Operator surface — separate authority from every user flow

Governance

Two authorities, two separate secrets, so one cannot be replayed into the other. Neither can reach a position that already exists: rates are snapshotted at creation, and collateral release reads no colour at all.

Markets

each with its own secrets

Treasury entries

one per repaid loan, never merged

Accrued fees

—

Authority renounced

0 of 2

Market

Each deployment carries its own parameter and treasury secrets, keyed by instance.

Fee parameters

Bounded in code, not in policy. The ceilings were sealed at deployment and cannot be raised.

Protocol fee, as a share of interestceiling 10000 bps (100%)

1000 bps (10%) of 10000

Late fee, as a share of principalceiling 10000 bps (100%)

200 bps (2%) of 10000

Both rates are copied onto every offer at creation and every loan at borrow, so an update touches nothing that already exists. That snapshot is load-bearing rather than tidiness: without it, raising the late fee to an unpayable value would convert every live loan's collateral into a gift to its lender.

Changing either rate invalidates every createOffer in flight. Those transactions fail with a legible "protocol parameters changed, retry" rather than landing against a value the caller did not expect.

Collateral allow-list

Which assets this market will accept against its principal. Policy, not identity — the principal asset itself stays sealed forever.

0
sNIGHT
1 active loanenabled
1
sSOUTH
enabled
2Empty — holds thirty-two zero bytesfree
3Empty — holds thirty-two zero bytesfree
4Empty — holds thirty-two zero bytesfree
5Empty — holds thirty-two zero bytesfree
6Empty — holds thirty-two zero bytesfree
7Empty — holds thirty-two zero bytesfree

Disabling strands nothing

It blocks new offers naming the slot and nothing else. Loans already drawn settle normally, because borrow compares against the colour the offer stored at creation, and collateral release reads no colour at all. There is no state in which a governance action can trap collateral.

slot 0 · 1 live

Irreversible actions

Two different things get called 'burning authority' and only one of them is a Midnight primitive.

Maintenance authority

The platform-level capability to replace a deployed contract's circuits. Whoever holds it can rewrite seize to send collateral to themselves, and no in-contract ceiling constrains it, because it can remove the ceiling. This is the single largest trust assumption in the system and it must be burned at mainnet, publicly.

retained on testnet

Parameter authority

A secret checked by the contract's own circuits, bounded by sealed ceilings, affecting only positions created after a change. Losing it freezes parameters; it cannot destroy anyone's collateral. Renouncing zeroes the commitment irreversibly.

Treasury

Collected one entry at a time. An operator cost paid occasionally with no clock running, unlike every other circuit here.

0.1sWEST
loan 060586…395b · sWEST
Sep 16, 2026

The protocol earns nothing on a default — the fee was never collected because there was no repayment to deduct it from. A seizure fee is a deliberate omission, not an oversight.

Deployments

sWESTWest market
deployed Sep 16, 2026
sSOUTHSouth market
deployed Sep 16, 2026

Say which authority you mean

"Admin keys burned" means very different things depending on whether it refers to maintenance authority or parameter authority, and the difference is the entire security model. Publish which one.