> For the complete documentation index, see [llms.txt](https://developers.term.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.term.finance/access-controls/further-details.md). # Upgradeability Smart contract code can't be modified after being deployed to the blockchain. In order to facilitate potential upgrades, bug fixes or security updates, Term Finance smart contracts adopt OpenZeppelin's implementation of the [UUPS Proxy Pattern](https://docs.openzeppelin.com/contracts/4.x/api/proxy#UUPSUpgradeable) to facilitate necessary updates, with the intent to gradually remove upgradeability altogether over time. Consistent with OpenZeppelin's recommendation for smart contracts that adopt the UUPS proxy pattern, the [\_authorizeUpgrade](https://docs.openzeppelin.com/contracts/4.x/api/proxy#UUPSUpgradeable-_authorizeUpgrade-address-) function is overridden to restrict access to an address set to the DEVOPS\_ROLE. The DEVOPS\_ROLE is reserved for the most sensitive Protocol admin actions (including upgrades) and is held only by the OwnerlessSafe. Actions reach the OwnerlessSafe through a 24-hour timelock, during which Term multisig holders and TERM token holders can veto them and a pause can halt execution. The architecture is detailed below. {% hint style="info" %} The configuration on this page is for Ethereum mainnet. It has been formally verified with the Certora Prover and checked against on-chain state. See [Formal verification](#formal-verification). {% endhint %} ## DEVOPS\_ROLE Governance Architecture
DEVOPS_ROLE governance on Ethereum mainnet: execute, veto and pause paths

DEVOPS_ROLE transactions pass through a 24-hour timelock that TERM token holders and Term multisig holders can veto, and that can be paused

### Execute path 1. The [DevOps-Proposer Safe (5/11)](https://app.safe.global/home?safe=eth:0xd5E12854A3Dba99deF295A7635D3Ba16427d2A28) queues a transaction on the [Zodiac Delay Modifier](https://etherscan.io/address/0x0C19d8A404079d71E5CA3e32fE3f758Ab543ACdf). It is the Delay Modifier's only module, so it is the only account that can queue. 2. The transaction waits through a 24-hour cooldown, during which it can be vetoed or paused. 3. Once the cooldown has passed, anyone can execute the transaction during the following 24-hour window (between 24 and 48 hours after it was queued). After that it expires and must be queued again. 4. The Delay Modifier executes the transaction through the [OwnerlessSafe](https://app.safe.global/home?safe=eth:0xb8A1dF43c1c88b13937C0c5CEBbAd15830cAeC03), the only holder of DEVOPS\_ROLE, which calls the protocol contract. The OwnerlessSafe's own signers can also act directly, without the delay, but only with all 9 of 9 signatures. ### Veto path Vetoes cancel queued transactions by advancing the Delay Modifier's transaction nonce (`setTxNonce`). Only the Delay Modifier's owner, the [DelayOwnerSafe (5/11)](https://app.safe.global/home?safe=eth:0x2a875746D0c88EBD2bbBfc8F8a773c58c3373ad3), can do this. A veto can only cancel transactions; it cannot create one. There are two ways to veto: * **Term multisig holders** sign a `setTxNonce` transaction on the DelayOwnerSafe. The DelayOwnerSafe has the same 11 signers as the DevOps-Proposer Safe. * **TERM token holders** pass a vote on the [TERM Governor](https://etherscan.io/address/0x2B715634134220ffeEE9458b4e34E41A41418607). The Governor acts through a [Zodiac Roles Modifier](https://etherscan.io/address/0xaBAC51B6AEb05a2CE65310F79e64DF203D6c8Ab3) that is a module of the DelayOwnerSafe. The Roles Modifier has no owner, and its single permission lets the Governor call only `setTxNonce` on the Delay Modifier. A [SetTxNonceGuard](https://etherscan.io/address/0x7aE03372ECDcEe335CdEfB7d354d507F0506616C) on the Roles Modifier enforces the same restriction. | TERM Governor setting | Value | | --------------------- | ------------------------------------------------------------------------------- | | Voting token | [TERM](https://etherscan.io/address/0xC3d21f79C3120A4fFda7A535f8005a7c297799bF) | | Voting delay | 0 (voting opens as soon as a proposal is created) | | Voting period | 22 hours | | Proposal threshold | 1,000 TERM | | Quorum | 1% of total supply (1,000,000 TERM), counting For and Abstain votes | | Timelock | None | Because the voting period (22 hours) is shorter than the Delay Modifier's cooldown (24 hours), a veto proposal created shortly after a transaction is queued can pass before that transaction becomes executable. ### Pause path A [PauseGuard](https://etherscan.io/address/0x3A70244c0fEc95B5Dd238dfa60DAbDB60a99f618#code) is installed as the Delay Modifier's guard. While it is paused, no queued transaction can be executed. A transaction that expires while paused must be queued again. | PauseGuard role | Holder | Permissions | | -------------------- | ------------------------------------------------------------------------------------------------------------ | -------------------------------------- | | Pauser | [PauseSafe (2/9)](https://app.safe.global/home?safe=eth:0x74f3F3dEfdC563bbFC8637BaB2d30596D2817472) | Pause | | ADMIN\_ROLE | [Admin Gnosis Safe (4/10)](https://app.safe.global/home?safe=eth:0x73d1C7dc9CEb14660Cf1E9BB29F80ECF9E97D774) | Unpause, change the Pauser | | DEFAULT\_ADMIN\_ROLE | None (`address(0)`) | Nobody can grant or revoke ADMIN\_ROLE | Like a veto, a pause can stop a queued transaction but cannot create one. ### Configuration locks The setup is protected against reconfiguration: * A [ConfigLockGuard](https://etherscan.io/address/0xeda83f6d7A8A56D4AA5433Bf7cC1fef496036d53#code) is installed on the DevOps-Proposer Safe, the OwnerlessSafe and the DelayOwnerSafe. On transactions signed by a Safe's owners, the Safe cannot change its own guard, modules or fallback handler, or make a delegate call. On the DelayOwnerSafe it also locks the Delay Modifier's owner, modules, guard and target. * The Roles Modifier's owner is `address(0)`, so its configuration, including the Governor's single permission, can never change. * The Governor has no timelock, and its voting token, proposal threshold, voting threshold and quorum cannot be changed. | What | Who can change it | | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Signers of the DevOps-Proposer Safe | DevOps-Proposer Safe signers | | Signers of the DelayOwnerSafe | DelayOwnerSafe signers | | Signers of the OwnerlessSafe | OwnerlessSafe signers (9/9), or the DevOps-Proposer Safe through the execute path | | Guard, modules and fallback handler of the OwnerlessSafe | The DevOps-Proposer Safe, only through the execute path (timelocked, vetoable and pausable) | | Delay Modifier cooldown and expiration | DelayOwnerSafe signers | | Guard, modules and fallback handler of the DevOps-Proposer Safe and DelayOwnerSafe | Nobody | | Delay Modifier owner, target, modules and guard | Nobody | | Roles Modifier configuration | Nobody | | Governor voting token, proposal threshold, voting threshold and quorum | Nobody | ## Formal verification The properties on this page are established in the [Governance Configuration Proof](https://github.com/term-finance/zodiac-modifier-roles-v1/blob/main/packages/evm/certora/governanceConfigurationProof.md), which combines two kinds of evidence: * **Formal verification** with the [Certora Prover](https://www.certora.com/prover) shows that, given the stated configuration, the Safes, modifiers, guards and Governor enforce these properties, including that there are no other execution paths. The specs are in [`packages/evm/certora`](https://github.com/term-finance/zodiac-modifier-roles-v1/tree/main/packages/evm/certora). * **On-chain reads** at stated mainnet blocks show that the deployed contracts have that configuration. The proof concludes: 1. Only Term multisig holders on the DevOps-Proposer Safe and on the OwnerlessSafe can execute DEVOPS\_ROLE methods, provided the call is not vetoed. 2. Only TERM token holders and Term multisig holders can veto Delay Modifier transactions. 3. The Roles Modifier's configuration and the Governor's voting token, proposal threshold, voting threshold and quorum cannot be changed by anyone. 4. The remaining settings can be changed only by Term multisig holders, as listed in the table above. ## Contract addresses (Ethereum) | Contract | Address | Configuration | | -------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | OwnerlessSafe | [0xb8A1dF43c1c88b13937C0c5CEBbAd15830cAeC03](https://etherscan.io/address/0xb8A1dF43c1c88b13937C0c5CEBbAd15830cAeC03) | Safe v1.3.0, 9 of 9 · holds DEVOPS\_ROLE · module: Delay Modifier · guard: ConfigLockGuard | | DevOps-Proposer Safe | [0xd5E12854A3Dba99deF295A7635D3Ba16427d2A28](https://etherscan.io/address/0xd5E12854A3Dba99deF295A7635D3Ba16427d2A28) | Safe v1.3.0, 5 of 11 · no modules · guard: ConfigLockGuard | | DelayOwnerSafe | [0x2a875746D0c88EBD2bbBfc8F8a773c58c3373ad3](https://etherscan.io/address/0x2a875746D0c88EBD2bbBfc8F8a773c58c3373ad3) | Safe v1.4.1, 5 of 11 · module: Roles Modifier · guard: ConfigLockGuard | | Admin Gnosis Safe | [0x73d1C7dc9CEb14660Cf1E9BB29F80ECF9E97D774](https://etherscan.io/address/0x73d1C7dc9CEb14660Cf1E9BB29F80ECF9E97D774) | Safe v1.3.0, 4 of 10 · PauseGuard ADMIN\_ROLE | | PauseSafe | [0x74f3F3dEfdC563bbFC8637BaB2d30596D2817472](https://etherscan.io/address/0x74f3F3dEfdC563bbFC8637BaB2d30596D2817472) | Safe v1.4.1, 2 of 9 · PauseGuard Pauser | | Delay Modifier | [0x0C19d8A404079d71E5CA3e32fE3f758Ab543ACdf](https://etherscan.io/address/0x0C19d8A404079d71E5CA3e32fE3f758Ab543ACdf) | 24h cooldown, 24h expiration · owner: DelayOwnerSafe · module: DevOps-Proposer Safe · target: OwnerlessSafe · guard: PauseGuard | | Roles Modifier | [0xaBAC51B6AEb05a2CE65310F79e64DF203D6c8Ab3](https://etherscan.io/address/0xaBAC51B6AEb05a2CE65310F79e64DF203D6c8Ab3) | Owner: `address(0)` · module: Governor · target: DelayOwnerSafe · guard: SetTxNonceGuard | | PauseGuard | [0x3A70244c0fEc95B5Dd238dfa60DAbDB60a99f618](https://etherscan.io/address/0x3A70244c0fEc95B5Dd238dfa60DAbDB60a99f618#code) | Guard on the Delay Modifier | | ConfigLockGuard | [0xeda83f6d7A8A56D4AA5433Bf7cC1fef496036d53](https://etherscan.io/address/0xeda83f6d7A8A56D4AA5433Bf7cC1fef496036d53#code) | Guard on the OwnerlessSafe, DevOps-Proposer Safe and DelayOwnerSafe | | SetTxNonceGuard | [0x7aE03372ECDcEe335CdEfB7d354d507F0506616C](https://etherscan.io/address/0x7aE03372ECDcEe335CdEfB7d354d507F0506616C#code) | Guard on the Roles Modifier | | TERM Governor | [0x2B715634134220ffeEE9458b4e34E41A41418607](https://etherscan.io/address/0x2B715634134220ffeEE9458b4e34E41A41418607#code) | See the Governor settings above | | TERM token | [0xC3d21f79C3120A4fFda7A535f8005a7c297799bF](https://etherscan.io/address/0xC3d21f79C3120A4fFda7A535f8005a7c297799bF#code) | Governor voting token |