Skip to main content

Administration, Risk, and Security

Multiswap’s current architecture has an explicit administrative trust boundary.

Owner powers​

The Dispatcher owner controls module installation and protocol configuration. Depending on the installed modules, administrative actions can include:

  • adding or replacing function selectors,
  • initializing pools,
  • registering assets and roles,
  • configuring quote parameters and oracles,
  • preparing and settling deposit phases,
  • updating pool-specific operational settings.

These powers can materially affect quoting and settlement. They should be included in any integration or risk review.

Progressive decentralization​

Multiswap is not decentralized merely because it runs on a blockchain. Today, its administrative powers are real, and they are disclosed above.

Our goal is for Multiswap to become completely decentralized when appropriate. In practice, that means after the protocol has been battle-hardened and there are enough CAV holders to support effective decentralized governance. The goal is real decentralization, not governance that exists in name but remains controlled by a handful of people.

That transition should be progressive and verifiable. As the protocol matures, administrative powers should be narrowed, distributed, timelocked, transferred to CAV governance, or removed entirely. The intended end state is a permissionless protocol whose core operation does not depend on CavalRe or any other privileged operator.

We do not believe decentralization should be performative or rushed. Administrative control can make a young protocol safer and easier to repair. But it should not become permanent merely because it is convenient. Every retained power should have a clear purpose, be visible onchain, and have a credible path toward elimination.

Integrator controls​

An integrator should:

  1. pin the expected chain and Dispatcher,
  2. monitor selector and ownership changes,
  3. validate pool and token roles onchain,
  4. read quote state from one block,
  5. simulate settlement with current calldata,
  6. enforce per-asset minimum receive amounts,
  7. cap allowances and native value,
  8. expire signed intents quickly.

Pool risk​

Multiswap changes AMM price-impact mechanics; it does not eliminate asset risk.

Pool users remain exposed to:

  • token contract and issuer risk,
  • oracle and anchor configuration risk,
  • reserve concentration,
  • target-allocation decisions,
  • smart contract bugs,
  • administrative compromise,
  • chain and bridge risk,
  • testnet or deployment instability.

Status and audits​

Testnet availability is not an audit claim. A production deployment should publish its deployed commit, verified addresses, ownership structure, audit reports, known limitations, and emergency procedures in the same release record.

Until that record exists, treat these docs as mechanism and testnet integration documentation, not a representation that a production deployment is risk-free.