Timelocks, guardians and invariants: how Oblio is kept safe

A staking pool is only as trustworthy as the powers behind it. Oblio separates powers on purpose: changes that could hurt users are slow, and actions that protect users are fast.

Roles

• Admin: proposes parameter and action changes, and is the only role that can unpause.
• Guardian: can pause the protocol and can drain a bucket instantly. It cannot unpause, re-weight or re-activate a bucket.
• Fee recipient: the only address protocol fees can ever be sent to. Claiming is permissionless.
• Upgrade authority: the only key that can initialize the protocol, which stops front-running of setup.

Admin transfer is two-step. The new admin must accept, and the current admin can cancel before that.

Privacy and oversight

The confidential transfer settings of the mint are controlled through a timelocked action. The admin can configure whether new confidential accounts are auto-approved and can set an auditor key, a public key that lets a designated party decrypt amounts. Everyone else only sees ciphertext. This is the mechanism that lets private balances coexist with institutional oversight.

Timelocks

Parameter changes follow propose, wait, execute. Role changes, bucket weights and the confidential mint settings use a timelocked action: the instruction only succeeds if it exactly matches the pending proposal and its delay has passed, and a proposal is consumed once. The timelock itself is bounded: it can never be set below one hour, so governance cannot remove the delay.

Fast in the safe direction

The guardian can stop feeding a misbehaving validator immediately by draining its bucket, which sets its weight to zero and marks it for unwinding. Bringing it back needs the timelock. A guardian pause blocks deposits, instant exits and reward injection, but ticket orders and claims continue so holders are never locked in.

The circuit breaker

On every sync the program recomputes real assets from the raw lamports in every stake account and compares them with its books. If the value dropped beyond tolerance, or the rate fell below its lower bound, the protocol pauses itself, does not apply the new accounting, and blocks every price-dependent path until the admin reviews and unpauses. Small losses within tolerance are absorbed without pausing.

Invariants we test

The integration suite runs the compiled program against the real Token-2022 and stake programs, and a stateful fuzzer applies random sequences of deposits, exits, cranks, reward credits and donations. After every instruction it checks:

• Physical partition: the gateway always holds at least rent plus protocol fees, funded unclaimed tickets and the reserve.
• Value reconciliation: right after a sync, booked assets equal the value recomputed from raw lamports.
• Price monotonicity: no user or crank operation can lower the share price.
• Atomicity: a failed transaction leaves state and supply byte-identical.
• Queue accounting: what is owed to tickets equals the sum of open tickets.

Tests are not an audit. Oblio is an unaudited devnet beta and should be treated as experimental software.