Security model
This page states who can do what, and what you have to trust. The full list of findings and
justifications from static analysis is in the repository's docs/SECURITY.md.
Roles
| Role | Can | Cannot |
|---|---|---|
| Maker owner | deposit, withdraw (always), add and revoke operators, pause and unpause its maker | touch other makers' funds |
| Operator (hot key) | update its maker's quotes, pause its maker | withdraw, deposit, unpause, add operators |
| Guardian | pause swaps globally or per pool, set a pool's reference adapter and deviation bound, set inventory caps within bounds | move, freeze or redirect maker funds; block withdrawals |
| Owner (two-step transfer) | set the guardian, the protocol fee (≤ 10 bp) and the treasury; collect accrued fees to the treasury | touch maker inventory; raise the fee above 10 bp |
| Anyone | register as a maker, create a pool within global bounds, swap |
Every admin parameter has hard-coded bounds in the contract and every state change emits an event.
What a compromised key can do
- Operator key: post bad quotes for its own maker and trade against them from another account. That can drain that maker's inventory at bad prices, the same exposure as a compromised Hyperliquid agent wallet. Mitigations: per-block fill caps, a per-pool reference-price guardrail when an adapter is set, and instant revocation by the owner. It can never withdraw.
- Guardian key: pause trading (a liveness attack). Makers can still withdraw everything.
- Owner key: set a new guardian or treasury and collect protocol fees already accrued. No path to maker inventory exists in the code.
Trust assumptions
- Single sequencer. Elysium has one sequencer (operated with Conduit). It orders by priority fee and says it favors no one, but it could censor or reorder. There is no public mempool.
- Settlement. Elysium is an Arbitrum Orbit rollup with AnyTrust data availability settling to HyperEVM. Withdrawals to HyperEVM are optimistic and wait out a challenge period.
- Future HyperCore precompile. Kinetiq's market-data precompile (about four weeks after mainnet) is attested by the sequencer, not proven. Our adapter treats it as a guardrail input with a maximum age, never as a price source for fills.
- Uniswap v4. Pools run on a PoolManager either from Uniswap's official deployment (once published and verified) or our deployment of the pinned official commits. Inventory is held as ERC-6909 claims in that PoolManager.
- Tokens. Fee-on-transfer and rebasing tokens are unsupported. Deposits credit only what the PoolManager actually received.
Invariants we test
- For every currency, the sum of maker balances plus accrued fees equals the hook's ERC-6909 claims.
- No fill executes on an expired, paused or over-cap quote.
- Operators never reduce the owner's withdrawable balance except through fills.
- The guardian never moves maker funds.
- No fill is better for the taker than the maker's quoted price.