How keys work
War Room is for SuperAdmin signers and Admins. Transaction keys never sign here.
SuperAdmin signer (5 wallets)
Constructor signers, not KeyRole.SuperAdmin. Any one of them can pause or full-stop from Overview. Changing config, unpausing, lifting, emergency withdraw, and rotating a signer needs a 3-of-5 proposal.
Admin (KeyRole.Admin)
Can pause, full-stop, revoke a TransactionKey, and add or revoke settlement tokens from the admin portal. Cannot add keys, change routers, or lift a halt. Can submit a tx that a TX key already signed. Cannot sign a 3-of-5 proposal.
Transaction key
Hot wallet. Signs and submits capture, convert, settle, bridge, bank, and payouts. Never pause, full-stop, or sign War Room proposals.
How a 3-of-5 proposal works
Most War Room actions are not a single click. Three of the five SuperAdmin signers must sign the same payload, then the last signer submits one transaction per target.
Create
Open New proposal, pick the action, fill the args. War Room saves a nonce, deadline, and the target list for contracts that implement that action (swap/bridge = Escrow only; halt/keys/fee/rotate/emergency = Escrow and Merchant Manager). Share the proposal URL.
Three SuperAdmin signers sign
Connect every SuperAdmin account in one wallet prompt (tick multiple). Switch the active account in the wallet to sign as a different signer — do not reconnect. The server recovers the EIP-712 signer and rejects anyone who is not on-chain SuperAdmin. Admins and TX keys cannot sign.
Last signer submits
After 3 distinct signatures, any connected SuperAdmin clicks Submit (3/5). That wallet sends one on-chain tx per contract that implements the action and pays gas. Swap/bridge is Escrow only. The contract checks the three signatures, then runs the action. The nonce cannot be reused.
Rules
- Pause and full stop are not proposals — they are one-wallet buttons on Overview.
- Unpause, lift, routers, fee, keys, rotate, and emergency are always 3-of-5.
- Signing is off-chain. Nothing happens on-chain until Submit.
- Submit fails if the deadline passed, the nonce was already used, a signer is not one of the five, or (for emergency execute) the 24h delay is still running.
- A full stop blocks router / fee / key submits even if you already collected 3 signatures. Lift first, then submit those. Rotate SuperAdmin still works while halted.
Immediate halt
One connected Admin or SuperAdmin signer. Overview buttons send pause or fullStop on every registered Escrow and Merchant Manager. These are not 3-of-5.
Pause
Who can call
Any Admin or any one SuperAdmin signer. One wallet, one tx per contract. Overview sends it on every registered Escrow and Merchant Manager.
When
Use when you need a fast freeze but expect to resume soon. Does not start the emergency-withdraw clock.
What happens
Turns pause on. Every payment and payout call listed below reverts. Config writes still work.
What stops
- New captures: native ETH, ERC-20, and capture-and-convert
- Same-chain settle (settlePayment)
- Disputes: open and resolve
- Refunds back to the payer
- Cross-chain settle, retry, dest credit, and stuck dest credit
- Bank settlement and merchant-balance withdraw
- Merchant Manager: ETH deposit and withdraw
- Merchant Manager: single and bulk token / ETH payouts
What still works
- Money already captured stays in escrow — nothing is swept
- 3-of-5 proposals: unpause, routers, fee, keys, rotate
- Admin can still add or revoke settlement tokens
- Admin can still revoke a TransactionKey
- Emergency withdraw is not available — that needs a full stop first
How to reverse
Create an Unpause 3-of-5 proposal. Three signers sign, last signer submits.
Full stop
Who can call
Any Admin or any one SuperAdmin signer. One wallet, one tx per contract. Overview sends it on every registered Escrow and Merchant Manager.
When
Use for a serious incident. Required before emergency withdraw. Stronger than pause because it also locks config.
What happens
Turns full stop on. Payment and payout calls revert. Router, token, key-add, fee, and rotate writes also revert.
What stops
- Everything pause stops (captures, settle, refund, dispute, bridge, bank, payouts, MM deposits)
- Swap router allow / revoke
- Bridge router allow / revoke
- Settlement token allow / revoke (Admin portal included)
- Adding or changing Admin / TransactionKey via 3-of-5
- Fee recipient change
What still works
- Admin can still revoke a TransactionKey
- 3-of-5 unpause — only clears the pause flag; money movement stays blocked until lift
- 3-of-5 lift full stop (also cancels a pending emergency withdraw)
- 3-of-5 rotate SuperAdmin signer (replace a compromised key while halted)
- 3-of-5 initiate / execute / cancel emergency withdraw
How to reverse
Create a Lift full stop 3-of-5 proposal. Lift also cancels a pending emergency withdraw.
3-of-5 actions
Create a proposal, share the URL, collect three signatures, then the last signer submits. Each action below is what that submit tx does.
Unpause
Who can call
3 of 5 SuperAdmin signers. Last signer submits and pays gas on each target.
When
After a pause, when it is safe to take payments and payouts again.
What happens
Turns pause off. If the contract is also full-stopped, money movement stays blocked until you lift.
What starts again
- New captures: native ETH, ERC-20, and capture-and-convert
- Same-chain settle (settlePayment)
- Disputes: open and resolve
- Refunds back to the payer
- Cross-chain settle, retry, dest credit, and stuck dest credit
- Bank settlement and merchant-balance withdraw
- Merchant Manager: ETH deposit and withdraw
- Merchant Manager: single and bulk token / ETH payouts
What still works
- If full-stopped, these still revert until Lift full stop
- Does not start or cancel emergency withdraw
How to reverse
Pause again from Overview (one Admin or signer).
Lift full stop
Who can call
3 of 5 SuperAdmin signers.
When
After a full stop, when the incident is closed.
What happens
Clears full stop. Cancels any pending emergency withdraw (destination, token list, 24h timer).
What starts again
- Payment and payout paths resume if the contract is not also paused
- Router, settlement token, key, fee, and rotate writes work again
What still works
- If paused is still on, captures / settle / payouts stay blocked until Unpause
How to reverse
Full stop again from Overview.
Set swap router
Who can call
3 of 5 SuperAdmin signers. Blocked while full-stopped.
When
After deploy, or when 1inch / swap router addresses change on that chain.
What happens
Allow or revoke a router used by capture-and-convert. Day-0 list is set in the ops UI Deploy card constructor.
How to reverse
Same action with allowed = false.
Set bridge router
Who can call
3 of 5 SuperAdmin signers. Blocked while full-stopped.
When
After deploy, or when LI.FI / bridge router addresses change on that chain.
What happens
Allow or revoke a router used by settle / retry bridge. Per-chain — not a shared .env list.
How to reverse
Same action with allowed = false.
Set fee recipient
Who can call
3 of 5 SuperAdmin signers. Blocked while full-stopped.
When
Treasury or leftover-fee address must change.
What happens
Updates where platform fees and dest leftover are sent on that contract.
How to reverse
Propose a new address.
Set key role
Who can call
3 of 5 SuperAdmin signers to add Admin or TX keys (blocked while full-stopped). Admin alone may revoke a TX key (role None), including during full stop.
When
Rotate a hot wallet, add an Admin, or disable a leaked TX key.
What happens
Assigns None, TransactionKey, or Admin. Cannot assign SuperAdmin. Cannot change a SuperAdmin signer slot (use rotate).
How to reverse
Revoke with role None (Admin can do that for TX keys without a proposal).
Rotate SuperAdmin signer
Who can call
3 of 5 SuperAdmin signers. Allowed during full stop so a compromised signer can be replaced while halted.
When
Replace one of the five signer wallets (lost key, personnel change).
What happens
Swaps signer index 0–4 to a new address. The new address must not already be a signer.
How to reverse
Rotate that index again.
Initiate emergency withdraw
Who can call
3 of 5 SuperAdmin signers. Contract must already be full-stopped.
When
After full stop, when funds must leave the contract.
What happens
Locks destination and token list and starts a 24 hour timer. Changing to or tokens resets the timer. Native ETH is always included on execute.
How to reverse
Cancel emergency withdraw, or lift full stop (both 3-of-5).
Execute emergency withdraw
Who can call
3 of 5 SuperAdmin signers. Only after initiate + 24 hours.
When
The delay has elapsed and destination is still correct.
What happens
Sweeps entire native balance and entire ERC-20 balances of the initiated tokens to the locked destination.
How to reverse
Cannot undo after execute. Re-initiate only if you lift and stop again.
Cancel emergency withdraw
Who can call
3 of 5 SuperAdmin signers.
When
Initiate was a mistake or destination must change without lifting the halt.
What happens
Clears destination, token list, and timer. Contract stays full-stopped.
How to reverse
Initiate again (resets 24h).
Also know
Settlement tokens
Not a War Room action and not 3-of-5. An Admin wallet adds or revokes them on the hosted admin portal (/dashboard/escrow) or ops UI settings. Day-0 tokens go in the Deploy card constructor. Full stop blocks this too.
Platform signatures
Capture, settle, and payout EIP-712 must be signed by a TransactionKey. Admin and SuperAdmin signer keys cannot authorize those calls. That is separate from War Room 3-of-5 signatures.