> For the complete documentation index, see [llms.txt](https://ovro.gitbook.io/ovro-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ovro.gitbook.io/ovro-docs/governance/multisig-and-timelock.md).

# Multisig & timelock

Who controls what, how changes are made, and how to watch for them.

OVRO has no single admin key. Control is split between a **Safe multisig** and a **48-hour timelock**, and the powers of both are limited by the contracts.

## The Safe

|           |                                                              |
| --------- | ------------------------------------------------------------ |
| Contract  | Safe v1.4.1 (the official Safe contracts on Robinhood Chain) |
| Signers   | 3 separate wallets                                           |
| Threshold | **2 of 3** signatures for every transaction                  |
| Address   | see [Contracts](/ovro-docs/security/contracts.md)            |

The owners and the threshold are public: on the Safe contract, read `getOwners()` and `getThreshold()`. The site's **● ONCHAIN** panel reads them live.

The Safe is also the **treasury**: the 5% treasury share of every round is sent there.

## What the Safe can do directly

These actions take effect immediately, because they only protect players or run once:

| Action                                 | Limits                                                                                                                                |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Pause / unpause **ticket sales**       | Draws, refunds and withdrawals keep working while paused.                                                                             |
| Cancel the live round **while paused** | Only before randomness is requested. Every ticket is refunded.                                                                        |
| Activate $OVRO (`activateToken`)       | **Once**, only during Genesis. The new rules apply from the next round, and the fee cap still applies. The role is removed after use. |

## What needs the timelock

Every other change goes through a `TimelockController` with a **48-hour minimum delay**. The Safe is its only proposer and executor.

* adding round rules for future rounds and choosing which rules the next round uses;
* changing the treasury, buyback executor or randomness provider;
* changing the randomness timeout;
* recovering ETH or tokens that are *not owed* to anyone (for example, sent to the contract by mistake);
* transferring the admin role, which additionally has its own 48-hour delay.

The timelock cannot change a round in progress, withdraw players' ETH, or raise protocol fees above 20%. Those limits are in the raffle contract code.

## How a change happens

1. The Safe owners sign a `schedule` transaction to the timelock (2 of 3 signatures).
2. The timelock emits `CallScheduled`. From this moment the exact change is public.
3. After at least 48 hours, the owners sign an `execute` transaction.
4. The change applies. Round rules only affect rounds that open afterwards.

## Watch for changes

On the timelock contract in the explorer, look at the **Logs** tab:

| Event           | Meaning                                                                                   |
| --------------- | ----------------------------------------------------------------------------------------- |
| `CallScheduled` | A change was proposed. It shows the target, the calldata and the earliest execution time. |
| `CallExecuted`  | A scheduled change was applied.                                                           |
| `Cancelled`     | A scheduled change was withdrawn.                                                         |

On the raffle contract, `ConfigAdded`, `ActiveConfigSet`, `TreasuryUpdated`, `BuybackExecutorUpdated`, `RandomnessProviderUpdated` and `TokenActivated` record every applied change.

## The deployer has no power

The wallet that deployed the contracts received no role. This is checked by the deployment script and can be verified with `hasRole` on the raffle and the timelock.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://ovro.gitbook.io/ovro-docs/governance/multisig-and-timelock.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.