> For the complete documentation index, see [llms.txt](https://docs.hoard.world/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hoard.world/protocol/security.md).

# Security and control

## What no key can do

Every Hoard contract uses OpenZeppelin's Ownable2Step, so ownership moves only when the new owner accepts it. Within that:

* No owner key can move user funds: not nested Hoardlings, not pledged collateral, not lender deposits, not the wall, not the Stock Vault.
* Nesting, unnesting, SPY claims, wall rebalancing, lender withdrawals, repayments and liquidations always run. Nothing pauses them.
* The seed liquidity's unlock date only moves forward, and `lockForever` is one-way.
* Team vesting cannot be accelerated; `release` pays only the beneficiary.
* The rewards reserve sits behind a six-hour timelock that administers itself.

## What the owner can do

Every owner function on every contract, from the source:

**Live controls**

* Pause **new borrows** on the lender vault. Repayments, withdrawals and liquidations keep running.
* Lower the lender cap ceiling at once; propose a raise that executes after six hours, or cancel it.
* Name and remove eligibility attestors.
* Start the launch HOARD stream to lender shares (`notifyRewards`), which pulls the HOARD from the owner.
* Spend the lender vault's reserve ledgers: the USDG reserve, which takes no interest share at launch and receives only interest routed while the pool is empty, and the HOARD reserve. Every spend reduces the balance the vault reports.
* Set the Stock Vault's SPY purchaser and keeper, and the fee source each of the Stock Vault and the wall manager accept fees from.
* Change the single address the hook exempts from the 3% fee. At launch it is the LiquidationRouter; this is the one owner power that could open a fee-free trading route, and it is the first thing to check on the deployed hook.
* On the LiquidityLock: extend the unlock date (forward only), lock forever, or withdraw once the date has passed.

**One-time wiring**, refused after first use: the Nest's vault and loan controller, the Stock Vault's nest, the wall's pool key, the lender vault's controller and liquidation router, the loan controller's liquidation router.

That is the whole list. Nothing pauses nesting, unnesting, claims, rebalancing, withdrawals, repayments or liquidations, by design: a pause that could trap collateral or block a liquidation would be a bigger risk than any it prevents.

## Price safety

* The borrow price takes the lowest of spot and two TWAPs, so borrowing power falls in the same block a price falls and rises only after a move has held.
* Liquidation eligibility uses TWAP only. A single-block crash cannot seize a position.
* A liquidation sale must fetch at least 75% of the oracle value of what it sells.
* Liquidations are sized to the breach, so thin depth is never asked to absorb a whole book at once.
* Lender rewards drip over seven days, so a deposit timed around a repayment captures only what it stays for.

## Audited foundations

DN404 and Solady for the token and mirror; OpenZeppelin for the vault (ERC4626), vesting, timelock, ownership, token movement and reentrancy guards; Compound's JumpRateModelV2 for rates. Custom code is limited to the borrow index, the hook's fee capture, the wall's positions, the oracle's gating, the Hoardling bind and liquidation routing. A professional audit and an invariant and fuzz suite precede mainnet.

## Ownership at launch

Ownership of every contract is proposed to a multisig by the transfer script and accepted from the multisig's own interface; the rewards timelock hands over its roles through its own delay. The multisig address is published on the [Addresses](/protocol/addresses.md) page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.hoard.world/protocol/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.