Governance

What governance can and cannot do on the psXDC vault: role separation, schedule → wait → execute delayed governance, the non-upgradeable vault, pause controls and the decision-making framework.

Governance on StakeXDC is deliberately narrow. The vault is non-upgradeable and has no admin path to user funds; what remains under governance is a small set of operational roles and risk parameters, every change to which is publicly scheduled and delayed before it can take effect.

What governance can and cannot do

Action	Possible under governance?
Mint psXDC to anyone	No. `mint()` is disabled
Withdraw user XDC from the vault	No. There is no `ownerWithdraw` function
Upgrade `PrimeStakedXDC_V3_2`	No. Non-upgradeable, deployed with a regular constructor
Rotate operational / risk roles	Yes, via the delayed-governance path
Change loss caps (`maxLossBpsPerReport`, `maxDailyLossBps`)	Yes: schedule → wait `governanceDelay` → execute
Bypass the time-lock	No. Direct `grantRole`/`revokeRole`/`renounceRole` are disabled to prevent bypass

→ Custody Model for details on what the validator and asset layer guarantees.

Role Separation (psXDC vault)

Role	Holder	Scope
`DEFAULT_ADMIN_ROLE`	Protocol multisig	Master switch; schedules and executes delayed role/risk changes; pause / unpause
`OPERATIONS_MANAGER_ROLE`	Designated operations multisig/manager	`distributeRewards` (monthly reward distributions), scan-limit tuning, auto-propose config, masternode parameter tuning
`RISK_MANAGER_ROLE`	Designated risk operator	`reportValidatorLoss` (bounded by per-report and per-day caps)
`PROPOSER_ROLE`	Designated proposer(s)	`proposeMasternode`, `reportMasternodeResignPrincipal`
`MIGRATION_MANAGER_ROLE` (legacy role name)	Operations funding wallet	Tops up the backing lane via `fundBacking` and funds the withdrawal-queue budget (`queueBackingBudget`) with plain XDC transfers

No single key can both move funds and modify roles. Role rotations themselves require delayed execution.

Delayed Governance: schedule → wait → execute

Every sensitive change in PrimeStakedXDC_V3_2 follows the same pattern:

Schedule	Execute (after `governanceDelay`)	Cancel
`setGovernanceDelay(delay_)`	`executeGovernanceDelay()`	`cancelGovernanceDelayChange()`
`setOperationsManager(account)`	`executeOperationsManager()`	`cancelOperationsManagerChange()`
`setRiskManager(account)`	`executeRiskManager()`	`cancelRiskManagerChange()`
`setMaxLossBpsPerReport(bps)`	`executeMaxLossBpsPerReport()`	`cancelMaxLossBpsPerReportChange()`
`setMaxDailyLossBps(bps)`	`executeMaxDailyLossBps()`	`cancelMaxDailyLossBpsChange()`

Ownership handoff uses the same pattern: scheduleOwnerTransfer(newOwner) → wait → executeOwnerTransfer() (or cancelOwnerTransfer()). transferOwnership and renounceOwnership are disabled so ownership can never change without the delay.

governanceDelay itself is bounded between MIN_GOVERNANCE_DELAY and MAX_GOVERNANCE_DELAY (default 1 day; min 1 minute, max 30 days).

Upgrade Policy

Component	Upgrade path
`PrimeStakedXDC_V3_2`	None. Non-upgradeable. Replacing the vault requires deploying a new contract and mirroring balances onto it (as the V3.1 → V3.2 snapshot airdrop did).

Pause / Emergency

Surface	Pause role	Effect
`PrimeStakedXDC_V3_2`	Admin (`DEFAULT_ADMIN_ROLE`, protocol multisig)	Halts stake/redeem flows for incident response

Pauses are immediate (no delay) so the multisig can react to incidents. Resuming requires a multisig unpause() call; no parameter changes happen during a pause beyond what the underlying role functions allow.

Decision-Making Framework

Decision Type	Process
Routine masternode propose / resign	`PROPOSER_ROLE` execution; bounded by on-chain limits
Reward distributions / scan-limit tuning	`OPERATIONS_MANAGER_ROLE` execution
Loss caps / role rotations	Schedule → wait `governanceDelay` → execute
Queue budget and backing funding	`MIGRATION_MANAGER_ROLE` wallet (legacy name); plain transfers, never NAV
Emergency pause	Multisig (immediate)
New audit / partner agreement	Team + legal review

What this means for Partners

No unilateral changes. Every sensitive change is publicly scheduled before it can take effect.
Predictable execution. governanceDelay is on-chain; partners can monitor pending changes through events without privileged access.
No admin path to user funds. The vault's design (no mint, no ownerWithdraw, no upgrade) means governance literally cannot move staker XDC.
Auditability. All role grants, schedules, executions, and parameter updates emit events indexed by the public subgraph.

→ Custody Model → Architecture Overview → Risk & Compliance