Role separation: upgrade ≠ fee ≠ oracle

Evidence summary #

All three governance roles (upgrade, fee/reserve config, oracle config) route through the single Timelock as final executor. Role separation exists at the calldata level (different target contracts, different functions) but all execution concentrates through the same Timelock address. Design choice, not misconfiguration.

Sources #

Methodology #

Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.

See the full factor methodology and distribution across all protocols →