Administration - Veilify

The admin is any caller the upgrade controller approves through canUpgrade(msg.sender, address(0)).

Setters

Function	Caller	Bounds	Event
`setGuard(address)`	Admin	non-zero	`GuardUpdated`
`setRelayer(address, bool)`	Admin	non-zero	`RelayerUpdated`
`setVerifiers(t, w, s)`	Admin	all non-zero	`VerifiersUpdated`
`setTreasury(address)`	Admin	non-zero	`TreasuryUpdated`
`setFeeConfig(depBps, wdBps, cancelCheckFee, overhead)`	Admin	bps ≤ 100, overhead ≤ 500,000	`FeeConfigUpdated`
`setTokenParams(token, min, checkFee, maxPullGas)`	Admin	-	`TokenParamsUpdated`
`setDepositLimits(token, max, cap)`	Admin	-	`DepositLimitsUpdated`
`setWhitelistManager(address)`	Admin	-	`WhitelistManagerUpdated`
`setPaused(bool)`	Gatekeeper or admin	-	`PauseUpdated`
`setWithdrawalsPaused(bool)`	Admin	-	`WithdrawalPauseUpdated`
`setUpgradeController(address)`	Upgrade controller	non-zero	`UpgradeControllerUpdated`
`sweepProtocolFees(token)`	Anyone	pays `treasury` only	`ProtocolFeesSwept`

Two pause switches

paused

Stops deposits, permit deposits, transfers and swaps. Gatekeeper or admin. Withdrawals stay open.

withdrawalsPaused

Stops withdrawals and swaps. Admin only. It exists for one case: stopping an in-progress drain.

withdrawPendingDeposit is never paused.

Upgrades

The implementation is UUPS. _authorizeUpgrade asks the upgrade controller:

IUpgradeController(upgradeController).canUpgrade(msg.sender, newImplementation)

AdminUpgradeController

function canUpgrade(address caller, address) external view returns (bool);   // caller == admin
function transferAdmin(address newAdmin) external;                              // admin only
function execute(address target, bytes calldata data) external returns (bytes memory);  // admin only

With AdminUpgradeController, the admin address calls pool setters directly, because canUpgrade(admin, …) is true. execute exists for the one call that needs the controller itself as msg.sender: setUpgradeController. To harden governance, deploy a timelock or multisig controller and switch to it through execute.

Fee accounting

Protocol fees accrue in protocolFeesAccrued[token] and are moved only by sweepProtocolFees, to treasury. A treasury the token refuses blocks only the sweep, never deposits or withdrawals.

enum FeeKind { DEPOSIT, WITHDRAWAL, CHECK, PULL_GAS }
event ProtocolFeeCharged(FeeKind indexed kind, bytes32 indexed ref, address indexed token, uint256 amount);

ref is bytes32(depositIndex) for deposit-side fees and the txNullifier for withdrawals.

​Setters

​Two pause switches