> For the complete documentation index, see [llms.txt](https://etherfi.gitbook.io/etherfi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://etherfi.gitbook.io/etherfi/security/security-and-risks/multisigs-and-controls.md).

# MultiSigs & Controls

This page is the single source of truth for who controls [ether.fi](http://ether.fi/), with what threshold, and after what delay. Every privileged power is listed with what it can do, what it explicitly cannot do, and a link to verify it onchain. The goal: minimize what any one party, including [ether.fi](http://ether.fi/), can do unilaterally, and make the rest checkable rather than asserted.

The most important boundary, true of every entity below: no key or multisig can move, redirect, or seize user funds. Privileged powers are limited to upgrading code (slowly, behind a public delay), changing parameters, and pausing. They can stop the protocol; they cannot take from it.

### Controls at a glance

<table><thead><tr><th width="142.28125">Control</th><th width="153.5399169921875">Threshold</th><th>Speed</th><th>CAN</th><th>CANNOT</th></tr></thead><tbody><tr><td><strong>Upgrade Admin</strong><br>(<a href="https://etherscan.io/address/0xcdd57D11476c22d265722F68390b036f3DA48c21">Safe</a>,<br><a href="https://etherscan.io/address/0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761">Timelock</a>)</td><td>6-of-10<br>(3 internal,<br>7 external)</td><td>10-day timelock on everything</td><td>Upgrade any contract; grant/revoke roles; change oracle committee and quorum; change its own delay</td><td>Act instantly (every action waits 10 days, visible onchain); move or seize user funds; get a faster path than depositors</td></tr><tr><td><strong>Operating Admin</strong><br>(<a href="https://etherscan.io/address/0x2aCA71020De61bb532008049e1Bd41E451aE8AdC">Safe</a>,<br><a href="https://etherscan.io/address/0xcD425f44758a08BaAB3C4908f3e3dE5776e45d7a">Timelock</a>)</td><td>4-of-7<br>(6 internal,<br>1 external)</td><td>Instant pause; 2-day timelock for parameters</td><td>Pause/unpause; adjust rate-limit and redemption parameters; pause crosschain bridges and set bridge peers; confirm, extend, or lift blacklists; instantly revoke a compromised operations or guardian key via the <a href="https://etherscan.io/address/0x4A84BA0b5e716b37C78D0F5094757205626C7C1e">RevokeAdmin</a></td><td>Upgrade contracts; change oracle membership or quorum; move or seize user funds</td></tr><tr><td><strong>Oracle committee</strong><br>(<a href="https://etherscan.io/address/0x57AaF0004C716388B21795431CD7D5f9D3Bb6a41">EtherFiOracle</a>)</td><td>2-of-3<br>(to be expanded to 3-of-5 by end July 2026)</td><td>Per report, onchain</td><td>Submit the rebase report that updates weETH's exchange rate, by quorum</td><td>Move share value beyond the onchain 5% APR cap; add or remove its own members</td></tr><tr><td><strong>Monitoring / pauser</strong><br>(<a href="https://etherscan.io/address/0x9af1298993dc1f397973c62a5d47a284cf76844d">key</a>)</td><td>1 automated key</td><td>Instant</td><td>Pause core contracts the moment an attack is detected (pauses are time-bounded and auto-expire); blacklist an actively-exploiting address with an automatic 3-day expiry</td><td>Unpause; upgrade; move funds; change any parameter; make a blacklist permanent. Pause-only by design</td></tr><tr><td><strong>Operations keys</strong><br>(automation)</td><td>bounded roles, no multisig</td><td>Instant</td><td>Execute oracle reports that already reached consensus; trigger rate-limited validator exits; queue/complete EigenLayer withdrawals (ETH returns to the protocol)</td><td>Move or seize user funds; mint unbacked weETH; upgrade; bypass oracle consensus or the APR cap. All holders queryable on the <a href="https://etherscan.io/address/0x62247D29B4B9BECf4BB73E0c722cf6445cfC7cE9">RoleRegistry</a></td></tr></tbody></table>

You can find the detailed Trust Matrix [here](/etherfi/security/security-and-risks/multisigs-and-controls/trust-matrix.md).

### How the separation works

Two multisig wallets divide authority so no single signer set can both rewrite the contracts and run them.

The **Upgrade Admin** (6-of-10) controls the most powerful actions, all routed through a **10-day timelock**. That window is a public review period: proposed code is visible onchain for 10 days before it can take effect, and any depositor who disagrees can exit first. The Upgrade Admin gets no faster path than anyone else.

The **Operating Admin** (4-of-7) runs the protocol day to day. Its emergency pause is immediate and bypasses the timelock, because stopping an attack cannot wait. Its reach is narrow: pause and adjust parameters, but it cannot upgrade code, change the oracle, or touch user balances. Non-emergency parameter changes sit behind a 2-day timelock.

The two timelocks own the contracts: the Upgrade Timelock ([10 days](https://etherscan.io/address/0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761)) owns the upgradeable proxies and the RoleRegistry; the Operating Timelock ([2 days](https://etherscan.io/address/0xcD425f44758a08BaAB3C4908f3e3dE5776e45d7a)) holds the slower operating roles.

### The exchange rate is bounded twice

weETH's value updates through oracle rebases. Two onchain bounds constrain every rebase: a report requires 2-of-3 oracle consensus (moving to 5 independent members by end July 2026), and it then passes an onchain 5% APR cap, with any over-cap report auto-rejected by the [EtherFiAdmin contract](https://etherscan.io/address/0x0EF8fa4760Db8f5Cd4d993f3e3416f30f942D705). Even a fully fraudulent quorum cannot move share value by more than a small bounded amount per report (e.g., 1.37 bps per day)

### Crosschain controls

weETH bridges follow the same separation: per-chain pause and rate-limit levers with the Operating Admin and per-chain controller Safes; verification-path changes through the Upgrade Admin and its timelock. Every active lane requires a full 4-of-4 quorum of four independent DVNs (Canary, Horizen, Nethermind, LayerZero Labs) with no single-verifier fallback, and mint authority on every chain is held by Safe-governed contracts, never an EOA.

### Verify it yourself

Nothing here needs to be taken on trust. For any address above: open it on Etherscan and use **Read as Proxy** for the live owner/implementation/admin; for a multisig, **`getOwners()`** and **`getThreshold()`** return the signer set and M-of-N; for a timelock, **`getMinDelay()`** returns the delay in seconds (864000 = 10 days, 172800 = 2 days); every role holder is queryable on the RoleRegistry via **`hasRole(role, address)`**.

### What the July 2026 security upgrade changed

The controls hardening previously listed here as roadmap is now live: the 10-day Upgrade Timelock batch executed onchain on **2026-07-14**. The upgrade was audited by Certora, including formal verification of the new role system and the pool's exchange-rate and solvency invariants (see [Audits](/etherfi/security/security-and-risks/audits.md)).

<table><thead><tr><th width="268.396728515625">Live since July 2026</th><th>What it adds</th></tr></thead><tbody><tr><td><strong>Consolidated</strong> <a href="https://etherscan.io/address/0x62247D29B4B9BECf4BB73E0c722cf6445cfC7cE9"><strong>RoleRegistry</strong></a></td><td>A single tiered role system (upgrade-timelock-gated admin, scoped operations roles) so every privileged role is granted, revoked, and audited in one place. Roughly 30 per-contract roles were replaced by 9 tiered roles; the registry itself is owned by the 10-day Upgrade Timelock</td></tr><tr><td><a href="https://etherscan.io/address/0x5585996E7cFE95f2D99e61168B8b35C66Ff99B18"><strong>Blacklister</strong></a></td><td>Targeted isolation of an actively-exploiting address without halting the protocol for others. Monitoring can blacklist with an automatic 3-day expiry; the Operating Admin confirms/extends/makes permanent; the contract is upgrade-timelock-gated. For active-attack interception, not screening</td></tr><tr><td><a href="https://etherscan.io/address/0x4A84BA0b5e716b37C78D0F5094757205626C7C1e"><strong>RevokeAdmin</strong></a></td><td>A fast path for the Operating Admin to revoke a compromised operations or guardian key, closing the gap between detecting a compromised key and removing it. It structurally cannot revoke the timelock or multisig roles themselves</td></tr><tr><td><strong>Time-bounded pauses</strong></td><td>Emergency pauses by the monitoring key now auto-expire (bounded between 8 hours and 30 days), and the key must cool down before pausing the same contract again. Only the Operating Admin can pause indefinitely or lift a pause early</td></tr><tr><td><strong>Bounded withdrawal finalization</strong></td><td>Withdrawal finalization is capped per day by an onchain limit, and once a request is finalized its payout rate is locked in: later rebases cannot change what it pays out</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://etherfi.gitbook.io/etherfi/security/security-and-risks/multisigs-and-controls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.