Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

Pause and upgrade mechanisms

Euler deployments can use factory-level pause and upgrade controls, vault-level governors, or immutable configurations. The available response depends on the contracts and roles selected for that deployment.

The canonical upgradeable EVK factory uses a FactoryGovernor to separate pause, unpause, and upgrade authority. Other factories and vaults can use different arrangements, so verify the relevant addresses and roles onchain.

Summary of canonical vault factory pause and upgrade controls

Factory-level controls

An EVK factory can assign its upgradeAdmin to a FactoryGovernor. In that arrangement:

  • PAUSE_GUARDIAN_ROLE can install a ReadOnlyProxy around the current implementation, causing state-changing calls through affected upgradeable vault proxies to revert while views remain available.
  • UNPAUSE_ADMIN_ROLE can restore the implementation retained by the latest read-only proxy.
  • DEFAULT_ADMIN_ROLE can use adminCall to call the factory, including calls that change its implementation.

A factory action applies to upgradeable vaults that resolve their implementation through that factory. It does not apply to immutable vaults or contracts outside the factory.

Vault-level controls

EVK contracts are governance agnostic. A vault's governor can be any address: an EOA or multisig holding direct control over every governable setting, or a purpose-built governance contract with selector-specific, wildcard, timelocked, or emergency permissions. Whether any such controls are used is a choice made by each vault's curator or risk manager, not a protocol guarantee — verify the actual arrangement onchain rather than assuming one. Depending on the configuration, authorized callers may lower LTVs or caps, replace the IRM, or pause selected operations through a hook.

Vault governance and factory governance are separate. The EVault's oracle or router address and unit of account are creation-time proxy metadata. If the configured oracle is a router, its routes can be changed only through that router's own governance.

Timelocks

Some deployments route governance actions through a TimelockController; many do not, and a governor holding direct, undelayed control is a common configuration. Where a timelock is used, its proposer can queue an operation, cancellers can cancel it, and an executor can execute it after the delay. An open executor role allows any address to execute an operation once it is ready; it does not allow that address to create or modify the proposal.

Emergency and selector-specific roles can follow different timing. Review the exact role assignments and permissions rather than assuming a change is delayed at all, or that every change uses the same delay.

Monitoring and response

Monitoring responsibilities are split. Platform-level monitoring focuses on critical, implementation-level threats to the EVK contracts themselves; a confirmed threat of that kind can lead to a factory-level pause of upgradeable vaults. Monitoring of individual vaults and markets — oracle behavior, governance and role changes, liquidity, positions, and contract events — is the responsibility of each vault's curator or risk manager and of the integrators building on those vaults. Euler does not guarantee or supervise how individual vaults and markets are managed. Alerts should map to a named owner and a response available under the deployed contracts.

A response might include a factory pause for implementation-level issues, a vault-governance action by the vault's own governor, or user and integrator communication. Immutable vaults may have no governor-controlled pause or upgrade path.

For a specific deployment, verify:

  1. the factory, implementation, governor, and timelock addresses;
  2. current role membership and selector permissions;
  3. delays, proposers, cancellers, and executors;
  4. emergency actions and whether they bypass a timelock;
  5. recent events and pending operations; and
  6. the exit, repayment, and liquidation behavior available during a pause.

Read next