> For the complete documentation index, see [llms.txt](https://ipusd.gitbook.io/ipusd-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ipusd.gitbook.io/ipusd-docs/vault-and-protocol/transparency-and-protocol-controls.md). # Transparency and Protocol Controls IP Vault is designed so that material protected protocol changes are visible onchain before they take effect. On Soneium mainnet, standard protected administrative operations are published onchain and remain pending for 10 minutes before execution. Handoff operations use a separate 24-hour delay. This gives users a public window to inspect the scheduled action, its parameters, and its expected execution time. The Transparency page turns those onchain operations and material Vault changes into user-readable events. Emergency controls are the exception to the normal notice period. Actions such as an emergency pause or immediate disablement of Instant Withdrawal can be used without waiting for the standard Timelock when the protocol requires immediate protection. ### What the page shows
The main sections are: * **Current Round:** Round ID, Settlement Capacity, settled amount, Remaining Settlement Capacity, Standard Withdrawal Capacity, and Round End Time * **Latest NAV:** NAV per share, Total Vault Value, Total IP Vault Shares, ipUSD Held, and the relevant update time * **NAV breakdown:** registered RWAs, the ipUSD liquidity buffer, Assets in settlement, and the current composition of the Vault * **Published events:** material Round, Capacity, RWA, valuation, and protocol-management events * **Protocol roles and controls:** multisig configuration, signer threshold, Timelock, FIFO, and other high-level controls ### Published event status Public event tags may include: * Pending * Executed * Reconciled * Cancelled Pending is shown while a scheduled operation remains within its applicable onchain delay: 10 minutes for standard protected operations and 24 hours for handoff operations. After the delay has elapsed, an unexecuted proposal does not use a separate Executable tag. The event remains visible without a status tag until it is executed or cancelled. ### Round and Settlement events The public timeline can include: * New round proposed * Round opened * Settlement capacity update proposed * Settlement capacity updated * Standard withdrawal capacity update proposed * Standard withdrawal capacity updated * Instant withdrawal limit update proposed * Instant withdrawal limit updated * Subscriptions settled * Standard withdrawals settled * Round closed ### RWA events The public timeline can also include: * RWA purchase proposed * RWA purchase funds sent * RWA purchase reconciled * RWA purchase refund received * RWA purchase shortfall recorded * RWA redemption proposed * RWA redemption initiated * RWA redemption reconciled * RWA registration proposed * New RWA registered * Valuation source update proposed * Valuation source updated * RWA valuation updated The contracts do not emit a separate NAV publication event. Latest NAV can be displayed with its relevant valuation time without implying that NAV requires separate administrator approval. Individual users’ Subscribe, Cancel, Claim, Instant Withdrawal, and Standard Withdrawal actions appear in the connected wallet’s Activity. They are not included in the public protocol event timeline. ### Protocol roles The contracts define three core administrative roles. | Role | High-level responsibility | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------- | | Governance / Admin | Manages RWA registration, valuation sources, RWA extractions, core configuration, addresses, roles, and upgrades | | Operator | Manages Rounds, Settlement Capacity, Standard Withdrawal Capacity, Instant Withdrawal parameters, and settlement reconciliation | | Guardian | Applies emergency pauses, disables Instant Withdrawal, and cancels pending Timelock operations | Governance initiates RWA purchases and redemptions. Reconciliation is scheduled through the applicable Timelock-controlled process. The contracts do not define a separate Valuation Reviewer role. ### Protocol safeguards * **Audited by PeckShield** ipUSD and IP Vault smart contracts have been audited by PeckShield. * **Onchain timelock** Scheduled administrative actions are published onchain and delayed before execution, allowing time for public review. Pending operations can be cancelled through the applicable protocol controls. * **Separated roles** Governance manages configuration and upgrades; the Operator manages rounds and settlements. The Guardian can trigger emergency pauses and cancel pending Timelock operations, but cannot move funds, upgrade contracts, or unpause the protocol. * **Contract-enforced FIFO** Subscriptions and Standard Withdrawals follow strict queue order. No administrator, signer, or operator can reorder requests or prioritize specific wallets.