Reference

Roles & Permissions

Every privileged action is gated to the TimelockController, a Timelock-pinned Chainlink CRE Forwarder, or a scoped Zodiac module.

Every re-pointable contract carries one owner: a TimelockController with a ~2-day delay.

• team — the deploying multisig that hands ownership to the Timelock.
• adminSafe — the single destination for protocol take (recovery slash, origination fee).
• warehouseSafe — the senior backing: a share-accumulator custodying the EulerEarn shares behind zipUSD, asserted distinct from every junior Safe.
• redemptionBox — the one address the warehouse may send freed USDC to: the par-redemption queue.
• erebor — the only address a credit-line draw may send borrowed USDC to.
• creOperator — the keeper driving the engine modules’ operator-gated calls.
• workflowAuthor — the CRE workflow identity the receivers trust.

Zodiac Roles Modifier v2

The WarehouseAdminModule CRE workflow can only run one of four operations — SUPPLY, APPROVE, REDEEM, REPAY — with every receiver, spender, and destination restricted in scope.

[We will escalate from a Timelock to an immutable codebase, when we have concluded testing.]