Governance

What governance can and cannot do

Action	Possible under governance?
Mint psXDC to anyone	No. `mint()` is disabled in V3
Withdraw user XDC from the vault	No. There is no `ownerWithdraw` function
Upgrade `PrimeStakedXDC_V3_2`	No. Non-upgradeable, deployed with a regular constructor
Rotate operational / risk roles	Yes, via the delayed-governance path
Change loss caps (`maxLossBpsPerReport`, `maxDailyLossBps`)	Yes: schedule → wait `governanceDelay` → execute
Bypass the time-lock	No. Direct `grantRole`/`revokeRole`/`renounceRole` are disabled to prevent bypass

→ Custody Model for details on what the validator and asset layer guarantees.

Role Separation (psXDC v3 vault)

Role	Holder	Scope
`DEFAULT_ADMIN_ROLE`	Protocol multisig	Master switch; schedules and executes delayed role/risk changes
`OPERATIONS_MANAGER_ROLE`	Designated operations multisig/manager	`distributeRewards` (monthly reward distributions), scan-limit tuning, auto-propose config, masternode parameter tuning
`RISK_MANAGER_ROLE`	Designated risk operator	`reportValidatorLoss` (bounded by per-report and per-day caps)
`PROPOSER_ROLE`	Designated proposer(s)	`proposeMasternode`, `reportMasternodeResignPrincipal`
`MIGRATION_MANAGER_ROLE`	Migration manager	Opens/closes the V2→V3 migration window, tops up backing via `fundBacking` and funds the withdrawal-queue budget (`queueBackingBudget`) with plain XDC transfers

No single key can both move funds and modify roles. Role rotations themselves require delayed execution.

Delayed Governance: schedule → wait → execute

Every sensitive change in PrimeStakedXDC_V3_2 follows the same pattern:

Schedule	Execute (after `governanceDelay`)	Cancel
`setGovernanceDelay(delay_)`	`executeGovernanceDelay()`	`cancelGovernanceDelayChange()`
`setOperationsManager(account)`	`executeOperationsManager()`	`cancelOperationsManagerChange()`
`setRiskManager(account)`	`executeRiskManager()`	`cancelRiskManagerChange()`
`setMaxLossBpsPerReport(bps)`	`executeMaxLossBpsPerReport()`	`cancelMaxLossBpsPerReportChange()`
`setMaxDailyLossBps(bps)`	`executeMaxDailyLossBps()`	`cancelMaxDailyLossBpsChange()`

Ownership handoff uses the same pattern: scheduleOwnerTransfer(newOwner) → wait → executeOwnerTransfer() (or cancelOwnerTransfer()). transferOwnership and renounceOwnership are disabled so ownership can never change without the delay.

governanceDelay itself is bounded between MIN_GOVERNANCE_DELAY and MAX_GOVERNANCE_DELAY (default 1 day; min 1 minute, max 30 days).

Upgrade Policy

Component	Upgrade path
`PrimeStakedXDC_V3_2`	None. Non-upgradeable. Replacing the vault requires deploying a new contract and migrating.
`PrimeStakedXDC_V3MigrationBridge`	None. Non-upgradeable. Treasury operations are delayed and capped.

Treasury & Bridge controls

The V3 migration bridge has its own delayed-governance and rate-limit machinery:

Control	Detail
Excess treasury withdrawal	Two-step: `withdrawExcessNative(recipient, amount)` (schedule) → `executeExcessNativeWithdrawal()` (after delay). Cancel any time with `cancelExcessNativeWithdrawal()`.
Daily outflow guard	`setDailyWithdrawalCap(amount)` bounds total daily outflows.
Owner handoff	Two-step delayed transfer, same shape as the vault.

Pause / Emergency

Surface	Pause role	Effect
`PrimeStakedXDC_V3_2`	`PAUSER_ROLE` (multisig)	Halts stake/redeem flows for incident response

Pauses are immediate (no delay) so the multisig can react to incidents. Resuming requires a multisig unpause() call; no parameter changes happen during a pause beyond what the underlying role functions allow.

Decision-Making Framework

Decision Type	Process
Routine masternode propose / resign	`PROPOSER_ROLE` execution; bounded by on-chain limits
Buffer / scan-limit tuning	`OPERATIONS_MANAGER_ROLE` execution
Loss caps / role rotations	Schedule → wait `governanceDelay` → execute
Migration window open / close	`MIGRATION_MANAGER_ROLE`
Emergency pause	Multisig (immediate)
New audit / partner agreement	Team + legal review

What this means for Partners

No unilateral changes. Every sensitive change is publicly scheduled before it can take effect.
Predictable execution. governanceDelay is on-chain; partners can monitor pending changes through events without privileged access.
No admin path to user funds. The V3 vault's design (no mint, no ownerWithdraw, no upgrade) means governance literally cannot move staker XDC.
Auditability. All role grants, schedules, executions, and parameter updates emit events indexed by the public subgraph.

→ Custody Model → Architecture Overview → Risk & Compliance

On this page