Admin Operations

Protocol administration via direct keypair or Squads multisig.

Direct Admin (Devnet)

On devnet, admin operations use a single keypair:

# Pause protocol
npx tsx scripts/fee-admin.ts status

# Set verify fee
npx tsx scripts/fee-admin.ts set-fee 5000000

# Withdraw fees
npx tsx scripts/fee-admin.ts withdraw-all

# Revenue simulation
npx tsx scripts/fee-admin.ts simulate 5000

Squads Multisig (Mainnet)

On mainnet, all admin operations go through a Squads multisig with threshold approval and time lock.

Setup

# Create multisig and transfer admin
npx tsx scripts/setup-multisig.ts
# Saves multisig-info.json with PDA addresses

Safety requirements enforced before execution:

Threshold ≥ 2 approvals
Members ≥ 2 signers
Time lock ≥ 3600 seconds (1 hour)

Proposal Flow

Propose — Any member creates a proposal
Approve — Members approve until threshold is met
Execute — After time lock passes, anyone can execute

Available Commands

Command	Description
`propose-pause`	Propose pausing the protocol
`propose-unpause`	Propose unpausing
`propose-update-config <lamports>`	Propose updating min_balance
`propose-transfer-admin <pubkey>`	Propose admin transfer
`propose-update-fee <lamports>`	Propose updating verify fee
`propose-withdraw-fees <lamports>`	Propose fee withdrawal
`approve <index>`	Approve a proposal
`execute <index>`	Execute after time lock
`status [index]`	Show multisig or proposal status

Example: Update Fee via Multisig

# Member 1: propose
npx tsx scripts/squads-admin.ts propose-update-fee 5000000
# Output: Proposal #3 awaiting 2 approvals. Time lock: 3600s

# Member 2: approve
KEYPAIR_PATH=~/.config/solana/member2.json \
  npx tsx scripts/squads-admin.ts approve 3

# After 1 hour time lock: execute
npx tsx scripts/squads-admin.ts execute 3

Emergency Pause

In case of a security incident:

# Direct (devnet)
# Use SDK: createPauseProtocolInstruction(admin)

# Multisig (mainnet)
npx tsx scripts/squads-admin.ts propose-pause
# All members approve immediately
npx tsx scripts/squads-admin.ts approve N
npx tsx scripts/squads-admin.ts execute N

Pause effects: Blocks commit_intent and verify_intent. revoke_intent always works so users can recover rent.

Config Migration

When the GuardConfig schema changes (e.g., adding fee fields), use migrate_config to realloc the PDA:

# Migrates from OLD_SPACE (66) to new SPACE (82)
# Preserves all existing data, initializes new fields to defaults
# Safe to run multiple times (idempotent)