn role on the first-loss modifier: burn the DAO's first-loss shares in an enacted burn motion (OD-67).
Make payments through Aragon Finance, under the shared payment permission.
Spend the funding registries' limits.
Cannot
Run scripts as the Aragon Agent. It holds neither RUN_SCRIPT_ROLE nor EXECUTE_ROLE.
Add a recipient to the vault's registries, or change their limit or period.
The new Easy Track factories that own a fixed template: up to five that onboard a protocol, each only if a named protocol needs its shape (OD-79), one that removes a branch of a permission, and a claim template if a launch protocol pays rewards. Easy Track factories are the only kind of new contract that Clutch may add. A motion gives it typed values, such as a target, an asset and a budget key, and the factory builds the permission.
Controlled by The committee's Safe is the trusted caller, fixed at deployment. The DAO registers each factory by vote.
Can
Onboard a protocol without a DAO vote: wrap and unwrap, a tokenized vault, a queue vault, a spender approval or a Morpho Blue market.
Onboard Lido Lend in one motion through the Morpho Blue template, once Lido Lend's own contract exists. The same motion adds its emergency exit (OD-49).
Bring back a single permission that the emergency role revoked, through the template that covers it, after the 72-hour window. A restart after the switch stays a vote (OD-97).
Cannot
Accept a condition tree from a motion.
Remove a permission at once. An emergency removal is the emergency Safe's revoke (OD-09).
Add a token for market, limit or recovery orders. The order signer's permission is a delegatecall, which no motion can write (OD-36, OD-46).
Numbers up to 5 onboarding templates (OD-79) · 1 removal template · a claim template only if needed (OD-72) · external audit in phase 3
A new Easy Track factory for burns of the DAO's first-loss shares. Every first-loss burn is one of its motions, so every burn waits for the objection window (OD-67).
Controlled by The committee's Safe is the trusted caller. The DAO registers it by vote.
Can
Burn an amount of the DAO's earnETH or earnUSD shares, in a motion that the committee's Safe creates on the Earn team's written instruction.
Act only when the window ends without an objection: anyone enacts the motion, and the Easy Track script executor burns through the first-loss burn role.
Cannot
Burn any other token. The factory pins the two share tokens.
Write a permission, or transfer, approve or redeem the shares.
Holds the emergency role and the switch. Two committee members, two Emergency Brakes members and one member of neither body sign it, so the committee cannot use it alone. It can only reduce exposure: revoke, switch off, exit, sell into stablecoins and send assets home.
Emergency Safe
New instance of existing code◐ Specified, not built
A new Safe with five signers: two committee members, two Emergency Brakes members and one member of neither body. Three must sign, so the committee cannot use it alone. It holds no assets, and no guard screens it.
Controlled by Five signers, at 3 of 5. Safe v1.5.0. The committee and the Emergency Brakes multisig each appoint two seats, and a DAO Snapshot appoints the fifth. A signer who leaves their body leaves the seat.
Can
Hold the emergency role: revoke the operator, zero approvals, exit positions and send assets to the Aragon Agent.
Switch the operator off: disable the operator modifier, for a defect in the permission layer, on the cap-breach trigger, or when the committee is compromised or silent. The switch also freezes the vault's queued motions (OD-58).
Make every emergency removal of an operator permission, at once. A forum post follows. A routine removal is a motion (OD-70).
Hold the emergency role on the orders account: revoke the operator there, cancel any order, send tokens to the Aragon Agent or the Asset Safe, and place recovery orders.
Overrule a silent or compromised committee: the two Emergency Brakes members and the fifth signer form a quorum.
Cannot
Add a permission or give a non-zero approval.
Enter a protocol, except to stake ETH, or borrow.
Reach the first-loss shares. They sit in the first-loss Safe, where only a burn motion and the narrow first-loss role of the committee's Safe act.
Disable the safety modifier or the orders modifier, or change where recovered assets go.
Restore what it stopped: enable a module again, grant a permission again or raise an approval. The DAO restarts (OD-59).
Numbers Safe v1.5.0 · 3 of 5 · 2 committee seats, 2 Emergency Brakes seats, 1 seat for neither · initiate within 6 h
A transaction guard on the committee's Safe (OD-83). It refuses any transaction that the vendor has not approved once. It is set after the launch; the launch cap lifts once it is live (OD-54).
[the screening vendor]'s transaction guard
New instance of existing code◐ Specified, not built
A guard contract on the committee's Safe, which consults it before every transaction (OD-83). It refuses a transaction that the vendor has not approved, once and exactly. It is set after the launch; the launch cap lifts once it is set with its bypass mode off (OD-54).
Controlled by The vendor's key approves transactions. Only the owners of the committee's Safe can remove the guard, through a 10-day timelock.
Can
Check every transaction of the committee's Safe: each operator action, each order on the orders account, each new motion and the committee's other duties (OD-83).
Fail closed: with no approval, the transaction reverts.
Cannot
Touch the Asset Safe, the emergency Safe or the DAO path. Recovery and the switch never wait for the vendor.
Act as a module guard. Safe v1.5.0 refuses it as one.
Hold a standing approval under the agreement, except its two built-in timelock approvals. The code allows them, so monitoring alerts on one, and the vendor's written acceptance is still owed.
Numbers removal timelock: 10 days · bypass timelock: 10 days · bypass off before the cap lifts
A Zodiac Roles modifier. It lets the operator do only what the policy lists, within budgets.
Operator modifier
New instance of existing code✓ Built and tested on a fork
A Zodiac Roles modifier, enabled as a module on the Asset Safe. It checks each call of the operator and governance roles against the policy, and runs only what the policy allows, as the Asset Safe.
Controlled by Its owner, the Asset Safe, so in the end the DAO.
Can
Carry the operator role, the governance role and the operator's budget keys.
Refuse any call that the policy does not list. It is default-deny.
Cannot
Be replaced without a DAO vote. The safety policy names its address, so the vote also rewrites the safety policy.
The permissions of the committee's Safe on the operator modifier. Every receiver, owner and beneficiary is pinned to the Asset Safe, so the operator can change positions but cannot move assets out.
Controlled by Held by the committee's Safe. The DAO writes it at the enabling vote. Motions widen it inside templates, and a removal motion narrows it; a DAO vote can change it in any way.
Can
Stake ETH, and wrap and unwrap stETH and WETH.
Deposit into and redeem from earnETH, earnUSD and sUSDS. Claims pay the Asset Safe.
Convert DAI to USDS and back through Sky's converter, paid to the Asset Safe.
Approve a protocol spender. The approval spends that spender's budget key, or stays under a fixed ceiling.
Cannot
Transfer a token. The transfer to the orders account is specified but not yet in the policy.
Borrow, or use a venue outside the launch scope.
Administer a modifier or the Safe, or change its own permissions.
Use delegatecall on the Asset Safe. Its one planned delegatecall, to CoW's order signer, is on the orders account and is specified (OD-43).
Reach the first-loss shares through the operator role. They sit in the first-loss Safe, where only a burn motion and the separate first-loss role of the committee's Safe act (OD-42, OD-60, OD-67).
Numbers one role key: `operator`
Exact permissions in the compiled policy (12 targets)
Budget keys on this modifier: sky_savings_usds, earn_usd_deposit, earn_eth_deposit_wsteth. The amounts are dry-run values and are not shown.
Held by: committee's Safe. On the operator modifier. Read at build time from the committed fork-test artifact. Its holders are stand-ins, and its budgets and ceilings are dry-run values, not mainnet figures.
The permissions that an enacted Easy Track motion uses on the operator modifier. A motion can widen what the operator may do, but only in bounded ways.
Controlled by Held by the Easy Track script executor, so only an enacted motion uses it.
Can
Write operator permissions for a target that a motion names, under the operator key only.
Set the operator's budgets, with a refill period of at least 30 days.
Revoke an operator target or function. The removal template uses this when a routine removal takes a whole target or function (OD-70).
Cannot
Grant or remove a role, or touch the emergency role.
Make the Asset Safe or any of its modules an operator target, the safety modifier included (OD-38). The compiler refuses a policy without this guard.
Grant the operator delegatecall (OD-36).
Take a condition tree from a motion: the factories build every tree. This is specified, and the modifier does not check it.
Numbers refill period: 30 days or more
Exact permissions in the compiled policy (1 target)
Held by: Easy Track script executor. On the operator modifier. Read at build time from the committed fork-test artifact. Its holders are stand-ins, and its budgets and ceilings are dry-run values, not mainnet figures.
Refillable quotas on the operator modifier, counted in token units. An approval to a protocol spends the key of that spender. An approval of zero is always free.
Controlled by The DAO sets them first. A budget motion changes a key only after an event, such as a new mandate size or a product unlock (OD-56). A motion sets only a key that the policy already holds, so the enabling vote holds spare keys for each token, and a new spender takes one (OD-69).
Can
Refill each period up to a maximum. Each successful call draws them down.
Stay apart: the key of one asset never pays for another asset.
Cannot
See value. A key counts token units, so it drifts with price.
Numbers amounts in the repository: dry-run stand-ins · production figures: from the attested computation, after the mandate is approved
A second Roles modifier for the emergency role, the switch included. Nothing screens it, so recovery never waits on a vendor. Its exit-governance role, which is specified, lets the motion that onboards a protocol add its emergency exit here.
Safety modifier
New instance of existing code✓ Built and tested on a fork
A second Roles modifier on the Asset Safe, for the emergency role and its switch. No guard screens it, so recovery never waits for the vendor.
Controlled by Its owner, the Asset Safe, so in the end the DAO.
Can
Carry the emergency role. It has no budget keys. The exit-governance role is specified, not built (OD-49).
Keep working after the emergency role's switch disables the operator modifier.
Cannot
Be disabled by the switch: its pin is exact. If it has a defect, the fix is a DAO vote.
The permissions of the emergency Safe on the safety modifier. They only reduce exposure. It moves assets only to the Aragon Agent or into the orders account, and a recovery order pays only the Agent. A recovery order, which is specified, has no on-chain price floor; CoW's rules hold its fill to the on-chain market (OD-48).
Controlled by Held by the emergency Safe, at 3 of 5.
Can
Revoke any operator target or function. One revoke reaches every operator permission on the modifier; the orders modifier needs its own, which is specified.
Switch the operator off: disableModule on the Asset Safe, with the module pinned to the operator modifier. The operator and governance roles stop at once, and so does every queued motion that writes through them (OD-58).
Set any operator spender's approval to zero.
Exit positions into the Asset Safe: cancel, claim and redeem on Earn, and redeem sUSDS. A protocol that a motion onboards gets its emergency exit from the same motion, which is specified (OD-49).
Unwrap wstETH and WETH, and stake ETH.
Transfer the vault's tokens and Earn shares, but only to the Aragon Agent.
Cannot
Add a permission or give a non-zero approval.
Send an asset anywhere except the Aragon Agent. The transfer to the orders account is specified but not built.
Disable the safety modifier or any later module. The switch's pin is exact.
Restore what it stopped: enable a module, grant a permission or set a budget. The compiler refuses a policy that gives it one (OD-59).
Reach the first-loss shares. They sit in the first-loss Safe, where only a burn motion and the narrow first-loss role of the committee's Safe act (OD-60, OD-67).
Exact permissions in the compiled policy (16 targets)
Held by: emergency Safe. On the safety modifier. Read at build time from the committed fork-test artifact. Its holders are stand-ins, and its budgets and ceilings are dry-run values, not mainnet figures.
The permissions that an enacted Easy Track motion uses on the safety modifier. The motion that onboards a protocol also adds its emergency exit through this role.
Controlled by Held by the Easy Track script executor, so only an enacted motion uses it. The DAO creates it at the enabling vote.
Can
Write an exit for the emergency role: redeem, withdraw, claim and cancel with the receiver and owner pinned to the Asset Safe, a transfer pinned to the Aragon Agent, or an approval set to zero.
Cannot
Write an entry, a deposit or a non-zero approval. The templates emit only exits; the modifier cannot check that, so tests and the audit do.
Grant delegatecall, touch membership or the switch, set an allowance, or target the Asset Safe or any module of it.
The permission policy as a Zodiac constellation, compiled by Clutch's own compiler into a committed artifact that votes and tests use.
The constellation
Existing and new parts✓ Built and tested on a fork
The permission policy, written as a Zodiac constellation in TypeScript under policy/constellation/. It names the Safes, the modifiers, the roles, the permissions and the budget keys.
Controlled by The repository. A change is a reviewed pull request. @lidofinance/defi-tech owns it.
Can
State every permission of the three built roles in one place. The exit-governance role and the two first-loss roles join when they are built (OD-49, OD-60, OD-67).
Go to the Lido Zodiac workspace, so that the UI can show it.
Cannot
Change the chain by itself. Only a vote or a motion applies a policy.
Numbers copied from the policy provider's constellation at `02ea37d` · copied files keep LGPL-3.0-only (OD-34)
The committed JSON file that reviewers approve. It holds every modifier call in order, the expected condition tree for each role, target and function, and the budget keys.
Controlled by Reviewers approve it in each policy pull request. CI checks that it equals a fresh compile.
Can
Feed the fork tests now, and later the enabling vote, the Easy Track templates and the drift detector.
Cannot
Describe mainnet yet. The committed artifact is for the fork tests: stand-in holders and dry-run amounts.
A planned check that reads the applied permissions back from the modifier's events on a fork, and compares them with the artifact. The chain then checks the compiler.
Controlled by@lidofinance/defi-tech, in phase 2.
Can
Catch a compiler or SDK bug before it reaches the chain.
Cannot
Run yet. A decode of real modifier events must be checked first.
The policy provider's hosted app. The team pushes the constellation to a Lido workspace there. The app shows the account graph, the policy, the difference from the chain and the transactions that a change needs. The app also makes the provider's own reading of the vault's three Safes, with the mandate's rules from this repository; Lido makes its own reading, and neither reads the other's data (OD-84, OD-87).
Controlled by The app: the policy provider. The workspace and its key: @lidofinance/defi-tech (OD-35). The committee can view it (OD-64).
Can
Show the system and its drift in a UI.
Show its own reading of the three Safes as one whole, with the mandate's rubrics, and publish its reports to IPFS with Lido's pinning key (OD-84, OD-85).
Refuse, in its signing flow, an operator transaction that would breach a cap or the liquidity buffer's floor (OD-86).
From the lift, send each transaction of the committee's Safe that it builds to [the screening vendor] for approval, and show the approval state (OD-88).
Take a push from a team member, from the merged main, with the key in a local file that git ignores.
Cannot
Change the policy or the mandate's rules. A change made in the UI is drift (OD-87).
Give signers, a vote or a motion a transaction, unless Clutch's compiler makes the same calls from the same commit.
Set a Safe's version, guard or fallback handler.
Be used by CI or by an agent. Neither holds the key.
Stop a signer who uses another Safe interface. Its refusal at signing is a gate in its own interface (OD-86).
Read Lido's data. The two readings stay independent (OD-84).
The vault. A Safe that holds the assets. Only Aragon Voting owns it; the roles act through the two modifiers.
Asset Safe
New instance of existing code✓ Built and tested on a fork
The vault. A new Safe that holds the assets. Aragon Voting is its only owner. The roles act on it only through its two modifiers. The first-loss shares sit apart in the first-loss Safe, and a token for an order sits in the orders account until the fill.
Controlled by Aragon Voting, at 1 of 1 (OD-73). Safe v1.5.0.
Can
Own both modifiers, and run their permitted calls as itself: it is their avatar.
Send a token to the orders account for an order, under the orders budgets. Specified, not built.
Cannot
Take an ERC-721 or ERC-1155 safe transfer, or sign by EIP-1271. It has no fallback handler, on purpose.
Have a guard or a module guard. Recovery never passes through vendor code.
Change its Safe version without a DAO vote.
Numbers Safe v1.5.0 · 1 of 1 · no guard · no fallback handler
The launch list: ETH, WETH, stETH, wstETH, USDC, USDT, DAI, USDS, sUSDS, and the earnETH and earnUSD shares. The Asset Safe holds them; the stablecoins, sUSDS and stETH also fund the vault.
Controlled by Each token's own issuer and governance.
Can
Be sold and bought in CoW orders by the operator, if on its lists: stETH, wstETH, WETH, USDC, USDT and USDS (OD-46). LDO left the launch list (OD-91).
Be sold by a recovery order into USDC, or into USDT: every token of the launch list except ETH, which is staked first, and the Earn shares, which leave through their redeem queues.
Cannot
Be traded by the operator if off its lists. DAI earns through Sky's converter and sUSDS through deposit and redeem, so both stay off (OD-22, OD-46). A new token needs a DAO vote (OD-78).
A Safe that Aragon Voting owns. It holds only the DAO's first-loss Earn shares. On the Earn team's written instruction, an Easy Track motion burns them, or a role of the committee's Safe redeems them to the Agent.
First-loss Safe
New instance of existing code◐ Specified, not built
A new Safe that holds only the DAO's first-loss shares in earnETH and earnUSD. Aragon Voting owns it. One modifier carries two narrow roles, so the committee can execute the first-loss terms without a DAO vote: a burn waits for an Easy Track motion's objection window, and an exit pays the Aragon Agent.
Controlled by Aragon Voting, at 1 of 1 (OD-73). Safe v1.5.0, with no guard or fallback handler, and one modifier: the first-loss modifier.
Can
Receive the first-loss shares from the Growth Committee Safe, once, after the enabling vote.
Burn the shares, but only in an enacted Easy Track motion, through the first-loss burn role (OD-67).
Redeem the shares with the proceeds pinned to the Aragon Agent, through the first-loss role of the committee's Safe (OD-60).
Cannot
Be reached by the operator or the emergency role. The no-redeem rule for the operator is structural, not written (OD-42).
Send the shares anywhere. Neither role can transfer or approve them.
Numbers Safe v1.5.0 · 1 of 1 · one modifier, two roles · no guard or fallback handler
The committee's narrow role on the first-loss Safe. Under the first-loss terms of the March 2026 Earn allocation, it exits the shares to the Aragon Agent, in place of the Growth Committee. A burn uses another role, by motion only (OD-67).
Controlled by Held by the committee's Safe, at 4 of 7. Once the launch cap lifts, the screening guard checks each action (OD-83). It acts on the Earn team's written instruction. The DAO can change or remove the role by vote.
Can
Request and claim the shares' redemption on a confirmed material risk, with the proceeds pinned to the Aragon Agent.
Cannot
Burn the shares. Only an enacted burn motion can (OD-67).
Transfer or approve the shares, or pay anyone but the Aragon Agent.
The role on the first-loss Safe that burns the DAO's first-loss shares. Only an enacted Easy Track motion uses it, so every burn waits for the objection window (OD-67).
Controlled by Held by the Easy Track script executor. The committee's Safe creates each burn motion on the first-loss burn factory, on the Earn team's written instruction. The DAO can change or remove the role by vote.
Can
Burn the DAO's earnETH or earnUSD shares after a loss of at least 1% that the curators confirm. Below that, a Snapshot exception comes first.
Cannot
Act before a motion's objection window ends, or on a motion that LDO holders reject.
Transfer, approve or redeem the shares.
Reach the Asset Safe or the orders account.
Numbers burn trigger: a confirmed loss of at least 1% · objection window: 72 h · incident update: within 7 days
Lido's lending product, a separate deployment that is compatible with Morpho Blue. It is not deployed yet. The vault onboards it after launch, by one motion.
Controlled by Its own governance.
Can
Join the vault through one motion on the Morpho Blue template, once its own contract exists. The motion names that contract, and it also adds the emergency exit (OD-49).
Cannot
Leave the protocol cap before it matures and a budget motion with a forum post unlocks it (OD-41).
Be granted an exit at the enabling vote: its address is not known before it deploys.
Numbers the Morpho Blue template's end-to-end test: owed · budget key: from the attested computation
A Safe that Aragon Voting owns, with one modifier of its own. The roles place CoW orders from it: the operator's orders pay the Asset Safe, and recovery orders pay the Aragon Agent.
Orders account
New instance of existing code◐ Specified, not built
A new Safe that Aragon Voting owns. Every vault swap is a CoW order placed from it. It holds only tokens in transit, between a transfer from the Asset Safe and a fill.
Controlled by Aragon Voting, at 1 of 1 (OD-73). The roles act on it only through its own modifier (OD-57).
Can
Place CoW market and limit orders through CoW's order signer, and TWAP orders through ComposableCoW.
Pay the Asset Safe for the operator's orders, and the Aragon Agent for recovery orders. Each role's permissions pin the receiver.
Settle any role's order with the approvals of CoW's vault relayer that the enabling vote sets. No role can raise an approval here.
Cannot
Bound an order's price on chain. An order's limit is a number that the caller chooses. CoW's rules, screening, the orders budgets and monitoring of each fill take the place of a bound, and screening covers only the operator (OD-48).
Limit what the emergency role sends in. The operator's transfers spend the orders budgets; the emergency role's have no budget.
Swap through a router at launch. Uniswap and 1inch wait until [the screening vendor] can check a swap's minimum output (OD-43).
Numbers owner: Aragon Voting, 1 of 1 · order life: 90 days; a recovery order: 1 day · orders budgets: from the attested computation
New instance of existing code◐ Specified, not built
One Roles modifier on the orders account, from the same mastercopy as the Asset Safe's. It carries the operator and emergency roles, and no governance role (OD-57, OD-58, OD-78).
Controlled by Its owner, the orders account, so in the end the DAO.
Can
Let the operator sign orders through the order signer and create TWAP orders. The receiver is the Asset Safe. The launch has no stop-loss orders (OD-79).
Let the emergency role cancel any order, set a relayer approval to zero, send any listed token to the Aragon Agent or the Asset Safe, and place recovery orders that buy USDC or USDT and pay the Agent.
Let the emergency role stop the operator by revoking its targets and functions. The stop also cancels the operator's open orders, because a fill does not consult the policy (OD-58).
Cannot
Let a motion add a token or raise an approval. A DAO vote does both (OD-46, OD-78).
Take the order signer's permission or a delegatecall from a motion (OD-36).
A deployed CoW contract, CowswapOrderSigner. The orders account calls it by delegatecall to sign a market or limit order. It computes the order's identifier from the typed order, so a permission can read the order's tokens, receiver and life.
Controlled by Its code runs only by delegatecall, inside the calling Safe. That Safe owns each order.
Can
Pre-sign an order whose life ends within validDuration and whose fee stays within a bound.
Withdraw a pre-signature with unsignOrder.
Cannot
Pin a receiver or amounts. The permission must pin them.
Show an audit. None was found, so it counts as new code: the external audit covers it with the Easy Track factories (OD-96).
ComposableCoW, its TWAP handler, and CoW's fallback handler
● Existing on mainnet
CoW's contracts for conditional orders. The orders account sets CoW's fallback handler and names ComposableCoW as the verifier of CoW's settlement domain. A handler checks each order's terms.
Controlled by External: CoW Protocol.
Can
Hold a TWAP order: equal parts at a fixed spacing, each with a minimum to receive. This is how the vault buys or sells a position over time.
Delete an order with remove.
Cannot
Post an order to CoW's order book. CoW's watch-tower does that.
Work for a Safe without CoW's fallback handler. That is why the orders account exists.
Numbers ComposableCoW and the fallback handler: audited by Ackee, reviewed by Gnosis · the TWAP handler: audit scope not checked
The order-based exchange that settles every vault order. Solvers compete to fill an order at its limit or better, and the settlement pays the order's receiver directly.
Controlled by External.
Can
Settle an order from the orders account, and pay its pinned receiver.
Hold each fill to at least the on-chain market. Bonded solvers compete on the surplus for users, and under the EBBO rule a solver that fills worse than on-chain AMM routing must refund the user.
Post each part of a conditional order to its order book through its watch-tower. If the watch-tower stops, the orders wait and no funds move.
Cannot
Take an order from the Asset Safe. The Asset Safe never pre-signs an order and never approves CoW's relayer.
Bound an order's price on chain. The order's own limit is the only bound.
Router swaps that the committee asked for. They are not in the launch scope.
Controlled by External.
Can
Take a swap whose recipient and tokens a permission pins.
Cannot
Have their minimum output bounded by the modifier. They wait until [the screening vendor] can check a swap's minimum output against a market price before execution (OD-43).
Watches the vault, the liquidity buffer, the orders, the motions and the Safes, and pages the right body when something is wrong.
Lido on-chain monitoring
Existing and new parts◐ Specified, not built
Lido's existing monitoring platform, with new detectors for the vault. It watches and alerts. It blocks nothing.
Controlled by@lidofinance/defi-tech writes the detector specification. @lidofinance/lido-valset-vroom reviews it and runs the platform (OD-13).
Can
Alert on drift from the artifact on every modifier, the safety policy included, since motions can write exits there (OD-49); on approvals and budget burn; on owner, threshold, module, guard and singleton changes of the new Safes and the committee's Safe; and on the orders account's fallback handler, domain verifier and relayer approvals.
Watch the liquidity buffer all the time, and warn before it reaches its floor (OD-40).
Check each fill against a market price, ask the committee at 30 days to confirm or cancel each open order, and alert on a recovery order whose limit sits far below a market price, on tokens left in the orders account and on late parts of conditional orders (OD-43, OD-48, OD-61).
Alert on any change of the first-loss Safe's balance, owners or modules, and page on every burn motion and every action of the first-loss role (OD-42, OD-60, OD-67).
Page at high severity on every emergency swap (OD-48).
Follow a new Lido product's exposure against the protocol cap until a motion unlocks it, and record the changes of the screening rules that the vendor reports (OD-41, OD-45).
Follow every motion, flag odd top-ups and repeated budget motions, and grade emergency actions.
Publish the cap reading of each fortnightly snapshot to IPFS, and page the emergency Safe on the cap-breach trigger, met in either reading (OD-58, OD-84).
Compare Lido's published readings with the policy provider's at each snapshot, and flag a top-up motion that starts while they differ by more than the band (OD-84).
Alert on a change of the mandate's rules made in the Zodiac UI (OD-87), and on a transaction of the committee's Safe that waits too long for [the screening vendor]'s approval (OD-88).
Flag a monthly report that is still missing on day 8.
Cannot
Block a transaction. If it stops, no permission widens.
Monthly reports and fortnightly cap readings, published on IPFS and cited on the forum. Each report shows the caps and the liquidity buffer; no contract checks them.
Report generator
New code◐ Specified, not built
A program in the Clutch repository that builds each report from the chain at a pinned block. Anyone can run it again and get the same result.
Controlled by@lidofinance/defi-tech builds it. The committee reviews and publishes each report. Monitoring runs it every fortnight.
Can
Show balances, positions, exposures, each ratio with its numerator and denominator, and each price with its level, its source and its time (OD-62).
List every open order with its limit, its age and the idle balance behind it, in each monthly report (OD-61).
Show the first-loss Safe as a sub-allocation of the vault.
Show the liquidity buffer against its floor in every report (OD-40).
Count a new Lido product in the protocol cap until a motion unlocks it (OD-41).
Read the mandate's rules from the rule data in this repository, the same rules that the policy provider's reading uses (OD-87).
Cannot
Carry an old price over silently. A price older than 24 hours counts as missing.
Anchor a report on chain.
Numbers monthly report: within 7 days after month-end · incident report: within 72 h · build: phase 2
The first price source for reports, the closing price at the Snapshot Date, and the written five-level waterfall behind it (OD-62).
Controlled by External sources. The committee's written valuation policy sets the waterfall's band and the share that its last level may price.
Can
Price each asset in a report. When Coingecko's price is missing, more than 24 hours old or outside a band around a second aggregator's price, the next level applies: a second aggregator, a Chainlink feed or a pool's time-weighted price, the on-chain rate into a priced underlying, and last the committee's estimate with its method.
Give the stETH price that is pinned when the enabling vote is prepared, for the stETH registry limit.
Cannot
Leave an asset unpriced. Every price carries its level and its source, and a top-up waits while the committee's estimate prices more than the set share of the vault.
Numbers a price older than 24 h counts as missing · five levels · band and level-5 share: not set
What happens, step by step. Each flow can play on the map. The badge shows whether the flow is built and tested on a fork, specified, open or planned.
Everyday operations
What the committee does on a normal day. The policy checks every operator transaction before it runs, and so does the screening guard once the launch cap lifts (OD-54).
An operator transaction
✓ Built and tested on a fork
How the committee changes a position, for example a USDS deposit into sUSDS. The policy checks the transaction before it runs, and so does the screening guard once the launch cap lifts.
Trigger The committee decides to change a position within the mandate. Time Minutes. Once the launch cap lifts, [the screening vendor] approves first.
Committee Safe signers, 4 of 7
The signers build the transaction in the Zodiac UI or with local tooling. It calls the operator modifier with the operator role.
The call is execTransactionWithRole on the operator modifier, with the role key bytes32("operator"). A batch goes through Safe's MultiSendCallOnly v1.3.0, the version of the committee's Safe.
[the screening vendor]
The vendor reviews the exact transaction and approves it on chain, once. Without the approval, the guard makes the committee's Safe refuse it.
Check The guard fails closed. Until the launch cap lifts, no guard is set on the committee's Safe and this step does not happen (OD-54, OD-83). INV-010 is pending: the harness has no guard yet.
Operator modifier
The modifier checks the call against the operator's permissions and refuses anything that the policy does not list. An approval spends its spender's budget key.
Asset Safe
The modifier runs the call as the Asset Safe. The protocol pays any proceeds or claims to the Asset Safe, because every receiver is pinned to it.
Check INV-003: every receiver, owner and beneficiary is the Asset Safe.
Monitoring
Monitoring records the change: approvals, budget burn and positions.
Check Specified: the vault's detectors are not built.
If this goes wrong
The vendor refuses: nothing runs. The committee fixes the transaction or asks again.
The policy refuses: the call reverts and nothing changes.
A problem shows after the call: the emergency Safe revokes the operator at once.
How the vault swaps one token for another. The operator sends the token to the orders account and places a CoW order there. The order pays the Asset Safe, because the policy pins the receiver.
Trigger The committee wants a different mix of assets, for example less stETH and more USDC, now or at a set price. Time A market order fills in minutes. A limit order can stand for up to 90 days (OD-61).
Operator
The operator transfers the token from the Asset Safe to the orders account. The transfer spends that token's orders budget, and the policy pins the recipient.
Check Specified: the orders account and its permissions are not in the policy yet.
Committee Safe
On the orders account, the committee's Safe signs a market or limit order through CoW's order signer. Once the launch cap lifts, the screening guard checks this transaction too.
Check INV-022: the order's receiver is the Asset Safe.
A delegatecall to signOrder(order, validDuration, feeAmountBP) on the order signer. The policy pins the sell and buy tokens to the operator's lists, the receiver to the Asset Safe, validDuration to the maximum order life, and the fee bound. The enabling vote has already approved CoW's vault relayer for each listed token.
CoW Protocol
CoW's solvers compete to fill the order at its limit or better. The settlement pays the Asset Safe directly.
Monitoring
Monitoring checks the fill against a market price, and alerts on tokens left in the orders account. At 30 days it asks the committee to confirm or cancel each open order, and each monthly report lists every open order.
Operator
An order that has not filled can be cancelled with unsignOrder. Unused tokens go back to the Asset Safe.
If this goes wrong
The vendor refuses the order: nothing runs.
A fill comes in far below the market: monitoring alerts, and the emergency Safe can cancel the open orders and sweep the account.
How the vault buys or sells over time. ComposableCoW holds the order, and CoW's watch-tower posts it to the order book.
Trigger The committee wants to average into a position over weeks. Time Until the last part fills or the order expires.
Operator
The operator funds the orders account from the Asset Safe, under the orders budget.
Committee Safe
The committee's Safe creates a TWAP order on ComposableCoW, in equal parts. It starts at once and ends within 90 days. Once the launch cap lifts, the screening guard checks it.
Check INV-022: the receiver is the Asset Safe. The launch has no stop-loss orders (OD-79).
ComposableCoW.createWithContext with a start of zero and CoW's current-timestamp value factory, so the order starts at its creation, and the handler pinned to the deployed TWAP handler. A TWAP order has at most 90 parts at most a day apart, or 12 parts at most 7 days apart (INV-024). The orders account's fallback handler is CoW's ExtensibleFallbackHandler, and ComposableCoW verifies CoW's settlement domain for it (INV-023).
CoW's watch-tower
The watch-tower posts each part of a TWAP order when it is due.
CoW Protocol
Each part fills at its minimum or better, and pays the Asset Safe directly.
Monitoring
Monitoring checks each fill, and alerts when a part is not posted on time.
If this goes wrong
The watch-tower stops: the orders wait and no funds move. The committee can remove them with remove and place ordinary orders.
The emergency Safe can cancel every open order and sweep the orders account.
Motions change the operator's permissions only through fixed templates, with 72 hours for LDO holders to object. A change outside the templates is a DAO vote, and a screening rule changes by review and a forum notice.
Onboarding a new protocol by motion
◐ Specified, not built
How the committee adds a protocol without a full DAO vote. It creates an Easy Track motion through a fixed template, and LDO holders have 72 hours to object. The policy's limits on the governance role are built and tested on a fork; the template factories are not built.
Trigger The committee wants a new target, for example Lido Lend after its launch. Time At least 72 hours, then enactment.
Committee
The committee posts a disclosure on the forum. It sets up monitoring for the new target and updates the runbooks.
Committee Safe
The committee's Safe creates the motion on the template factory, with typed values only: a target, an asset and a budget key. Once the launch cap lifts, the screening guard checks this transaction.
Check The budget key must already be in the policy: a new spender takes one of the spare keys that the enabling vote holds (OD-69). A token new to the orders account needs a DAO vote (OD-46, OD-78).
LDO holders
The motion waits 72 hours. If holders of 0.5% of LDO object, it fails. This window is the timelock for every structural increase of exposure. The Emergency Brakes multisig can also pause Easy Track.
Easy Track
At enactment, Easy Track rebuilds the script and requires the hash stored at creation. A changed script fails.
Check INV-005, tested on a mock Easy Track.
Governance role
The script executor writes the new operator permission through the governance role. The modifier checks this write too: the operator key only, no role change, no delegatecall and no administrative target.
Check INV-004: the Asset Safe and every module of it are refused as targets (OD-38).
Exit-governance role
The same script gives the emergency role the new target's exits on the safety modifier: redeem, withdraw, claim and cancel pinned to the Asset Safe, a transfer pinned to the Agent, and an approval set to zero.
Check INV-025: this role writes only under the emergency key, with no delegatecall, allowance or administrative target. Specified, not built (OD-49).
Operator, and the emergency Safe if needed
The operator can use the new permission. The emergency Safe can revoke it at once.
If this goes wrong
An objection of 0.5% of LDO stops the motion.
The Emergency Brakes multisig pauses Easy Track. Only the DAO can unpause it.
The emergency Safe's switch freezes the motion, because its write goes through the operator modifier. The DAO's restart vote cancels the motion first (OD-59).
The committee's Safe cancels its own motion.
After enactment, the emergency Safe revokes the new operator permission at once. A write to the safety modifier cannot be revoked that way: only an objection, the Easy Track pause or a DAO vote stops it (OD-49).
How a budget key changes. There is no routine retune: the committee files a budget motion only after an event (OD-56).
Trigger An event: a new mandate size, a new spender, a product's unlock, or the lift of the launch cap. A price move is not an event. Time 72 hours.
Committee
The attested computation derives the key's new budget, under that key's ceiling. The forum post names the event.
Check A motion sets only a key that the policy already holds, so a new spender takes a spare key (OD-69). A new mandate size also needs a DAO vote for the funding limits and the fixed approval ceilings, by design (OD-71, OD-89).
Committee Safe
The committee's Safe creates a motion on the budget factory. The guard screens it, once the guard is set (OD-54).
Easy Track
After 72 hours without an objection, the executor sets the budget through the governance role. The refill period stays at 30 days or more.
Check INV-012: the 30-day floor is tested; the per-key ceilings wait for the attested figures.
Monitoring
Monitoring flags every budget motion, and checks that its forum post names an event.
The owner path. The DAO can do anything to the Asset Safe: replace the policy, change who holds a role, enable a module again or move the operator role to another Safe. It is also the only path that restarts after an emergency stop (OD-59). Each such change takes days.
Trigger A change outside the motions' limits, a repair after a defect in the safety modifier, or a restart after the switch. Time About five days: the Aragon Voting vote.
LDO holders
LDO holders vote in Aragon Voting.
Aragon Voting
Aragon Voting sends the Asset Safe transaction itself, or approves it by hash, as the only owner. Nothing passes Dual Governance (OD-73).
Asset Safe
The Asset Safe runs the change, for example a new policy on both modifiers.
A new Lido product, Lido Lend first, counts against the protocol cap until it matures. A budget motion with a forum post unlocks it, so LDO holders can object.
Trigger The product meets the maturity criteria in the mandate. earnETH and earnUSD are not new products. Time 72 hours.
Committee
The committee posts on the forum which maturity criteria the product meets.
Committee Safe
The committee's Safe creates a budget motion that raises the product's budget key. Once the launch cap lifts, the screening guard checks it.
LDO holders
LDO holders have 72 hours to object. An objection of 0.5% of LDO stops the unlock.
Easy Track
The motion enacts through the governance role. From then on, reports count the product as a Lido product, outside the protocol cap.
Money comes from the DAO treasury through Easy Track top-ups. The objection window is the control; the registry limit is the backstop.
A top-up
◐ Specified, not built
How money moves from the DAO treasury to the vault after the seed. The committee's Safe creates an Easy Track top-up motion, within the mandate size and the treasury share.
Trigger The mandate's published eligibility conditions for a replenishment are met, and the vault has headroom under the mandate size (OD-89). Time 72 hours.
Committee
The committee posts the top-up on the forum: the funded value, the headroom under the mandate size, and the vault's share of the DAO's non-LDO treasury. The post links both readings' latest reports (OD-85).
Check No top-up starts while the report is late, while the committee's estimate prices more than the set share of the vault (OD-62), or while Lido's reading and the policy provider's differ by more than the band (OD-84). Until the launch cap lifts, the committee asks for a top-up only while the vault stays at or below the cap, and the post states the room left under it (OD-54).
Committee Safe
The committee's Safe creates a top-up motion. The guard screens it, once the guard is set (OD-54).
LDO holders
LDO holders have 72 hours to object.
Easy Track and Aragon Finance
At enactment, the registry checks its limit for the month again, and Aragon Finance pays the Asset Safe from the treasury.
Check INV-017: only the Asset Safe, only allowed tokens, within the limit. Pending: nothing is built yet.
Monitoring
Monitoring flags a top-up above the posted headroom, a top-up that would take the vault above the mandate size or the treasury share, and any top-up after an objected one. Until the launch cap lifts, it also alerts on a top-up motion that would take the vault above the cap.
If this goes wrong
An objection stops the top-up. The mandate then asks for a Snapshot vote.
The registry refuses a payment above its remaining limit.
How the vault gets its first assets. After the enabling vote, the Growth Committee moves the DAO's first-loss Earn shares to the first-loss Safe. Then one seed motion funds the rest.
Trigger The enabling vote has executed, its Safe batches have run, and the Safes exist (OD-92).
Growth Committee Safe
The Growth Committee Safe transfers the first-loss earnETH and earnUSD shares to the first-loss Safe. That Safe needs no permission to receive them.
Committee Safe
The committee's Safe creates the seed motion. It is at most the mandate size, less the value of the first-loss shares at the report's price rule (OD-89, OD-98). Until the launch cap lifts, it is also at most the cap (OD-54).
Easy Track and Aragon Finance
After 72 hours, Aragon Finance pays the Asset Safe through the funding registries.
The committee
From then on, on the Earn team's written instruction, a burn motion burns the shares, and the first-loss role of the committee's Safe redeems them to the Agent. No other role reaches the first-loss Safe, and monitoring alerts on any change of its balance.
Check INV-021: the first-loss Safe has Aragon Voting as its only owner, and one modifier with two narrow roles. Specified, not built.
How the DAO's first-loss Earn shares absorb a loss, as the March 2026 terms say. The committee executes the terms without a DAO vote: a burn is an Easy Track motion, with its objection window, and an exit goes through one narrow role (OD-60, OD-67).
Trigger A loss of at least 1% in earnETH or earnUSD that the curators confirm, or a confirmed material risk. Time A burn: at least 72 hours, the objection window. An exit: minutes to initiate, then the redeem queue. Both start after the Earn team's written instruction.
Earn team and curators
A curator flags the loss, and the vault's curators confirm it. The Earn team instructs the committee in writing: burn up to all of the DAO's shares in that vault, or exit through the vault's normal redemption.
Check Below 1%, a Snapshot exception comes first, as after the Kelp incident.
Committee Safe, 4 of 7
For a burn, the committee's Safe creates a motion on the first-loss burn factory, and the forum post with the instruction goes up with it. For an exit, it requests and claims the redemption through the first-loss role, and the proceeds go to the Aragon Agent. Once the launch cap lifts, the screening guard checks both transactions.
Check INV-021: only an enacted motion can burn the shares, and neither role can transfer or approve them. Specified, not built.
Easy Track, after 72 hours
If LDO holders do not object, anyone enacts the motion. The Easy Track script executor calls burn on the share token through the first-loss burn role.
Monitoring
Monitoring pages on the motion and on the action, and alerts on the change of the first-loss Safe's balance.
Committee
The incident update follows on the forum within seven days. Reports show the first-loss amount less the burn.
If this goes wrong
LDO holders object: the motion fails, and nothing burns. The DAO can still burn by vote, as the Safe's owner.
Depositors see the motion for 72 hours and can time their entries and exits, so the vault should pause deposits and redemptions until the burn, as Lido Earn did after the Kelp incident.
A curator freezes the vault: an exit waits for the vault, and a burn still works.
The DAO changes or ends the authorisation: a vote changes or removes the roles and the burn factory.
Caps are detective. Monitoring and reports measure the vault, publish the numbers and start the fix. No contract reverts on a cap.
The fortnightly snapshot
◐ Specified, not built
Every two weeks, two readings of the vault drive the published cap readings: Lido's, at a pinned block, and the policy provider's own. Budgets no longer follow them (OD-56).
Trigger Every two weeks.
Monitoring
Monitoring runs the report generator at the snapshot's pinned block.
Monitoring
It publishes the cap ratios to IPFS.
Policy provider
The Zodiac UI publishes its own reading of the same snapshot to IPFS, and monitoring compares the two (OD-84, OD-85).
Committee
If a cap is breached in either reading, the committee rebalances within two working days.
The committee publishes a report within seven calendar days after month-end. Anyone can run the generator again and check it.
Trigger Month-end. Time Within 7 calendar days.
Report generator
The generator reads the chain at a pinned block, with prices at the Snapshot Date from the five-level waterfall, Coingecko first. Each price carries its level and its source, and the report lists every open order.
Committee
The committee reviews the report and publishes it on IPFS.
Committee
The forum post cites the report's IPFS identifier, and the policy provider's report next to it. The post is the reports' only anchor (OD-85).
Monitoring
If the report is late, no top-up starts. Monitoring flags it on day 8, and the committee explains the delay on the forum.
The vault keeps at least one month of baseline spend in stablecoins and sUSDS. A detector watches it all the time, and the committee restores it within the mandate's window.
Trigger The buffer falls toward its floor, for example after a large deposit or a missed top-up. Time The mandate's window.
Monitoring
The buffer detector warns at a margin above the floor, and alerts at the floor.
[the screening vendor]
Once the launch cap lifts, and if the vendor can check it, screening refuses an operator transaction that would take the buffer below its floor.
Check Requested from the vendor, not confirmed.
Zodiac UI
The UI's signing flow refuses an operator transaction that would take the buffer below its floor, in its own interface only (OD-86).
Committee
The committee restores the buffer: it exits a position, or sells through a CoW order into a stablecoin.
Reporting
Every report of both readings shows the buffer against its floor (OD-84).
Two fast stops and one slow restart. The emergency Safe pulls assets back and can switch the operator off; the Emergency Brakes multisig can pause Easy Track; only the DAO restarts, in days.
A financial incident: stop and pull back
✓ Built and tested on a fork
A depeg, a curator failure or a protocol compromise. The emergency Safe acts through the safety modifier at 3 of 5, and no guard screens it. Each step only reduces exposure.
Trigger An alert, or a signer sees the risk. Time Initiate within 6 hours: the mandate's ceiling. Drills must prove it.
Lido incident process
The alert pages the emergency Safe's signers.
Emergency Safe, 3 of 5
Revoke the operator's targets or functions. One revoke reaches every operator permission on the operator modifier; the orders modifier needs one more, once it exists.
Check INV-018: every operator permission is under one key.
Emergency Safe
On the orders account, cancel the open orders and send its tokens to the Agent or the Asset Safe. Setting a relayer approval to zero also stops recovery orders in that token until a DAO vote.
Check Specified: the orders account does not exist yet.
Emergency Safe
Set the operator's approvals to zero.
Emergency Safe
Exit positions into the Asset Safe: cancel, claim and redeem on Earn, and redeem sUSDS.
Check Tested on a fork for sUSDS and WETH. The Earn exits are in the policy but not yet tested.
Emergency Safe
Send assets home to the Aragon Agent. The transfer goes only to this fixed address.
Check INV-002: assets leave only for the Agent, or for the orders account once it exists.
Committee
Post on the forum after the revoke.
If this goes wrong
A queued motion would restore a revoked permission: the emergency Safe's switch freezes it, or the Emergency Brakes multisig pauses Easy Track. Only the DAO restarts, and its vote cancels the motion first (OD-59).
No recovery order can fill at a price that the signers accept: send the assets to the Agent instead.
When an asset must become a stablecoin in an emergency. The emergency Safe sends it to the orders account and places an order that buys USDC or USDT and pays the Aragon Agent.
Trigger An incident where holding the asset is the risk, for example a depeg. Time Initiate within 6 hours. A recovery order lives at most 1 day, and the emergency Safe signs a new one if it does not fill. The order names its own limit, so it can fill in a depeg at a price that the signers accept.
Emergency Safe
Exit the position into the Asset Safe if needed. Native ETH is staked first; wstETH, WETH and sUSDS can be sold as they are.
Emergency Safe
Transfer the asset to the orders account. The policy pins the recipient.
Check Specified: the orders account is not in the policy yet.
Emergency Safe
Place a recovery order that buys USDC, or USDT as the second destination, and pays the Aragon Agent. No guard screens it, and nothing on chain bounds its price, so every emergency swap pages at high severity.
Check INV-014: the emergency role's orders buy only USDC or USDT and pay only the Aragon Agent. CoW's EBBO rule holds the fill to the on-chain market, and monitoring alerts on a limit far below a market price (OD-48).
CoW Protocol
CoW settles, and the proceeds go straight to the Aragon Agent. If the order does not fill, the emergency Safe signs a new one, or cancels it and sends the tokens to the Agent.
Check USDS and DAI carry USDC risk, so recovery can buy USDT when USDC is the problem.
If the operator's permissions themselves are wrong, the emergency Safe switches the operator modifier off. The safety modifier keeps working, and only the DAO restarts.
Trigger A defect in the policy, the modifier or a factory, for example a bug-bounty report. Time Initiate within 6 hours.
Lido incident process
The incident process pages the emergency Safe.
Emergency Safe, 3 of 5
The emergency Safe calls disableModule on the Asset Safe through the emergency role. The module argument is pinned to the operator modifier. On the orders account it revokes the operator's targets and functions instead, and cancels the operator's open orders, so recovery keeps working there (OD-58).
Check Built for the Asset Safe. Specified for the orders account.
Operator modifier
The operator and governance roles stop at once, and so does every queued motion that writes through them.
Check The switch does not stop the exit-governance role on the safety modifier. A motion that writes there stops only by an objection, the Easy Track pause or a DAO vote (OD-49).
Emergency Safe
The emergency Safe can still act through the safety modifier.
LDO holders
Only the DAO can enable the operator modifier again. Its vote first cancels the queued motions, because a motion does not expire, and also grants again the operator's permissions on the orders account (OD-59).
No contract reverts on a cap. Monitoring publishes the breach, the committee fixes it, and the emergency Safe stops the operator if the breach gets worse.
Trigger A fortnightly cap reading, Lido's or the policy provider's, shows a breach. Time Two working days to fix, then the next fortnightly snapshot.
Monitoring
Monitoring publishes Lido's cap reading to IPFS, and the policy provider publishes its own. A breach in either reading counts (OD-84).
Committee
The committee has two working days to rebalance.
Monitoring
At the next fortnightly snapshot, the breach is still there and larger. Monitoring pages the emergency Safe and links the reading.
Emergency Safe
The emergency Safe switches the Asset Safe's operator modifier off. Once the orders account exists, it also revokes the operator there (OD-58). The trigger is fixed, so the duty needs no judgment.
The guard fails closed. The operator stops, no new motion can start, and the committee's other duties on its Safe stop too (OD-83). Recovery does not change.
Trigger Once the guard is set, the vendor's service is down or refuses everything (OD-54). Time Up to 10 days, the guard's removal timelock.
Guard
Every transaction of the committee's Safe reverts, because no approval arrives: operator transactions, new motions and the committee's other duties.
Monitoring
Monitoring alerts when a transaction of the committee's Safe waits for the approval longer than the set time (OD-88).
Emergency Safe
It acts as before. No guard screens it.
Committee Safe owners
The owners can start the guard's removal. It takes 10 days, and monitoring sees it.
LDO holders
The DAO can also give the operator role to another Safe by vote.
Trigger A motion looks wrong: a bad target, a wrong amount or a missing disclosure. Time Before the 72-hour window ends.
Monitoring and the forum
The motion-lifecycle alert and the forum disclosure show the motion.
LDO holders
LDO holders object within 72 hours. An objection of 0.5% of LDO stops the motion.
Emergency Brakes multisig
If time is short, the multisig pauses Easy Track. This stops every DAO motion, and only the DAO can unpause it.
Emergency Safe
For a vault motion, the emergency Safe can also switch the operator off. The motion's write goes through the operator modifier, so it cannot enact. Only the DAO restarts, and its vote cancels the motion first (OD-59).
Committee Safe
The committee's Safe can cancel its own motion before it enacts.
Emergency Safe
If the motion enacts, the emergency Safe revokes the new operator permission at once. An exit written to the safety modifier cannot be revoked that way; a DAO vote replaces it (OD-49).
The roadmap's phases, in order. A phase starts when the gates of the phase before it close. The Status tab shows where the work is now.
Trigger The roadmap.
Phase 0: decisions
EM has accepted the setup ADRs, 001 to 004, and accepts ADR 005 to ADR 012. [the screening vendor]'s written terms are due before the launch cap lifts (OD-54).
Phase 1: specification
The specifications and the detector specification, the control matrix and the screening rule list with the vendor's questions, the Zodiac UI requirement list, the orders account's fork tests, the runbook drafts and the Lido Zodiac workspace.
Phase 2: build
The round-trip check, the orders account and its permissions, the first-loss Safe with its two roles, the Easy Track factories with their emergency exits, the funding path, the report generator, the buffer detector, the mandate's rule data, the comparison of the two readings, and the invariant-to-test check.
Phase 3: assurance
An external audit of the factories and of CoW's order signer, which counts as new code (OD-96), Lido's review of the guard change, and fork drills that initiate within 6 hours.
Phase 4: governance and deployment
The mandate's Snapshot vote, a Snapshot that appoints the emergency Safe's fifth signer, the LIP, the enabling vote and deployment without the guard under the launch cap, the share transfer to the first-loss Safe and the seed motion.
Phase 5: operation
Monthly reports, the fortnightly cap reading, budget motions after events and recurring drills. Once the guard is set with its bypass mode off, the committee's forum post lifts the launch cap.
One DAO vote turns the system on. The enabling-vote page lists what it holds, what comes before it and what follows without a vote.
Trigger The mandate is approved and phase 3 is done.
Lido
Before the vote, fork tests show that CoW's order signer and fallback handler work on Safe v1.5.0 behind a Roles modifier.
Check INV-022 and INV-023 are pending.
Committee
The vote does not wait for the guard. The vault launches under the launch cap (OD-54, OD-55).
Lido
Safe's releases, advisories and bug-bounty records are checked again shortly before the vote.
LDO holders
The vote registers the factories and adds USDS to the payment permission and to the shared stablecoin token list (OD-93). Aragon Voting runs these items itself, without Dual Governance (OD-73). For the vault's Safes, it approves the hash of each Safe batch: the batches apply the policy compiled for mainnet from the reviewed constellation, grant the roles, the exit-governance role and the two first-loss roles included, and set up the orders account with its order lists and relayer approvals (OD-92).
Anyone
After the vote executes, anyone sends each Safe batch with Voting's approval of its hash. The batches of one Safe run in nonce order (OD-92).
Check One command computes each batch's hash again from the published batch, so a reviewer can match it to the vote. The command is owed.
Growth Committee, then the committee's Safe
After the batches run, the Growth Committee moves the first-loss shares to the first-loss Safe, and the seed motion funds the vault.
The committee's Safe carries the committee's seven signers, and two of them sit on the emergency Safe. Nothing on chain keeps them in step, so a rotation is a manual duty.
Trigger A signer joins or leaves the committee, or a seat holder leaves the Emergency Brakes multisig.
Committee
The committee's Safe changes its owner.
Committee
A signer who leaves the committee also leaves an emergency seat, and the committee appoints the successor there. The Emergency Brakes multisig does the same for its two seats, and only a DAO Snapshot changes the fifth (OD-58).
Monitoring
Monitoring alerts on each owner change of the committee's Safe and the emergency Safe, as critical on the emergency Safe.
Check INV-026: exactly two owners of the emergency Safe are owners of the committee's Safe, two are owners of the Emergency Brakes Safe, and one is an owner of neither. Pending: the Safe is not deployed.
The committee's rulebook, block by block: what the draft says, how Clutch keeps each rule, and what Clutch changed and why. Highlighted notes mark each change.
LDO holders approve the mandate in a Snapshot vote. Its draft is not public yet, so this tab paraphrases only what the repository records about it, and shows no figure from it.
10✎ Mandate text owed
4¶ Forum post
7◆ Design choice
2◌ Proposed
Purpose and custody
The draft says The committee puts a bounded part of the DAO treasury to work in approved protocols. The DAO keeps the assets, and no committee or service provider can take them.
How Clutch keeps it
On chain Aragon Voting is the only owner of the Asset Safe, the orders account and the first-loss Safe, and recovered assets go to the Aragon Agent.
On chain every receiver, owner and beneficiary in the operator's permissions is the vault.
Detection alerts on any change of the owners, modules or singleton of every new Safe.
INV-001, INV-021 and INV-023 fix the owners; INV-003 and INV-022 fix the receivers.
Changed by Clutch
✎ Mandate text owed The custody section names Aragon Voting as the owner of the vault's Safes, and the Aragon Agent as the destination of recovered assets. It says that no vault action passes Dual Governance.
Why A vote on the vault then runs without Dual Governance, which protects stETH holders, not the treasury. Aragon Voting already pays from the treasury through Finance, so it gains no new power.
The draft says A launch list of assets and venues. It names four main stablecoins: USDC, USDT, USDS and DAI.
How Clutch keeps it
On chain default deny. A new target needs a template motion with a 72-hour objection window, or a DAO vote.
Before execution the screening vendor checks every operator transaction and every new motion, once the launch cap lifts (OD-54).
Detection drift of the chain from the committed policy.
INV-004 and INV-005 bound what a motion can add. INV-015 keeps the operator inside the launch scope.
Changed by Clutch
◆ Design choice DAI joins the launch list, so the vault holds all four main stablecoins. DAI earns through Sky's DAI–USDS converter, one to one, and not through swaps.
Why The mandate's four main stablecoins include DAI, and converting is cheaper than swapping.
◆ Design choice Lido Lend joins by one motion after launch. It is a separate deployment that is compatible with Morpho Blue, and the same motion adds its emergency exit.
Why Lido Lend does not exist yet, so its address cannot be in the enabling vote.
◆ Design choice LDO leaves the launch list, the operator's order lists and the recovery sell list.
Why LDO is not a funding asset, so it would enter the vault only through a buy order or a DAO vote, and a buy order reads as an LDO buyback. EM removed it on 2026-10-22.
The draft says Caps on exposure, each a share of a defined base: per protocol or counterparty, per stablecoin, and for yield-bearing assets. The whole vault may sit in Lido's own products.
How Clutch keeps it
On chain none. The policy cannot see value; budgets per protocol spender bound how much can move each month.
Before execution the Zodiac UI refuses an operator transaction that breaches a cap, in its interface only; a screening rule is requested for the same refusal.
Detection monitoring publishes the cap reading of each fortnightly snapshot. If a breach is not fixed within two working days and is larger at the next reading, the emergency Safe switches the operator off. A breach in either reading, Lido's or the policy provider's, counts.
Display each cap against its limit, in the Zodiac UI.
Budget keys count token units and refill no more often than every 30 days. Caps are ratios, so budgets drift with price. There is no routine retune: a budget motion follows an event (OD-56).
Changed by Clutch
✎ Mandate text owed Exposure to mature Lido products is unbounded. A new Lido product, Lido Lend first, stays in the protocol cap until it meets the maturity criteria and a budget motion with a forum post unlocks it. earnETH and earnUSD are not new.
Why The mandate backs Lido's own products without a cap. The maturity step keeps a product without a track record from taking the whole vault on its first day.
The draft says A stablecoin buffer of one month of baseline spend.
How Clutch keeps it
On chain none.
Before execution the Zodiac UI refuses an operator transaction that takes the buffer below its floor, in its interface only; a screening rule is requested for the same refusal.
Detection a continuous detector with an early warning, and a line in every report.
Display the buffer against its floor, in the Zodiac UI.
The buffer counts the stablecoins that the Asset Safe holds directly, and sUSDS. Its figure comes from the attested computation.
Changed by Clutch
¶ Forum post The forum post states the buffer's controls: the detector, the report line, screening where the vendor can check it, the display, and the committee's window to restore it. The Snapshot text keeps the rule.
Why Nothing on chain can hold a buffer, so monitoring, reports, screening and the display must keep it. The control matrix carries that detail, and the forum post carries the control matrix.
The draft says The vault holds up to the mandate size in assets. Each funding counts in US dollars at its value when it is funded, and the legacy positions count too. The vault never holds more than a set share of the DAO's non-LDO treasury. More funding needs a separate DAO approval, and a replenishment needs published eligibility conditions. After an objection, a further pull needs a Snapshot vote.
How Clutch keeps it
On chain two funding registries pay only the Asset Safe, within a limit per month each. The limits are a backstop: they allow more than the mandate size.
Before execution the screening vendor checks every top-up motion when the committee's Safe creates it, once the launch cap lifts (OD-54).
Detection alerts on a top-up above the posted headroom, on a top-up that would take the vault above the mandate size or the treasury share, and on any top-up after an objected one.
INV-017 fixes the registries' recipient. A registry cannot enforce the Snapshot-vote rule after an objection; monitoring and a DAO vote that sets the limit to zero cover it. Nothing on chain holds the mandate size or the treasury share.
Changed by Clutch
✎ Mandate text owed The funding rules allow sUSDS.
Why A DAO vote adds USDS to the shared payment permission, and the stablecoin registry pays sUSDS too.
✎ Mandate text owed Until the screening guard is live, the vault stays under a cap of one million dollars on the Asset Safe and the orders account. A forum post lifts the cap once the guard is set with its bypass mode off.
Why EM allowed a launch without the guard under this cap. The registries keep their limits, so the cap holds by procedure: top-ups stop at the cap, monitoring alerts above it, and LDO holders can object.
✎ Mandate text owed The size section states the treasury share's base, the time of its test, and the remedy for a breach that no vault transaction causes. The funding section publishes the eligibility conditions of a replenishment.
Why The treasury's own spending or a price move can breach the share with no vault transaction, and a top-up needs conditions to meet.
◌ Proposed Monitoring keeps the funded value: the first-loss shares at their value on the day of the transfer, and each top-up at its value on the day of its enactment, by the report's price rule. Each top-up's forum post states it, with the headroom under the mandate size.
Why The mandate counts each funding at its value when funded, so later prices do not move the vault against its size.
The draft says The emergency path may swap any asset into any of the four main stablecoins.
How Clutch keeps it
On chain every swap is a CoW order from the orders account, and each role's permissions pin the receiver: the Asset Safe for the operator, the Aragon Agent for recovery.
Before execution once the launch cap lifts, the screening vendor checks every operator order. Recovery orders are never screened.
Detection each fill against a market price, open orders, and a page on every emergency swap.
Orders live at most 90 days, recovery orders 1 day (INV-024). Nothing on chain bounds an order's price; CoW's competition and EBBO rule hold a fill to the on-chain market.
Changed by Clutch
¶ Forum post The forum post's emergency section states that the emergency swap goes into USDC, or USDT as the second destination, and not into any of the four main stablecoins.
Why USDS and DAI carry USDC risk through Sky's peg stability module, so they are no escape from a USDC depeg. The forum post carries the emergency section.
✎ Mandate text owed The swap section says plainly what the launch trades off: CoW's market, limit and TWAP orders through the orders account are the only venue, nothing on chain bounds their price, and Uniswap and 1inch wait for a screening check of the output.
Why The committee needs those order types, and a router swap without a bounded output loses value to front-running. One venue at launch is a trade-off, so the text names it.
The draft says A dual-access emergency exit: the DAO, and an emergency committee independent of the Treasury Management Committee, can each return every asset to the treasury within six hours.
How Clutch keeps it
On chain the emergency Safe revokes, exits and sends assets to the Agent through the safety modifier, which nothing screens. The committee cannot use it alone.
On chain the emergency Safe can switch the operator off; the Emergency Brakes multisig can pause Easy Track; only a DAO vote restarts.
Drills fork drills must show every emergency action initiated within six hours.
INV-002 and INV-009 fix the emergency powers, and INV-027 refuses any emergency call that restores authority. A motion that onboards a protocol also adds its emergency exit through the exit-governance role (INV-025).
Changed by Clutch
¶ Forum post The forum post's emergency section describes the emergency Safe: three of five, with two committee members, two Emergency Brakes members and a fifth signer who is a member of neither body.
Why Its quorum without the committee, the two Emergency Brakes members and the fifth signer, is the draft's independent emergency committee, so the dual-access exit holds as drafted. The detail fits the forum post.
The draft says The committee publishes a monthly report within seven calendar days after month-end, a post before each top-up, and an incident report.
How Clutch keeps it
A report generator in this repository that anyone can run again at a pinned block.
No top-up starts while the monthly report is late; monitoring flags it on day 8.
Monitoring publishes the cap reading of each fortnightly snapshot to IPFS.
Each monthly report lists every open order with its limit, its age and the idle balance behind it.
Display two readings, Lido's report generator and the policy provider's own, on the same rules. Both go to IPFS, and a breach in either counts.
Prices follow a five-level waterfall, Coingecko first, and every price shows its level and its source. Reports have no on-chain anchor; the forum post carries the report's identifier.
Changed by Clutch
◆ Design choice The LIP states the price waterfall, and that the committee's valuation policy sets its band and the share that its last level may price. The mandate text does not need it.
Why Reviewers can then hold the committee to how each figure was priced, and the Snapshot text stays short.
The draft says Legacy DAO investments carry over into the vault and reduce the initial funding request.
How Clutch keeps it
On chain the DAO's first-loss Earn shares sit in a first-loss Safe. A burn runs only as an Easy Track motion, and one narrow role of the committee's Safe redeems them to the Aragon Agent; no other role reaches them.
The committee acts on the Earn team's written instruction, under the March 2026 terms. Below them, a Snapshot exception comes first.
Detection alerts on any change of the first-loss Safe's balance, owners or modules, and a page on every burn motion and every action of the role.
INV-021 fixes the first-loss Safe's shape and its two roles. The Growth Committee's Safe moves the shares once, after the enabling vote.
Changed by Clutch
✎ Mandate text owed The legacy section takes over the first-loss terms of the March 2026 Earn allocation, with the committee as executor in place of the Growth Committee: a burn as an Easy Track motion, and an exit through one narrow role on a first-loss Safe.
Why The chain cannot tell first-loss shares from other Earn shares, so a separate Safe keeps them apart. A burn moves the shares' value to other depositors, so LDO holders get the objection window, and no burn is silent; an exit pays the DAO, so it stays fast.
The draft says LDO holders approve the mandate in a Snapshot vote, before the enabling vote.
How Clutch keeps it
Every rule gets a control on each layer that can carry it: on chain, before execution, detection and display.
Motions are the timelock for every structural increase of exposure.
A relaxation of a screening rule gets a notice on the forum, and the vendor's own delay if it has one.
The control matrix maps each rule to its controls, owner and status.
Changed by Clutch
¶ Forum post The forum post carries the control matrix, which says how each rule is kept.
Why Much of the mandate cannot be enforced on chain, so each rule needs a named control and owner. That detail fits the forum post, and the Snapshot text stays short.
The permission policy as code: the accounts, modifiers and roles that the committed artifact builds, what is specified but not built, and what Clutch changed from the policy provider's version.
The constellation uses the format of the Zodiac UI. Clutch started from the policy provider's constellation for this vault and rewrote it to the decided design. Clutch's own compiler turns it into the committed artifact that reviewers approve, and this page reads the graph below from that artifact when it is built.
As built, from the committed artifact
Avatar and ownerAsset SafeThe Aragon Agent owns it; every permitted call runs as it
Roleoperatorheld by committee's Safe12 targets · 25 callsTargets and calls
earnETH redeem queue 2
DAI–USDS converter 2
DAI 1
wstETH 3
earnUSD redeem queue 2
USDC 1
sUSDS 3
stETH 2
WETH 2
earnUSD USDC deposit queue 3
USDS 1
earnETH wstETH deposit queue 3
Rolegovernanceheld by Easy Track script executor1 target · 6 callsTargets and calls
operator modifier 6
Roles modifiersafety modifier1 role · no budget keys
Roleemergencyheld by emergency Safe16 targets · 31 callsTargets and calls
earnETH redeem queue 2
Asset Safe 1
earnUSD share 1
operator modifier 2
DAI 2
wstETH 3
earnUSD redeem queue 2
USDC 2
sUSDS 3
stETH 3
earnETH share 1
WETH 2
earnUSD USDC deposit queue 2
USDT 1
USDS 2
earnETH wstETH deposit queue 2
Specified, not in the constellation yet
Orders account
◐ Specified, not built
Where A second Voting-owned Safe, with one modifier of its own
One orders modifier for the operator and emergency roles, and no governance role: a DAO vote adds a token (OD-57, OD-58, OD-78). The operator signs CoW orders that pay the Asset Safe; recovery orders pay the Aragon Agent.
Where A Voting-owned Safe with one modifier of its own
One first-loss modifier with two roles. The first-loss burn role, held by the Easy Track script executor, burns the DAO's first-loss shares only in an enacted motion. The first-loss role, held by the committee's Safe, redeems them to the Aragon Agent. No other role reaches them.
What Clutch changed from the provider's constellation, and why 13
Area
Provider's constellation
Clutch
Why
Modifiers ↻ Changed
One Roles modifier, with the operator and emergency roles.
Two modifiers on the Asset Safe: the operator modifier for the operator and governance roles, and the safety modifier for the emergency role and its switch.
Recovery must keep working when the operator is switched off, and no screening may sit in its way.
A new emergency Safe at 3 of 5: two committee members, two Emergency Brakes members and one member of neither body. The Emergency Brakes multisig keeps only the Easy Track pause.
Financial emergencies need the people who watch the portfolio every day, and no single body may act alone. The quorum without the committee is the mandate's independent exit.
The emergency role could call disableModule with both arguments open.
The emergency role can disable only the operator modifier; the module argument is pinned. It holds no call that restores authority, and the compiler refuses one.
An open disableModule could switch off the safety modifier, and with it every recovery path. Only the DAO restarts.
No role. It assumed that motions act as the Aragon Agent, which Easy Track cannot do.
A governance role for Easy Track's script executor. It writes operator permissions from fixed templates, never delegatecall and never on the Asset Safe or its modules.
Motions need their own narrow role; two fork probes showed how a wider one reaches the vault (OD-36, OD-38).
No permission for staking, WETH or the withdrawal queue.
Stake ETH, and wrap and unwrap WETH. No Lido withdrawal queue: stETH is sold in CoW orders instead (ADR 007, decision 27).
ETH and WETH are on the launch list. The withdrawal queue left the design on 2026-10-08, because CoW orders already buy WETH and a request cannot be cancelled.
Approvals pin the spender and leave the amount open; deposits spend monthly budgets with placeholder figures.
Each approval spends its spender's budget key, or stays under a fixed ceiling; deposits spend nothing; a budget motion cannot set a refill period under 30 days.
A spender can pull an approval without any deposit, so the approval is what must be bounded.
The first-loss shares sit in a first-loss Safe. Only an enacted motion burns them, and only a narrow role of the committee's Safe redeems them to the Agent; the vault's other roles never see them.
The chain cannot tell first-loss shares from other Earn shares, so a separate Safe keeps them apart. The narrow roles let the committee execute the first-loss terms without a DAO vote, and a burn waits for the objection window.
The hosted app compiles actions and pushes the policy, with an API key.
Clutch's own offline compiler writes the committed artifact, and CI checks it. The Zodiac UI is a view, and local tooling verifies everything it builds.
Reviewers must approve exactly what the vote applies, so the compile runs here, from the reviewed commit.
The request for solution that Lido contributors sent to the policy provider, ask by ask: what it asked, how Clutch answers, and what Clutch changed or added, and why. Highlighted notes mark each difference.
The RFP asked any other design to keep four properties, and Clutch keeps all four. Below, each card takes one part of the RFP.
22✓ As asked
10↻ Changed
2◌ Not answered yet
8+ Added by Clutch
The four properties
DAO ownership
Aragon Voting is the only owner of every account that holds assets, and recovered assets go to the Aragon Agent. The Asset Safe owns both of its modifiers, which are proxies of a locked mastercopy.
Each role reaches only named targets and functions, and every receiver is pinned to the vault. A motion adds a permission only through a template fixed at audit time, and never grants delegatecall or administration.
The emergency Safe revokes, exits and returns assets at once, and no guard sits on its path. It can also switch the operator off. Fork drills must show each action started within six hours.
Clutch compiles and checks the policy itself, from the reviewed commit, and the provider's hosted app is out of the path. Removal, recovery and DAO actions are plain on-chain calls with no vendor code on their path.
The RFP asked An Asset Safe holds the assets and the positions. The Aragon Agent is its only owner, and the DAO cannot lose that ownership because a provider service is unavailable.
Clutch The Asset Safe is a Safe v1.5.0 with Aragon Voting as its only owner, at a threshold of one, with no guard and no fallback handler. No vendor code is on the DAO's path, and the DAO cannot lose that ownership because a provider service is unavailable.
Why A vote on the vault then runs without Dual Governance, which protects stETH holders, not the treasury. Aragon Voting already pays from the treasury through Finance, so it gains no new power (OD-73).
The RFP asked An Operator Safe at 4 of 7 makes routine transactions through a restricted role. It cannot change its own permissions, block their removal, borrow, or use an asset or a function that a motion or the DAO did not approve.
Clutch The committee's existing Safe, at 4 of 7, holds the operator role (OD-80). From the lift of the launch cap, the screening vendor's guard screens it (OD-83). It cannot borrow, administer a modifier or a Safe, change its own permissions, or move assets out except into the orders account.
The RFP asked An Emergency Safe at 3 of 5, which the RFP links to the Emergency Brakes multisig, revokes approvals, exits approved positions and returns assets to the fixed DAO treasury address.
Clutch A new emergency Safe at 3 of 5 holds the emergency role and the switch: two Emergency Brakes members, two committee members and one member of neither body. The Emergency Brakes multisig itself keeps only the Easy Track pause.
Why Financial emergencies need people who watch the portfolio every day, and technical ones need the engineering view. No single body acts alone, and the quorum without the committee returns assets without it.
The RFP asked Neither Safe can block the removal of its own authority, and the Operator Safe cannot block a DAO recovery action.
Clutch The Asset Safe owns both modifiers, so a DAO vote can remove any role. The emergency Safe can switch the operator off. Recovery runs through the emergency Safe, which has no guard, and the safety modifier, which carries no operator role.
The Asset Safe, the emergency Safe and the first-loss Safe run Safe v1.5.0, and the committee's Safe runs Safe v1.3.0 (OD-80). Each modifier is an EIP-1167 minimal proxy of the locked Roles mastercopy, deployed through the Zodiac module proxy factory, with the Asset Safe as its owner, avatar and target.
Added by Clutch
+ Added Two modifiers on the Asset Safe: the operator modifier for the operator and governance roles, and the safety modifier for the emergency and exit-governance roles.
Why Recovery must keep working when the operator is switched off, and no screening may sit in its way.
+ Added A first-loss Safe, owned by Aragon Voting, holds the DAO's first-loss Earn shares. An Easy Track motion burns them, and one narrow role of the committee's Safe redeems them to the Agent.
Why The chain cannot tell first-loss shares from other Earn shares, so a separate Safe keeps them apart, and the committee executes the first-loss terms without a DAO vote.
The RFP asked Easy Track manages the operator allowlist: it adds or removes an asset, a protocol target or a function selector, and changes a parameter constraint inside an allowed function.
Clutch Motions add and remove, but only through templates fixed at audit time. An onboarding motion fills one of up to five onboarding templates with typed parameters such as a target, an asset and a budget key; a removal motion takes one branch away; and a budget motion sets budgets within their ceilings. A token for the orders account needs a DAO vote, and an emergency removal is the emergency Safe's immediate revoke.
Why A motion that carried its own condition tree could widen authority past what the DAO approved, so every motion fills a template. The order signer's permission is a delegatecall, which no motion may write.
The RFP asked Lido contributors design, build, audit, deploy and maintain the Easy Track helper contracts. The provider confirms that its access control exposes the administration functions and works safely with this path.
Clutch The Easy Track factories are the only new contracts. Lido builds them in phase 2, and an external audit covers them in phase 3, with CoW's order signer, which has no known audit (OD-96). The governance role calls six administration functions of the Roles modifier, each one guarded.
The RFP asked The Aragon Agent stays the only owner of the Asset Safe. Easy Track gets no ownership and no unrestricted execution, and it executes only the permission changes that the Operator Safe proposes in motions.
Clutch Aragon Voting, not the Aragon Agent, owns the Asset Safe (OD-73). Easy Track never receives authority over the vault's owner or the Agent. On the Asset Safe, its executor holds only the governance and exit-governance roles. Outside it, the executor holds only the burn role on the first-loss Safe, so every first-loss burn is a motion (OD-67). The committee's Safe, as the trusted caller of every factory, creates every motion.
Why The reason is the one under Accounts: a vault vote passes no Dual Governance, and Aragon Voting gains no new power (OD-73).
The RFP asked A direct DAO path can make every change that Easy Track can make.
Clutch A DAO vote, a direct Aragon Voting item, can do everything on the owner path: replace the policy, change membership and apply any change without Easy Track. A fork test runs that path.
The RFP asked The complete initial configuration is in place before ownership passes to the DAO, so no separate setup-only vote is needed.
Clutch Ownership never passes: the Asset Safe is created with Aragon Voting as its only owner. The enabling vote approves the hash of each Safe batch, and the batches apply the committed policy artifact, grant every role and set up the orders account and the first-loss Safe; the vote also registers the factories. No setup-only vote is needed (OD-92).
Why Aragon Voting is the only owner of the Asset Safe at all times, so only the DAO can configure the vault. Its enabling vote approves the Safe batches, and anyone sends them after the vote (OD-73, OD-92).
The governance role holds scopeTarget, revokeTarget, allowFunction, revokeFunction, scopeFunction and setAllowance on the operator modifier. The first five pin the role key to operator and refuse the Asset Safe and its modules as targets; allowFunction and scopeFunction allow no delegatecall; setAllowance takes only the operator's budget keys.
Added by Clutch
+ Added An exit-governance role on the safety modifier: the motion that onboards a protocol also writes the emergency role's exit from it.
Why Without it, a protocol that a motion onboards would have no emergency exit until a DAO vote added one.
The RFP asked Adding or widening a permission and removing one are separate actions. A removal cannot add or widen, and an expansion cannot make an arbitrary call.
Clutch Onboarding templates only add, and the removal template only takes away: it writes the function's tree without the removed branch and adds nothing. No template can make an arbitrary call. An emergency removal is the emergency role's revoke, which cannot grant anything.
The RFP asked An expansion waits through a three-day objection period.
Clutch Every motion has a 72-hour objection window. Motions are the timelock for every structural increase of exposure, such as a new target or a higher budget.
The RFP asked A standard removal goes through an Easy Track removal motion, with the same three-day objection period.
Clutch A routine removal is a motion of the removal template, with the same objection window. An emergency removal is the emergency Safe's immediate revoke, posted on the forum afterwards.
The RFP asked For an urgent risk, the emergency authority blocks or revokes within hours, and a durable change follows later.
Clutch The emergency Safe revokes the operator's targets and functions on the operator modifier and the orders modifier at once, and it can switch the operator off. A revoke is durable: only a motion or a DAO vote grants the permission again, and only a DAO vote restarts the operator.
The RFP asked A launch set of stETH, wstETH, LDO, USDC, USDT, DAI, sDAI, USDS, sUSDS, earnUSD and earnETH, with a note of the assets or actions that need custom policy work.
Clutch Clutch takes EM's launch list (ADR 011): ETH, WETH, stETH, wstETH, earnETH, earnUSD, USDC, USDT, USDS, sUSDS, CoW Swap access and Lido Lend access. DAI earns through Sky's DAI–USDS converter, and sDAI and LDO are out.
Why EM set the list and later took LDO off it (OD-91). DAI earns through USDS without a swap or a third-party market, so sDAI is not needed. ETH and WETH need staking and wrapping. Lido's withdrawal queue left the design on 2026-10-08: stETH is sold in CoW orders instead.
The RFP asked Unapproved actions are denied by default. On-chain rules restrict the target contracts, the functions, the transferred value and the relevant parameters.
Clutch Each role reaches only named targets and functions, and no target is open as a whole. Every receiver, owner and beneficiary is pinned to the vault, and only the staking and wrapping calls can carry ETH.
The RFP asked Allocation limits per protocol, per yield-asset class and per liquid staking provider other than Lido, where this is technically possible.
Clutch The caps come from the mandate draft: per protocol or counterparty, per stablecoin, and for yield-bearing assets, each a share of a defined base. The whole vault may sit in Lido products.
Why The mandate is the committee's rulebook, and its launch list holds no asset of another liquid staking provider.
The RFP asked The answer explains which limits hold before execution and which depend on reporting and remediation.
Clutch No limit reverts on chain, because the policy cannot see value. Budgets per spender bound how much can move each month, a screening rule is requested that refuses an operator transaction that breaks a cap, and the Zodiac UI refuses one in its own interface (OD-86). Monitoring publishes the cap reading every two weeks, next to the policy provider's own, and a breach in either counts (OD-84). If a breach is not fixed within two working days and is larger at the next reading, the emergency Safe switches the operator off (OD-58).
The RFP asked The Operator Safe cannot add a target, a function, an asset or a wider parameter range without the governance process.
Clutch The operator holds no administration function, and only motions and DAO votes write its permissions. A fork test checks that the operator cannot widen its own scope or reach administration.
The RFP asked The permission detail separates protocol targets, function selectors, asset parameters and other policy parameters.
Clutch The committed artifact lists every target, function and condition tree of each role, and the budget keys of each modifier. The Actors and Constellation tabs read it.
Functions that act only for the calling Safe, such as wrapping, unwrapping and claims, take any arguments. Only stETH's submit and WETH's deposit can carry ETH.
The RFP asked The emergency role revokes token approvals and exits approved positions.
Clutch The emergency role sets approvals to zero, exits positions to the Asset Safe, unwraps wstETH and WETH, redeems sUSDS and Earn shares, and revokes the operator's targets and functions. A motion that onboards a protocol also adds the exit from it.
The RFP asked Recovered assets go only to the fixed DAO treasury address.
Clutch Recovered assets go to the Aragon Agent, or to the orders account, whose recovery orders buy USDC or USDT and pay only the Agent. A recovery order lives at most one day.
Why The mandate lets the emergency path swap assets into stablecoins, and a swap needs an order. Aragon Voting owns the orders account, and its recovery orders pay only the Aragon Agent.
The RFP asked The Operator Safe cannot veto an emergency action.
Clutch Recovery runs through the emergency Safe, which has no guard, and the safety modifier, which carries no operator role. Switching the operator off leaves both working.
The RFP asked The emergency role cannot add permissions, enter a new protocol, borrow, create leverage or change the recovery destination.
Clutch It cannot add a permission, borrow, reach the first-loss Safe, change the recovery destination, disable any module but the operator modifier, or restore what it stopped. The only protocol that it enters is Lido's staking, because recovery stakes ETH before it sells.
The RFP asked In an incident, new operator transactions stop first. The emergency signers check the event, revoke approvals, exit positions or start queued withdrawals, and return what is liquid to the treasury. The DAO disables a role or a module if needed, and an incident report follows.
Clutch The emergency Safe switches the operator off, revokes, exits and returns assets, redeems Earn shares through their queues, and sells stETH by a recovery order or sends it to the Agent. A DAO vote can disable anything, and the committee publishes an incident report within 72 hours.
The vault does not use Lido's withdrawal queue (ADR 007, decision 27): stETH leaves by a recovery order or by a transfer to the Agent. Earn shares leave through their redeem queues, and the role can cancel open deposit requests.
The RFP asked Monitoring covers transactions, assets, protocols and permission changes.
Clutch Lido's on-chain monitoring carries policy drift against the committed artifact, the approval inventory, budget burn, module, owner and singleton changes on the new Safes, and motion events. A motion that onboards a protocol needs monitoring of it before enactment.
The RFP asked Alerts reach the operator, the emergency signers and DAO operations, with the supported signals and the expected alert times.
Clutch The detector specification lists each detector with what it watches, its severity and where it runs. It is owed in phase 1, and it sets no alert time yet.
The RFP asked Each operator transaction is simulated and checked before execution, and the answer names the service that checks it.
Clutch From the lift of the launch cap, the screening vendor checks each operator transaction before it runs. Its transaction guard on the committee's Safe refuses any transaction that the vendor did not approve on chain, once (OD-83). Every motion is screened too, because that Safe creates it. Until the cap lifts, the vault runs without the guard. The repository does not record whether the vendor simulates each transaction. From the launch, the Zodiac UI's signing flow refuses an operator transaction that would breach a cap or the buffer's floor, in its own interface only (OD-86), and from the lift it requests the vendor's approval for each transaction it builds (OD-88).
Why EM allowed a launch without the guard under this cap, so the vendor is not on the launch's critical path. Above the cap, blocking before execution stays a hard requirement.
The RFP asked The answer explains what happens when the monitoring or blocking service is unavailable. On-chain permissions stay the final enforcement layer, and losing monitoring never widens them.
Clutch The guard fails closed: the operator, new motions and the committee's other duties on its Safe stop, and recovery is unaffected (OD-83). The owners can remove the guard after ten days. If monitoring stops, the permissions on chain still hold and do not widen.
The guard is set on the committee's Safe with setGuard, and its bypass mode stays off. The vendor's key approves each transaction hash once, and the guard holds no standing approval except its two built-in timelock approvals.
The RFP asked The NAV shows the total in USD, the valuation time and the freshness of the data, by asset, protocol, strategy and position. The answer says whether NAV is the provider's product, a partner's or custom work.
Clutch Two readings. Lido's report generator reads the vault at a pinned block, with each price's source and timestamp. The policy provider makes its own reading in the Zodiac UI, with the same rules, and shows the value per account, asset and protocol. Neither reads the other's data, both go to IPFS, and both count: a breach in either triggers the switch, and no top-up starts while they differ by more than a band.
Why Two independent readings check each other, and anyone can re-run Lido's at a pinned block.
The RFP asked The on-chain system keeps working without the provider's hosted app, API, extension, indexer, relayer or cloud service.
Clutch Clutch's own offline compiler builds every policy change from the reviewed commit, and the hosted app is out of the path. The modifiers are proxies of a locked mastercopy that the Asset Safe owns. Swaps need CoW's off-chain services, but the emergency role can always send assets to the Agent.
The RFP asked An authorized account can send a valid transaction through another Safe-compatible frontend, or as raw transaction data.
Clutch Every account is a standard Safe, and a role acts through a plain call to its modifier, execTransactionWithRole. The fork tests make these calls with no frontend at all.
The RFP asked Permission removal, module disablement, emergency recovery and DAO ownership actions stay available through an outage, a suspension, a billing dispute or a contract termination.
Clutch All of them are on-chain calls by the emergency Safe or the DAO, and no vendor code is on their path.
+ Added Reports: a monthly report that anyone can re-run at a pinned block, and a cap reading every two weeks on IPFS. The policy provider publishes its own reading next to Lido's, with the same rules, and both count.
Why Tokenholders hold the committee to the mandate through its reports, and a breach in either cap reading is what makes the emergency Safe switch the operator off. Two independent readings check each other.
What Clutch takes from audited code and existing platforms, and what it adds. New things carry the review and audit risk.
Reused as it is 12
Deployed code and existing platforms, audited unless the row says otherwise. Clutch configures or calls them and changes no line of them.
Zodiac Roles mastercopy and module proxy factory
The deployed, locked Roles code behind all four modifiers, and the factory that makes their proxies.
Why Audited, permission code that is already in production. The deployed mastercopy is older than the upstream source, so an audit must pin the deployed bytecode.
The provider's UI shows the account graph, the policy, the difference from the chain and the transactions that a change needs.
Why The team works in the Zodiac UI (OD-33). It is a view: local tooling verifies everything that it produces. Lido gives the provider a written requirement list. The provider makes its own reading of the vault, with the mandate's rules from this repository, and Lido makes its own; both count (OD-84, OD-87).
Why Certora (with formal verification) and Ackee audited v1.5.0. Its record is short, so the vault avoids the paths that changed most, and Safe's advisories are checked again before the vote.
The DAO path: Aragon Voting, which owns the vault's Safes, and the Aragon Agent, the treasury that receives recovered assets. Dual Governance gates only the Agent's own execution, which the vault does not use (OD-73).
Why The DAO keeps custody and the final say. Clutch adds no authority over the Agent.
The exchange that settles every vault order; the deployed order signer for market and limit orders; ComposableCoW, its TWAP handler and CoW's fallback handler for TWAP orders.
Why Ackee audited ComposableCoW and the fallback handler, and Gnosis reviewed ComposableCoW. Whether the TWAP handler is in scope is not checked, so Lido reviews it in phase 3. The 40-line order signer has no audit that the repository found, so it counts as new code and the external audit covers it with the Easy Track factories (OD-96).
stETH, wstETH, WETH, Lido Earn, sUSDS and Sky's DAI–USDS converter. Lido Lend comes later through the Morpho Blue template. The withdrawal queue left the design on 2026-10-08.
Why EM's launch list (ADR 011). Clutch adds permissions only, never code, to these protocols.
[the screening vendor]'s approval and monitoring service
The vendor's existing service, which approves transactions and watches for depegs and protocol compromise.
Why Lido already has an arrangement with the vendor for four guarded multisigs. Above the launch cap, on-chain blocking before execution is a hard requirement (OD-54).
Fresh deployments of audited contracts, such as new Safes from the Safe singleton. The code is old; the instance and its settings are new.
The four new Safes
The Asset Safe, the emergency Safe, the orders account and the first-loss Safe: proxies of the Safe singleton.
Why Each Safe has one job: custody, unscreened recovery, orders in transit, or the first-loss shares held apart. The committee's existing Safe holds the operator role, so Clutch deploys no operator Safe (OD-80). Clutch's own script deploys the four, because the Zodiac Safe node cannot set the version or the fallback handler.
Two minimal proxies of the Roles mastercopy on the Asset Safe, one on the orders account and one on the first-loss Safe.
Why On the Asset Safe, one modifier for operation and governance and one for recovery, so recovery survives when the operator modifier is switched off. The orders account's one modifier carries the operator and emergency roles, and there the emergency role's revoke stops the operator (OD-57, OD-58). The first-loss modifier carries two narrow roles: one for the committee's Safe, which redeems to the Aragon Agent, and Easy Track's, which burns by motion (OD-60, OD-67).
Owner The DAO, through the Asset Safe, the orders account and the first-loss Safe
One instance of the vendor's existing transaction guard, of the build that the guarded Lido multisigs run.
Why Lido writes no guard code. Lido reviews the one change made after the guard's audit: both timelocks went from 1 day to 10 days. The instance is set after the launch, before the launch cap lifts (OD-54).
Two registries from Easy Track's registry factories, with Aragon Voting as their admin, and two instances of its top-up factory. The deployer sets each registry up and gives up its roles, and a check before the vote proves every role (OD-92).
Why The same pattern already pays many Lido recipients. Each registry pays only the Asset Safe, within a monthly limit.
Owner The DAO registers them; Aragon Voting administers the registries
What Lido writes for Clutch. This is where review and audit effort goes.
The permission policy
The six roles and their permissions: what the operator, governance, emergency, exit-governance, first-loss and first-loss burn roles may call, and with which arguments. Three are built; the exit-governance role and the two first-loss roles are specified (OD-49, OD-60, OD-67).
Why This is the heart of Clutch. Every permission traces back to a decision and forward to a test.
Owner@lidofinance/defi-tech; reviewers approve each change
Template factories (up to five that onboard, one that removes, and a claim template if needed), one budget factory and one first-loss burn factory for Easy Track: the only new contracts allowed.
Why Motions onboard protocols, remove branches, change budgets after an event and burn first-loss shares without a DAO vote, through factories fixed at audit time. A new orders token requires a DAO vote (OD-78).
Owner@lidofinance/defi-tech; an external audit in phase 3
New detectors on Lido's monitoring platform: drift, approvals, budgets, motions, funding, Safe changes, orders and fills, the liquidity buffer, the first-loss Safe, the cap reading and missing reports; the comparison of the two readings, rule changes made in the Zodiac UI, and late approvals of the screening vendor.
Why Caps are detective. Monitoring is how a breach is seen and how the emergency Safe is paged.
Owner@lidofinance/defi-tech writes the specification
A specification that maps every mandate rule to its controls on each layer, and the written list of the screening vendor's rules with their change control.
Why What the chain cannot enforce gets screening, monitoring and display. A relaxation of a screening rule gets review and notice (OD-39, OD-45).
Owner@lidofinance/defi-tech; the committee configures the vendor's rules
What must stay true for the design to hold, ranked by impact. Each one says what breaks if it is false and what watches it.
1 No role can reach an owner-only function of the Asset Safe, the orders account or a modifier, beyond the narrow, pinned calls that the policy grants.
Design
Why it matters
The Asset Safe owns both modifiers, and every role call runs as the Asset Safe. The emergency revoke and the governance writes work only because a narrow role may administer a modifier. The LIP calls this composition the primary risk.
If it is false
An operator, a motion or a factory bug gets administration of the vault. Fork probes found two such paths, and both are closed: a motion could grant the operator delegatecall (OD-36), or give it the safety modifier as a target (OD-38).
2 Aragon Voting is the only owner of the Asset Safe, which has no guard, no module guard and no fallback handler.
Design
Why it matters
Custody stays with the DAO, and recovery never passes through vendor code. The vault also stays off the parts of Safe v1.5.0 that changed most.
If it is false
A guard there would put recovery behind vendor code that only a DAO vote can remove. A fallback handler or a contract signature would open the least-proven paths of v1.5.0. The accepted cost: no ERC-721 or ERC-1155 safe transfers, and no EIP-1271 signing.
Watched byINV-001test_asset_safe_shape No test checks that Aragon Voting never signs as a contract. The owner, guard, module and singleton alerts are not built.
The DAO is the final authority. Only the DAO replaces the policy, enables a disabled modifier, unpauses Easy Track, moves the operator role to another Safe or sets registry limits. Every restart after an emergency stop is a DAO vote (OD-59).
If it is false
Nothing restarts after a stop: the operator stays switched off, or Easy Track stays paused. Every DAO action takes about five days, and a defect in the safety modifier leaves only the DAO path.
The committee's own Safe, at 4 of 7, holds the operator role and the first-loss role (OD-80). Two of its signers sit on the emergency Safe.
If it is false
The committee proposes its own expansions and executes the first-loss terms. A captured quorum of the committee's Safe can redeem the first-loss shares to the Aragon Agent, and can propose a burn, which LDO holders see for 72 hours before it moves the shares' value to the vault's other depositors. Two compromised committee keys do not reach the emergency role (OD-58).
5 [the screening vendor]'s guard approves each exact transaction once, fails closed, and holds no standing approval.
Trust
Why it matters
Above the launch cap, on-chain blocking before execution is a hard requirement. Once the cap lifts, the guard screens every transaction of the committee's Safe: every operator action, every new motion and the committee's other duties (OD-83).
If it is false
One standing approval of the modifier's execution function would approve all vault activity. One approved stray delegatecall can replace the code of the committee's Safe and drop the guard, and a module on that Safe would skip it. An outage stops the operator and new motions for up to ten days.
Watched by○ Not checked yet INV-010 is pending and has no test. Restricted fork tests of the vendor's guard passed on 2026-10-02. Lido's guard detector supports Safe v1.3.0 and must add this instance. The vendor's written acceptance of the no-standing-approval rule is owed. All three come before the cap lifts, not before the launch (OD-54).
6 Until the guard is live, the committee keeps the vault under a cap of one million dollars by procedure.
Operational
Why it matters
EM allowed a launch without the screening guard under that cap, on the Asset Safe and the orders account (OD-54, OD-55).
If it is false
No contract refuses a top-up above the cap: only the procedure, an objection and monitoring stop it. Until the cap lifts, no operator transaction and no motion creation is screened.
Watched by○ Not checked yet The alerts on a top-up motion that would cross the cap, and on a vault value above it, are not built.
7 The committed artifact, compiled from the constellation, is the only statement of the policy.
Design
Why it matters
Reviewers approve the artifact. The enabling vote, the Easy Track templates and the drift detector consume it. Nothing is signed that the compiler did not produce from the same commit.
If it is false
A transaction built in the hosted Zodiac app, or a change made in its UI, becomes unreviewed drift. The tests, the vote and the detector can then disagree.
Watched bypolicy.yml CI fails when the artifact differs from a fresh compile. The round-trip check (INV-016) and the drift detector are not built.
8 The locked Roles mastercopy and the pinned roles SDK encode and check conditions the way the compiler and the tests expect.
Trust
Why it matters
The deployed mastercopy is older than the upstream source, and Clutch's compiler is built on the SDK.
If it is false
Until the round-trip check exists, a compiler or SDK bug can reach the chain unseen. A change of SDK, plan or licence can block local compilation.
Watched bypolicy.yml CI runs the compiler tests and a type-check. The SDK's selectors and event topics match the mastercopy. A decode of real events is not checked yet.
9 Safe v1.5.0 has no defect on the paths that the vault uses.
Trust
Why it matters
The new Safes run it: execution, approveHash, module execution and owner management. The orders account also uses a fallback handler and contract signatures. Its record of holding value is short.
If it is false
Custody or recovery could fail. A delegatecall can replace a Safe's code without any Safe event.
Watched byINV-019test_asset_safe_shape Safe's releases, advisories and bug-bounty records are checked again before the enabling vote. The critical alert on a singleton change is not built.
10 Every template pins each receiver, owner and beneficiary, bounds each amount that moves value, never emits an administrative function, and gives the emergency role only exits.
Design
Why it matters
Motions onboard protocols without a DAO vote. The audit question becomes: can this template ever emit something unsafe?
If it is false
Any motion that survives its objection window can use a template flaw. A sound template can still point the operator at an unaudited contract; then only the attached budget bounds the loss.
Watched by○ Not checked yet No factory is built. Each needs tests for the four properties. The governance role's limits (INV-004) are a second layer.
12 The emergency Safe's signers can start any emergency action within six hours, and the Emergency Brakes multisig can pause Easy Track in that time.
Operational
Why it matters
Six hours is the mandate's ceiling and a hard gate. The measure is the time to initiate, not the time to fill an order. Every quorum of the emergency Safe needs a signer from outside the committee.
If it is false
Recovery comes late in a depeg. A misread runbook during a depeg loses funds in minutes.
Watched by○ Not checked yet The validator refuses a reviewed runbook whose drill exceeds six hours. No runbook is written or drilled yet; drills are a phase 3 gate. No response-time data exists for a group that mixes members of two bodies; the first drill measures it.
13 The emergency Safe keeps its seat rule: two committee members, two Emergency Brakes members and a fifth signer who is a member of neither body.
Trust
Why it matters
No quorum of the emergency Safe is the committee alone, and the quorum without the committee is the mandate's independent exit. It holds the switch, and the cap-breach trigger pages it.
If it is false
Seat capture: any three signers can change the owners, for example to add a third committee member. The committee could then act alone, or the independent exit would be lost. A worsening breach or a defect would go on.
Watched byINV-026test_operator_holds_only_the_operator_key The emergency Safe is not deployed, and its fifth signer is not chosen. The owner-change alert and the paging alert on the trigger are not built.
14 Monitoring detects a cap breach, and the committee fixes it within two working days.
Design
Why it matters
The permission layer cannot see value, so no contract reverts on a cap.
If it is false
A breach goes unseen or unfixed. Every detective control ends at a person, whom the mandate must name.
Watched by○ Not checked yet The detector specification is phase 1 work. The fortnightly cap reading and its paging alert are decided, not built. Permissions do not widen when monitoring stops.
15 CoW's order signer, ComposableCoW and CoW's fallback handler work on Safe v1.5.0 behind a Roles modifier, and each role's orders pay only their pinned receiver.
Design
Why it matters
Every swap runs through the orders account. The pinned receiver keeps the operator's proceeds in the vault and recovery proceeds at the Agent.
If it is false
If the fallback handler or the order signer fails on Safe v1.5.0, the vault has no limit or TWAP orders. If a receiver pin fails, an order could pay another account.
Watched by○ Not checked yet INV-022 and INV-023 are pending. The fork tests are owed before the design is relied on.
16 CoW's solver competition and EBBO rule, screening, the orders budgets and monitoring of each fill keep order prices close to the market.
Trust
Why it matters
Nothing on chain bounds a CoW order's price. Its limit is a number that the caller chooses, and recovery orders have no on-chain floor (OD-48).
If it is false
A careless or hostile limit sells below the market when solvers fail to compete or break the EBBO rule beyond what a bond repays, or when liquidity is thin. The budgets bound the operator's transfers; the emergency role's orders are neither budgeted nor screened.
Watched by○ Not checked yet CoW DAO enforces the EBBO rule after the fact. [the screening vendor] has not confirmed a price check. The fill-price and recovery-limit alerts are not built.
18 The liquidity buffer stays at or above one month of baseline spend.
Operational
Why it matters
The committee requires it. Nothing on chain enforces it.
If it is false
The vault cannot meet a month of baseline spend from liquid stablecoins.
Watched by○ Not checked yet The detector is specified, not built, and the runbook to restore the buffer is not written. The screening rule is requested from the vendor. The figure comes from the attested computation with the approved mandate.
19 The 72-hour objection on each top-up keeps funding inside the mandate. The registry limit is only the backstop.
Design
Why it matters
The mandate makes the objection the control of a top-up.
If it is false
Without an objection, the committee's Safe can pull one mandate size per registry per month, and two within about 72 hours around a month boundary. The mandate size and the treasury share then hold only by procedure.
Watched by○ Not checked yet INV-017 is pending: no registry, factory or test exists. The funding flags are not built.
20 Budgets in token units bound the monthly flow to each spender; the caps are measured, not enforced by budgets.
Design
Why it matters
The modifier can count only token units per key, while caps are ratios of value.
If it is false
Budgets drift with price, and no budget motion follows the price (OD-56). A key can allow more than its cap's room after a price rise; the published cap reading, and the guard once it is live, catch a breach. Keys for Lido products bound only the monthly movement, a weak control.
21 The attested computation behind budgets, limits and ceilings ran correctly on inputs that match the approved mandate.
Operational
Why it matters
No financial figure may enter the repository except from an attested computation.
If it is false
Budgets, registry limits and approval ceilings would be too loose or too tight. A changed mandate needs a new run.
Watched by○ Not checked yet It ran with an independent attester and pinned inputs on 2026-09-22 and 2026-10-02. The results enter only after the mandate is approved.
23 Lido Earn's curators act in the vault's interest, and Earn shares stay transferable until the first-loss shares move.
Trust
Why it matters
earnETH and earnUSD are launch positions, and the first-loss shares move to the first-loss Safe after the enabling vote.
If it is false
Curator misbehaviour becomes a financial emergency. A pause, whitelist, lockup or blacklist on the shares is a reversal condition.
Watched bytest_D3b_earn_deposit_policy_layer Fork tests of the share transfer, the burn motion and the first-loss role are owed. The first-loss balance alert is not built.
27 The test harness behaves like the real system for what the tests claim.
Design
Why it matters
The LIP's Implemented parts rest on fork tests. Nothing is deployed, and no audit is done.
If it is false
Green tests can miss real behaviour: the real Aragon Voting path, the real Easy Track and the screening guard.
Watched bytest_02_enabling_vote_end_to_end The kit's harness mocks Aragon Voting, which owns the Asset Safe, the Aragon Agent, Easy Track and its executor, and uses plain stand-in addresses for the committee's Safe and the emergency Safe. The enabling-vote rehearsal runs the real Aragon Voting, ACL, Finance and Easy Track.
Where the work stands. These tables are read from the repository when the page is built.
Roadmap
The roadmap is gated, not dated. A phase starts when the gates of the one before it close.
0. DecisionsAccept design ADRs 005–011 and process ADR 012; EM has accepted setup ADRs 001–004. Close or defer open decisions. Written confirmation of no standing approvals and consent to be named are due before the launch cap lifts, not before launch (OD-54).Gate: EM accepts each ADR. Each open decision is closed or explicitly deferred.
1. SpecificationWrite architecture, roles matrix, permission model, threat model and monitoring specifications. Give each invariant an ID. Keep the constellation policy, its compiler, its artifact and the fork tests in line with the accepted ADRs; the port exists since 2026-10-06 (OD-33). Set up the Lido Zodiac workspace (OD-35). Write the control matrix and screening rule list (OD-39, OD-45). Send the screening vendor its questions and the policy provider the UI requirements (OD-44, OD-84 to OD-88). Fork-test the CoW order signer and ComposableCoW from Safe v1.5.0 behind a Roles modifier (OD-43). Draft runbooks. Import the budget computation after mandate approval.Gate: The acceptor accepts the specifications. Each invariant has an ID and names its ADR.
2. BuildBuild the round-trip check. Add the orders account, first-loss Safe, their modifiers and permissions, the first-loss and first-loss-burn roles, and the burn factory (OD-42, OD-43, OD-60, OD-67). Build Easy Track factories, each with its emergency exit through exit-governance (OD-49), and a budget factory that can set several keys in one motion (OD-94). Build the command that computes each Safe batch's hash again (OD-92). Configure funding. Build reporting, buffer detection, the mandate's rule data, and the comparison of Lido's reading with the policy provider's (OD-40, OD-84, OD-87). Enforce invariant-to-test coverage and one-command verification. Run fork tests in CI on main and in the merge queue. Keep the archive RPC key in repository secrets; never use it on pull requests (OD-52).Gate: CI enforces a passing test for each invariant. One command verifies each permission change.
3. AssuranceAudit the Easy Track factories, CoW's order signer, the policy and the deployment externally. The order signer has no known audit, so it counts as new code (OD-96). Lido reviews the guard's post-audit change before the launch cap lifts. Lido reviews the TWAP handler unless an audit covers it (OD-43). Drill each emergency and technical action on a fork. Check the LIP against the specifications.Gate: Audit findings are closed or accepted. Each emergency drill starts its action within six hours.
4. Governance and deploymentPublish the mandate on the forum and hold its Snapshot. Appoint the emergency Safe's fifth signer by Snapshot: a member of neither the committee nor the Emergency Brakes multisig (OD-58). Prepare the LIP and enabling on-chain vote, with the Safe batches published for review (OD-92). Rehearse the vote and the batches at a recent block, with the check of the shared payment permission, before the vote starts and again before it executes (OD-92, OD-93). Repeat Safe release, advisory and bug-bounty checks shortly before the vote (OD-17). Deploy without the guard, under the one-million-dollar cap that the committee keeps by procedure (OD-54, OD-55). The Growth Committee transfers first-loss Earn shares to the first-loss Safe. Then enact the seed motion within the cap.Gate: Safe checks find no change on the vault's paths, or EM decides again. A fork rehearsal of the vote verifies the orders account's CoW fallback handler, ComposableCoW domain verifier and relayer approvals. The vote passes. Deployed state matches the artifacts.
5. OperationPublish monthly reports and fortnightly cap readings on IPFS. Change budgets by motion only after an event (OD-56). Repeat drills. Before the cap lifts, set the guard on the committee's Safe with bypass mode off (OD-83). Put the screening vendor's terms in place and complete Lido's review of the post-audit guard change. The committee's forum post then lifts the cap (OD-54).Gate: Continuous operation.
What is still owed
EM accepts ADR 005 to ADR 012.
A Snapshot appoints the emergency Safe's fifth signer, a member of neither the committee nor the Emergency Brakes multisig (OD-58, OD-65).
The committee's valuation policy sets the price waterfall's band and the share of the vault that its last level may price (OD-62). It also sets the band between the two readings (OD-84).
[the screening vendor] confirms in writing that it accepts no standing approvals and agrees to be named.
[the screening vendor] says which rules it can check before execution: the liquidity buffer, the caps, an order's limit and a router swap's minimum output.
The policy provider answers the requirement list: its own reading of the three Safes, its reports on IPFS, its refusal at signing, the mandate's rules from this repository, and the screening vendor's approval in its signing flow (OD-44, OD-84 to OD-88).
[the screening vendor] also says whether it records rule changes and whether it can delay a relaxation.
The mandate's Snapshot text owes ten changes, and its forum post four, before the Snapshot vote (OD-90).
Fork tests owed: CoW's order signer and TWAP orders on Safe v1.5.0 behind a Roles modifier, before the orders account is relied on; the Morpho Blue template end to end; the burn motion and the first-loss role with their built factory and policy. The enabling-vote rehearsal covered the payment rewrite, the first-loss share move and Aragon Voting's approved hashes on the three Safes (OD-92).
Figures owed from the attested computation once the mandate is approved: the budgets, the orders budgets, the funding limits and the liquidity buffer.
The mandate's drafters owe the holder and the form of the Twyne position.
The enabling vote's Safe batches, published with one command that computes each hash again (OD-92).
The mandate's drafters owe the treasury share's base, the time of its test, the remedy for a breach that no vault transaction causes, and the eligibility conditions of a replenishment (OD-89).
The production deployment script is not written yet. The enabling-vote page lists what the one vote holds.
Open decisions
OD-65 Who holds the emergency Safe's fifth seat? The fifth signer is a member of neither the committee nor the Emergency Brakes multisig (OD-58), and a DAO Snapshot appoints them.
Pages by review state: 4 human-reviewed, 40 slop.
The LIP, part by part
In the LIP, Implemented means built and tested on a fork. Nothing is deployed.
committee's Safe, as the removal template's trusted caller; the emergency Safe in an emergency
No
No
Zero the approvals
emergency Safe
No
No
Exit positions to the Safe
emergency Safe
No
No
Recovery order
emergency Safe
No
No
Cancel orders and sweep the orders account
emergency Safe
No
No
Return assets to the Agent
emergency Safe
No
No
Switch the operator off
emergency Safe
No
No
Pause Easy Track
Emergency Brakes multisig
No
No
Restart after a stop
DAO
No
No
Top up the vault
committee's Safe
No
No
Move the legacy Earn shares
the Growth Committee's Safe
No
No
Burn first-loss Earn shares
committee's Safe, as the burn factory's trusted caller
No
No
Exit the first-loss shares
committee's Safe
No
No
Re-set a funding limit
DAO
No
No
Restore the liquidity buffer
committee's Safe
No
No
Unlock a matured product
committee's Safe, as the budget factory's trusted caller
No
No
Remove the screening guard
the owners of the committee's Safe
No
No
Move the operator role to another Safe
DAO
No
No
Rotate a signer
the committee's Safe; the emergency Safe for a seat
No
No
Re-affirm open orders
the committee, through the committee's Safe
No
No
Cancel orders on a policy change
committee's Safe, or the emergency Safe
No
No
Replace the operator modifier
DAO
No
No
Glossary
Plain definitions. A dotted underline anywhere on the page links to a term here.
ADR
A numbered decision record in docs/adr/. An agent drafts it. It stays proposed until EM, and later the committee, accepts it. An acceptance authorises nothing on chain.
Permission for a named contract, the spender, to pull tokens from the Safe. In Clutch, an approval to a protocol spends that spender's budget key or stays under a fixed ceiling. An approval of zero is always allowed.
The DAO's treasury contract. Recovered assets come back to it, and Aragon Finance pays the vault's funding out of it. Aragon Voting, not the Agent, owns the vault's Safes.
The committed JSON file that reviewers approve. It holds the modifier calls in order, the expected condition tree for every role, target and function, and the budget keys.
Format clutch.policy-artifact/1. The committed one is compiled against the fork-test manifest, not mainnet.
A refillable spending quota on the operator modifier, counted in token units. A permitted call draws it down, and it refills each period up to a maximum.
A Zodiac allowance: balance, maxRefill, refill, period and timestamp under a 32-byte key. The key is the label in bytes, such as bytes32("earn_usd_deposit").
Clutch's own TypeScript program on the Zodiac roles SDK. It turns the constellation into the artifact offline, and it refuses entries that only the hosted app can compile.
The Zodiac description of the Safes, the modifiers, the roles, the permissions and the budget keys, written in TypeScript under policy/constellation/. It is the source of Clutch's permission policy.
The specification that maps every mandate rule to its controls on each layer: the on-chain policy, screening before execution, monitoring with alerts, and display in the Zodiac UI.
CoW Protocol, an order-based exchange. Every vault swap is a CoW order from the orders account. Solvers compete to fill an order at its limit or better, and the EBBO rule holds a fill to the on-chain market; nothing on chain bounds the price.
A call that runs another contract's code inside the caller's own storage. A delegatecall from a Safe can therefore rewrite the Safe itself. No motion can grant it to the operator (OD-36).
The layer that a DAO vote passes through before the Aragon Agent executes it. It adds a delay. The vault does not use it: Aragon Voting owns the vault's Safes, so a vote on the vault runs directly.
Ethereum best bid and offer: CoW's rule that solvers must fill an order at least as well as on-chain AMM routing would. A solver that breaks it must refund the user, or its bond is slashed.
The DAO vote that turns the system on. It registers the factories and adds USDS to the payment permission and to the shared stablecoin token list. For the vault's Safes, it approves the hash of each Safe batch, and anyone sends the batches after the vote: they apply the policy compiled for mainnet, grant the roles, and set up the orders account and the first-loss Safe.
A contract that a Safe forwards unknown calls to, for example to accept NFT safe transfers or to sign messages. The Asset Safe has none, on purpose. The orders account uses CoW's, because conditional orders need it.
A Safe that Aragon Voting owns, which holds only the first-loss shares. Its one modifier carries two narrow roles: Easy Track's, which burns the shares only by enacted motion, and a role of the committee's Safe, which redeems them to the Aragon Agent.
The DAO's earnETH and earnUSD shares from the March 2026 Earn allocation. They take losses first, to protect other depositors. They move to the first-loss Safe. On the Earn team's written instruction, they burn by Easy Track motion, after the objection window, or the committee redeems them to the Aragon Agent through one narrow role.
A contract that a Safe asks before each transaction that its owners sign. Here, [the screening vendor]'s guard on the committee's Safe, set after the launch and before the launch cap lifts (OD-83). A module guard does the same for module transactions; Clutch uses none.
A cap of one million dollars on the Asset Safe and the orders account while the screening guard is not live. The committee keeps it by procedure: top-ups stop at the cap, monitoring alerts above it, and LDO holders can object. A forum post lifts it once the guard is set with its bypass mode off.
A CoW order that sells only at a set price or better. It can stand for up to 90 days, like every operator order. A sale when a price rises to a target is a limit order.
The stablecoins that the Asset Safe holds directly, and sUSDS, kept at or above one month of baseline spend. Monitoring watches it, every report shows it, and the committee restores it within the mandate's window.
The Treasury Management mandate: the rules that the committee runs the vault by. It is not yet approved. Its figures enter the repository only after its Snapshot vote.
The ceiling of the vault's funding. The vault holds up to it in assets: each funding counts in US dollars at its value when it is funded, and the legacy positions count too. No top-up refills the vault to it by right, and a larger size needs a separate DAO approval. It also sets each funding registry's limit per month and the fixed approval ceilings. Its figure is not in the repository.
A contract that a Safe has switched on, so that it can make the Safe act without owner signatures. The two Roles modifiers are the Asset Safe's modules.
One Easy Track proposal. Its factory's trusted caller creates it, and it enacts after the objection window. Easy Track rebuilds and hash-checks its script at enactment.
A Lido product, such as Lido Lend, that counts against the protocol cap until it meets the mandate's maturity criteria and a motion unlocks it. earnETH and earnUSD are not new.
A Safe that Aragon Voting owns, with CoW's fallback handler and one modifier of its own. The roles place CoW orders from it. It holds only tokens in transit.
The rule stored for one role, contract and function. It says which argument values are allowed. A new write replaces the old rule; it does not add to it.
The written order of price sources for a report: Coingecko's close, a second aggregator, a Chainlink feed or a pool's time-weighted price, the on-chain rate into a priced underlying, and last the committee's estimate. No asset is unpriced, and every price shows its level.
An order that the emergency role places from the orders account. It sells an asset for USDC, or USDT as the second destination, and pays the Aragon Agent. No guard screens it.
A delegatecall to CoW's order signer, which lives at most 1 day.
Request for solution: the requirements that Lido contributors sent to the policy provider. It asked what the provider supports today, what needs work and what it cannot do. The RFP tab maps each ask to Clutch's answer.
A named set of permissions on a modifier: operator, governance, emergency, exit governance, first-loss or first-loss burn. A Safe or contract that holds the role can make the calls that it allows.
On chain, a 32-byte key names the role. In Clutch the key is the label in bytes, such as bytes32("operator").
A Zodiac module that checks each call against the caller's role, refuses anything not explicitly allowed, and runs the rest as the Safe. Clutch has four: an operator modifier and a safety modifier on the Asset Safe, one orders modifier on the orders account, and one first-loss modifier on the first-loss Safe.
A planned check that rebuilds the applied permissions from the modifier's on-chain events on a fork, and compares them with the artifact. The chain then checks the compiler.
The vault's first funding, one motion after the enabling vote. It is at most the mandate size, less the value of the first-loss shares at the report's price rule, and at most the launch cap until the cap lifts.
Lido's treasury swap contracts. The design used Stonks 2.0 instances until 2026-10-06, when the orders account replaced them: they offered no limit or TWAP orders (OD-43).
The emergency role's call that disables the operator modifier on the Asset Safe. The operator stops, and so does every queued motion that writes through that modifier. Recovery keeps working. Only a DAO vote turns the operator on again.
disableModule(prevModule, operatorModifier) on the Asset Safe, with the module argument pinned by EqualTo.
An Easy Track motion that pays the Asset Safe from the DAO treasury, within the funding registry's limit per month. After the seed, a top-up needs the mandate's published eligibility conditions, and it keeps the vault within the mandate size and the treasury share.
The largest part of the DAO's non-LDO treasury that the vault may hold. The mandate sets it. The mandate still owes the share's base, the time of its test, and the remedy for a breach that no vault transaction causes.
The only address that may create motions on an Easy Track factory, fixed when the factory is deployed. For every Clutch factory it is the committee's Safe (OD-80).
Time-weighted average price: a CoW order in equal parts at a fixed spacing. It buys or sells a position over time, which is how the vault averages its cost.
Lido's contract that turns stETH back into ETH. A request cannot be cancelled and takes days to finalize. The vault does not use it: it left the design on 2026-10-08, and stETH is sold in CoW orders instead.