> For the complete documentation index, see [llms.txt](https://docs.vena.finance/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vena.finance/safety/risk-framework.md). # Risk framework Vena's risk model is layered. No single control is the backstop — a compromise of any one layer is meant to be caught by the others. Residual risk remains; this page describes both the layers and what's left uncovered. ## Layers of defence * **Curator review.** [SharpByte](https://www.sharpbyte.xyz/) proposes and monitors every listed market. See [Parameter reference](/asset-parameters/parameter-reference.md). * **Parameter caps.** Supply caps, borrow caps, LTV, and liquidation thresholds limit exposure per asset and across the pool. * **Oracle redundancy.** Pyth feeds with configured heartbeats and deviation thresholds; staleness fallbacks in place. See [Oracles](/safety/oracles.md). * **Audit coverage.** Sherlock and Omniscia. See [Audits](/safety/audits.md). * **Role separation and timelocks.** Risk parameters, listings, and upgrades are split across multisigs and gated by a timelock. See [Roles and admin](#roles-and-admin) below. * **Pause and freeze controls.** Privileged admin roles can pause the whole pool, pause an individual reserve, or freeze an individual reserve. See [Pause and freeze controls](#pause-and-freeze-controls) below. ## Roles and admin Vena inherits AAVE V3's ACLManager role structure. Each role is assigned to a multisig — separating curator-side risk management from protocol-team listing and upgrade authority, with a joint pause multisig that either side can exercise unilaterally. | Role | Controls | Holder | | ------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------- | | Pool Admin | All pool configuration except role grants/revokes | Vena multisig | | Emergency Admin | Pause (pool and reserve) | Joint Vena + SharpByte multisig | | Risk Admin | LTV, liquidation threshold, liquidation penalty, supply/borrow caps, reserve factor, IR strategy, freeze | SharpByte multisig | | Asset Listing Admin | `initReserves` (new asset listings) | Vena multisig | | ACL Admin | Grants and revokes every role above | Vena multisig | The Vena multisig and the joint Vena + SharpByte multisig are each **3-of-5**, with signers drawn from three parties across the Vena core team and SharpByte. ### Timelocks Every role action and every contract-implementation upgrade passes through a **24-hour timelock**, with one deliberate exception: * **Emergency Admin pause is not timelocked.** Pause is meant to be fast; introducing a delay would defeat its purpose. * **All other actions** — parameter changes, asset listings, role grants/revokes, and contract upgrades — are queued and observable on-chain for 24 hours before they execute. ## Pause and freeze controls Vena inherits AAVE V3's admin-controlled risk controls. Three distinct actions are available: * **Freeze a reserve** (Risk Admin or Pool Admin). Prevents new supply, new borrow, and rate swaps in that market. Repay, liquidation, and withdrawal remain available. Used when a market needs to be wound down safely without trapping existing users. * **Pause a reserve** (Emergency Admin or Pool Admin). Halts all activity in that market — supply, borrow, repay, rate swap, liquidation, and aToken transfers. Used in the event of an acute oracle, market, or contract-level anomaly affecting that asset. * **Pause the entire pool** (Emergency Admin only). Applies the reserve-level pause to every market simultaneously. Reserved for a protocol-wide threat. Each pause action is callable by the address holding the corresponding role. See [Roles and admin](#roles-and-admin) for who holds each. ## Residual risks No smart-contract system is risk-free. Users carry the residual risk of: * **Smart-contract risk.** Despite audits, previously unknown bugs may exist in Vena or its dependencies. * **Oracle risk.** Price feeds may be manipulated, delayed, or fail. Fallback logic reduces but does not eliminate this. * **Market risk.** Volatile collateral can fall faster than a user can react. Liquidation is mechanical; positions with a tight health factor may be closed at a loss. * **Dependency risk.** Vena relies on Fluent L2 and on Pyth. Outages, reorgs, or upgrades at those layers can affect Vena. Users supplying or borrowing on Vena accept these risks. Position sizing and active monitoring are the main user-side defences. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.vena.finance/safety/risk-framework.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.