Governance
Comptroller
The Sablier Protocol uses a Comptroller smart contract architecture for governance. The Comptroller acts as an intermediary that has exclusive access to specific protocol functions. This design provides a more flexible and centralized accross all protocols access control model while maintaining security.
Lockup
Comptroller has the following permissions on each chain where Lockup is deployed:
| Permission | Function |
|---|---|
| Allow to Hook | allowToHook |
| Recover | recover |
| Set Native Token | setNativeToken |
| Set NFT Descriptor | setNFTDescriptor |
TODO: Add links when reference pages are created
MerkleFactory
Comptroller has the following permission on each chain where the factories are deployed:
| Permission | Function |
|---|---|
| Set Native Token | setNativeToken |
TODO: Add links when reference pages are created
Flow
Comptroller has the following permissions on each chain where Flow is deployed:
| Permission | Function |
|---|---|
| Recover | recover |
| Set Native Token | setNativeToken |
| Set NFT Descriptor | setNFTDescriptor |
TODO: Add links when reference pages are created
Admin Addresses
Before the introduction of the Comptroller architecture, we used a direct "Admin" role for governance. These admin accounts had the same authority as the current Comptroller contract, with direct access to specific protocol functions. More concretely, the Admin is a collection of multisig wallets and EOAs currently in control of Sablier Labs.
PR NOTE: I didn't add functions for the previous versions, since we won't have contract references for them.
Trustlessness
Despite having an admin, the Sablier Protocol remains trustless. Here's why:
- The protocol is permissionless, i.e. it can be freely accessed by anyone with an Internet connection.
- The protocol is persistent, i.e. the admin cannot pause it.
- The streaming logic is non-upgradeable, i.e. the admin cannot tamper with the streams created by users.
- There are no escape hatches that allow the admin to claim user funds.
- There is a hard-coded upper limit of 10% to the fees that the admin can charge.
Timelocks
The parameter changes that can be effected are NOT subject to a timelock. This means that the admin can execute any of the functions listed above at any time.
Governance
As a startup, Sablier has to deal with uncertainty regarding:
- Protocol-market fit
- Smart contract security
Attaining success in these areas is no easy feat, and as such, decentralizing the protocol's governance will not be an initial priority.
Nonetheless, we believe that progressive decentralization is the most effective approach to scaling a smart contract protocol. As the protocol matures, we will decentralize its governance incrementally.