Governance

The hBTC protocol employs a role-based governance model with clearly scoped permissions to separate strategic control, operational execution, and risk oversight.

Roles

Owner

The Owner is the highest authority within the protocol and is responsible for assigning and managing all other roles. The Owner has the ability to modify critical protocol settings, subject to timelock constraints as well as day-to-day protocol configuration without timelock.

The Owner role is secured by a 3-of-6 multi-signature wallet.

Guardian

A Guardian role provides emergency risk controls, enabling protective actions such as pausing protocol functionality.

Operator

Operators are specialized operational roles who execute predefined functions within strict boundaries.

• Trader: Executes strategy-related transactions (e.g., borrow, stake, swap)

• Manager: Manages funding of withdrawal claims

• Rewarder: Performs reward logging accounting updates

• Fee Setter: Can set custom exit fee

All role changes are timelocked.

Active Roles

Owner: SM1QXYXZG78DCWJZJKY0901KTK3350071W9YYRPMT (3/6 multi-sig)

Guardian: SM1QXYXZG78DCWJZJKY0901KTK3350071W9YYRPMT (3/6 multi-sig)

Trader: SP20V8SG811G6CT2QMZQNX6XCN20YAX36DYD1BAE0

Rewarder: SP20V8SG811G6CT2QMZQNX6XCN20YAX36DYD1BAE0

Manager: SP20V8SG811G6CT2QMZQNX6XCN20YAX36DYD1BAE0

Fee Setter: None

Settings

Protocol

Defines the set of core protocol smart contracts with the ability to invoke internal contracts, move assets within the system, and execute approved external contract calls.

Assets

Specifies the assets that protocol smart contracts are authorized to custody, transfer, and deploy as part of strategy execution.

Externals

Defines the external smart contracts that the system is permitted to interact with, including money markets, yield protocols, and swap interfaces.

All security-sensitive setting updates are timelocked.

Active Settings

Protocol

• See Smart Contracts

Assets

• sBTC

• USDh

• sUSDh

Externals

• Zest Protocol

  • market-v0-3

  • sBTC vault-v0-1

  • USDh vault-v0-1

• Hermetica USDh Protocol

  • staking-v1-1

  • staking-silo-v1-1

  • minting-auto-v1-2

Timelock

All critical protocol changes—including role assignments and security-sensitive parameter updates—are subject to a governance timelock.

The current timelock period is 24 hours.

Emergency Control

In case of a owner compromise (worst case scenario) the emergency mechanism freezes the protocol and allows for the safe withdrawal of assets.