Skip to main content
Every Cargo vault is administered through a Safe multisig behind a timelock, so changes are visible before they take effect.

​
Ownership

  • Administration: a Safe multisig. The v4 design specifies a 3-of-5 Safe (issuer director, second director, operations, independent director, security agent), with a guard that requires the independent director or the security agent to sign every transfer out.
  • Custody: holders keep shares in their own wallets. The Safe administers contracts; it does not hold client assets.
  • Addresses: published on the Contract Addresses page only.

​
Notice and Timelock

​
How a Change Is Rolled Out

1

Propose

The change is prepared and signed by the Safe owners.
2

Queue

It waits in the timelock and can be cancelled before it executes.
3

Execute

After the delay, it executes and the change is announced.

​
Pauses

A pause guardian can suspend a batch, creations and redemptions, or minting when the NAV oracle fails, a lot shows a collateral-manager discrepancy above 0.5%, a sanctions screen hits or the chain has an incident. Minting also stops if a collateral-manager report is stale. A pause stops new activity; it does not move holders’ shares.