# Security and contracts

> Official addresses, administrative powers, the prior-notice gate, pausers, staged sealing and review scope.

Source: https://docs.botradix.com/security-contracts/

This page explains who can change the contracts, how changes are processed and what limits apply to leaving the DEX. See also [Exit without the website](https://docs.botradix.com/exit/), [How to read BotRadix proxies](https://docs.botradix.com/proxies/) and [Reproducible compilation](https://docs.botradix.com/reproducible-build/).

## Reference status

**Reference: 11 October 2026.** The v2.2 contracts are active; administrable components remain **OPEN**, without sealing. The router administrator is AvisoPrevio, `0x3a3273Df1c640D2625Bcc0f378Fc571D371f0dEd`. Code and operations delays and the committed minimum delay are **0 hours**. Pause-only keys are in place.

**Source publication:** joint publication on BaseScan is planned near closure, before sealing. Address links on this page do not imply that the code has already been verified.

## Funds, permissions and risks

Collateral is recorded in CrossMargin under your wallet. Under the code described here, user withdrawals require the corresponding wallet authorization and are paid to their owner; a trading or session key has no withdrawal permission. This is not an absolute custody guarantee: the addresses retaining state can stay the same while the logic enforcing those permissions is replaced.

While a component remains OPEN, its authority can change code, routes, parameters or dependencies through its upgrade mechanisms. Powers include configuring markets and reporters, pausing, declaring an emergency and withdrawing free vault liquidity subject to the checks in the code in force. A stable address or a user signature does not remove administration, software, oracle, liquidation or liquidity risk.

## The prior-notice gate

AvisoPrevio is a contract without a proxy that processes administrative calls through `execute(target, data, salt)`. Its `ADMIN()` is the coordinator authorized by BotRadix administration. Having this gate does not make that authority decentralized or a multisig.

The gate classifies each call by destination, function and, where relevant, arguments. `classify()` exposes the class; `delays()` returns the current delays and minimum floor.

| Class | Mechanism | Examples |
|---|---|---|
| `FAST` | No waiting period | Pauses, cancellations and certain revocations; arguments must meet the function's restrictions |
| `OPS` | Requires the operations delay | Parameters, market listings, vault withdrawals, administrative emergency and resumption |
| `CODE` | Requires the code delay | Logic or routing changes, pointers, price sources and destinations not otherwise classified |

With a positive delay, administration schedules the exact data with `schedule()`. The identifier binds the destination, data and salt. `execute()` checks the delay **in force at execution**, so an increase also protects pending operations. The execution window lasts 14 days from when an operation becomes ready. `operationState()` exposes its dates and status; events record scheduling, execution and cancellation. With a zero delay, execution can proceed without prior scheduling: there is no mandatory reaction period.

`raiseDelay()` only increases delays and takes effect immediately. `lowerDelay()` must go through the gate itself and wait for the longest current delay among those being reduced. `commitMinimumDelay()` raises a floor that cannot subsequently be lowered. These rules do not make every upgrade in the system pass through the gate.

### What the gate cannot hold back

Replacing the CrossMargin proxy implementation and business logic has separate authority paths tied to the coordinator. While those paths remain open, the gate alone does not enforce a waiting period on them. It also does not delay direct action by keys authorized only to pause.

`announce()` records the public `CambioAnunciado` event for a change the gate cannot hold back. **It neither executes the change nor blocks execution until a date.** An operational announcement is not a contract-enforced waiting period. Assessing protection requires checking each component's authority and lifecycle as well as the gate.

## Pausers and resumption

The mechanism supports up to eight pause-only keys. They can activate pause, reduce-only mode, a trading stop or a withdrawal pause; that permission does not allow resuming, upgrading contracts or withdrawing user funds. Resumption belongs to administration and is classified as an operation by the gate.

Under the v2.2 mechanism, a CrossMargin withdrawal pause expires after **72 hours**, requires **24 hours without a pause** before the next one and does not apply during a confirmed emergency. Its effective state and expiry can be read. Expiry does not guarantee payment: positions, orders, debts, prices and liquidity still matter. Restrictions on new positions do not replace closing and liquidation checks. While the code remains upgradeable, these rules can also change.

## Sealing in stages

A seal applies to one component and its specific permissions. Sealing the router does not automatically seal CrossMargin, the oracle hub, its reporters or automation. A `sealed` flag alone is also insufficient: check whether upgradeable module routes, authorities with notice and parameters adjustable within their limits remain.

The plan is to check and close upgrade surfaces separately, publish the source and compilation recipe, and document what becomes fixed and what remains administrable for each component. A full closure and a closure retaining changes through a notice gate have different permissions; the applied profile must be stated. Pauses, permitted parameters and external risks do not disappear when code is sealed.

**Pending prerequisite at the reference date:** before increasing notice or sealing, two governance findings from the internal review must be fixed and retested. The future seal is not presented as protection already available.

## Reviews performed and their limits

The work is an **internal review, not an external audit**. Documented work includes reading fund and permission paths, contract and invariant tests, upgrade and rollback rehearsals, exit and emergency review, and compilation and source-to-artifact checks. Each check covers its version and scenarios, not every possible state.

The final fund-path review and the text review for publication are separate activities. Reviewing comments does not add an independent security review. The pending findings above remain a prerequisite for sealing; neither tests nor explorer source verification guarantee the absence of bugs.

**Audit status at the reference date:** no external audit has been published. No security certification is claimed for these contracts.

## Official addresses

All addresses below are on **Base mainnet, chain ID 8453**. They are cross-checked against the v2.2 deployment map and public manifest for the stated reference. An inventory is a snapshot: implementations and routes can change while open. Check the full address and distinguish entry points from their implementations; do not send tokens directly to a facet or module.

### Entry points and control

| Contract or role | BaseScan address |
|---|---|
| DEX router (CoreUSDC) | [0x740E207d90ec9D82fce040F8DA0268dB761F364E](https://basescan.org/address/0x740E207d90ec9D82fce040F8DA0268dB761F364E) |
| CrossMargin (collateral proxy) | [0x79ED1002F842DE2A9E25d353F2627206483b2b3B](https://basescan.org/address/0x79ED1002F842DE2A9E25d353F2627206483b2b3B) |
| PairForge (oracle host) | [0x55Ec5A8DFEb6ab71BCAE98D833b4E1d96a6c871C](https://basescan.org/address/0x55Ec5A8DFEb6ab71BCAE98D833b4E1d96a6c871C) |
| Registry (host) | [0x9ad0298331bda8E08034027e7C2b1352f9cEB164](https://basescan.org/address/0x9ad0298331bda8E08034027e7C2b1352f9cEB164) |
| Automation (host) | [0x4b9adab771698a52460e5DeC0Ee91955436c68c2](https://basescan.org/address/0x4b9adab771698a52460e5DeC0Ee91955436c68c2) |
| Uniswap V3 adapter (host) | [0x52D9bbcE58874272E1359769e643e4327427f4dB](https://basescan.org/address/0x52D9bbcE58874272E1359769e643e4327427f4dB) |
| Account factory | [0x092A0905b357E72bacE1C2e3Fa46A45475FB9e24](https://basescan.org/address/0x092A0905b357E72bacE1C2e3Fa46A45475FB9e24) |
| Administration coordinator | [0xA7509a1581bD718DE319475A0CEB9776bc29c463](https://basescan.org/address/0xA7509a1581bD718DE319475A0CEB9776bc29c463) |
| BotradixSalida | [0x43473B3684ccB5d9d57D119f2A6bc7B9B1f5EEe5](https://basescan.org/address/0x43473B3684ccB5d9d57D119f2A6bc7B9B1f5EEe5) |
| AvisoPrevio (router administrator) | [0x3a3273Df1c640D2625Bcc0f378Fc571D371f0dEd](https://basescan.org/address/0x3a3273Df1c640D2625Bcc0f378Fc571D371f0dEd) |

### Inventory of the 57 v2.2 release components

These are the 54 components in the v2.2 map plus Salida, AvisoPrevio and its factory. Logic addresses are not deposit endpoints.

#### Exit and notice

| Contract or role | BaseScan address |
|---|---|
| BotradixSalida | [0x43473B3684ccB5d9d57D119f2A6bc7B9B1f5EEe5](https://basescan.org/address/0x43473B3684ccB5d9d57D119f2A6bc7B9B1f5EEe5) |
| BotradixAvisoPrevio | [0x3a3273Df1c640D2625Bcc0f378Fc571D371f0dEd](https://basescan.org/address/0x3a3273Df1c640D2625Bcc0f378Fc571D371f0dEd) |
| BotradixAvisoPrevioFactory | [0xD3369F63E6a8Dc60914a428c0d15d98CB9f5Ba12](https://basescan.org/address/0xD3369F63E6a8Dc60914a428c0d15d98CB9f5Ba12) |

#### Dispatch and module administration

| Contract or role | BaseScan address |
|---|---|
| BotradixDispatchKernelV2 | [0x95DC9EFbff26Acb8B9509d68dd73E712c4541093](https://basescan.org/address/0x95DC9EFbff26Acb8B9509d68dd73E712c4541093) |
| BotradixRouterModuleHub | [0x1939D6DEA5032Af296888A2b5b379121981807E5](https://basescan.org/address/0x1939D6DEA5032Af296888A2b5b379121981807E5) |
| BotradixRouterModuleAdminFacet | [0xd7Ee406f1309e422Ce215e1257799D595fA3EA02](https://basescan.org/address/0xd7Ee406f1309e422Ce215e1257799D595fA3EA02) |
| BotradixBusinessModuleAdmin | [0x75434e902a3e9538fE9Cdc9606163fCd26073177](https://basescan.org/address/0x75434e902a3e9538fE9Cdc9606163fCd26073177) |

#### Router facets

| Contract or role | BaseScan address |
|---|---|
| BotradixAdminAuthFacet | [0x281f19360d4bd6278D8b36D239319E0152c4d15a](https://basescan.org/address/0x281f19360d4bd6278D8b36D239319E0152c4d15a) |
| BotradixMarketLifecycleFacet | [0xFBe27EDAAD662eCf2315bCeEeAD626A88A8a1C3c](https://basescan.org/address/0xFBe27EDAAD662eCf2315bCeEeAD626A88A8a1C3c) |
| BotradixTradeFacet | [0x4C154d0e8EC1123db8BfA9cAf5e9170229B01d59](https://basescan.org/address/0x4C154d0e8EC1123db8BfA9cAf5e9170229B01d59) |
| BotradixPositionFacet | [0xa1D5a5B20b7ec4729d8d72B633CF6743Ed69E37b](https://basescan.org/address/0xa1D5a5B20b7ec4729d8d72B633CF6743Ed69E37b) |
| BotradixSettlementFacet | [0x69c8228f0679db9b9d1815C5f46596D3A3cD794E](https://basescan.org/address/0x69c8228f0679db9b9d1815C5f46596D3A3cD794E) |
| BotradixReadMarketFacet | [0x7CC58E07E4FF466cEB637F181118A13840b056D6](https://basescan.org/address/0x7CC58E07E4FF466cEB637F181118A13840b056D6) |
| BotradixMarketAdminFacet | [0x13aa7628E7f163Ee6B55BB9d2b185Ab9e609680E](https://basescan.org/address/0x13aa7628E7f163Ee6B55BB9d2b185Ab9e609680E) |
| BotradixAssetRiskFacet | [0x4c3528F5086af74B546Faa8F12AEc31A246aE77d](https://basescan.org/address/0x4c3528F5086af74B546Faa8F12AEc31A246aE77d) |
| BotradixDelegateAuthFacet | [0xC10072306b31d3ad13d6c517ced6E003f92a3e5f](https://basescan.org/address/0xC10072306b31d3ad13d6c517ced6E003f92a3e5f) |
| BotradixIncreaseFacet | [0x5351963473f2E1fB58853024D51494495e3E988b](https://basescan.org/address/0x5351963473f2E1fB58853024D51494495e3E988b) |
| BotradixCollateralFacet | [0xD3a6759D95Dd186B3E0a04E81F3F4c0d6fF29520](https://basescan.org/address/0xD3a6759D95Dd186B3E0a04E81F3F4c0d6fF29520) |
| BotradixSignedExitFacet | [0xcF06610b85C1274aEbc21BFA11C6086f87f996d8](https://basescan.org/address/0xcF06610b85C1274aEbc21BFA11C6086f87f996d8) |

#### DEX components

| Contract or role | BaseScan address |
|---|---|
| BotradixDexCreateEngine | [0x1eC79D9d237a4C1C52a1A031277418008DDc3Cc8](https://basescan.org/address/0x1eC79D9d237a4C1C52a1A031277418008DDc3Cc8) |
| BotradixDexIncreaseEngine | [0x19c1124d3781902b027DFa6552d5C45a4feB86D8](https://basescan.org/address/0x19c1124d3781902b027DFa6552d5C45a4feB86D8) |
| BotradixDexCloseEngine | [0x72027074498955a67c621b2D7f7f1afCcd5Dbd1E](https://basescan.org/address/0x72027074498955a67c621b2D7f7f1afCcd5Dbd1E) |
| BotradixDexOrderEngine | [0x1194767Edff4E934cdDbB559261fEdE19baEc3a2](https://basescan.org/address/0x1194767Edff4E934cdDbB559261fEdE19baEc3a2) |
| BotradixDexMarketFacet | [0xAf0c1d7b11E8D0D90A2Cb591D601b02f861E1B94](https://basescan.org/address/0xAf0c1d7b11E8D0D90A2Cb591D601b02f861E1B94) |
| BotradixDexIntegrationFacet | [0x2015603CF00329CE95EfF785Ec28d9501056C407](https://basescan.org/address/0x2015603CF00329CE95EfF785Ec28d9501056C407) |
| BotradixDexOrderFacet | [0xb18145Dde11aae097AFBe722A11df102c4C2fE47](https://basescan.org/address/0xb18145Dde11aae097AFBe722A11df102c4C2fE47) |
| BotradixDexPositionFacet | [0xC36d1735434ba694C2e9b4A1efB7A9d0c2B9F8e5](https://basescan.org/address/0xC36d1735434ba694C2e9b4A1efB7A9d0c2B9F8e5) |
| BotradixDexCanonicalFacet | [0xed8bc62D385f04a5ee9feC62F4b0B8e8AB7050AF](https://basescan.org/address/0xed8bc62D385f04a5ee9feC62F4b0B8e8AB7050AF) |
| BotradixDexVaultFacet | [0x1039f4bC44BCa16F568C25fB954B5F88389bC7e3](https://basescan.org/address/0x1039f4bC44BCa16F568C25fB954B5F88389bC7e3) |
| BotradixDexOpenEngine | [0x2Ff92928880f4ec898Be3aA71429fac326f9C490](https://basescan.org/address/0x2Ff92928880f4ec898Be3aA71429fac326f9C490) |
| BotradixDexManageEngine | [0x393a9C32b81F817987E7FE6B97Dd67582ED939f6](https://basescan.org/address/0x393a9C32b81F817987E7FE6B97Dd67582ED939f6) |
| BotradixDexInvertEngine | [0x510F52C36A8c77346A0209DbD77C1865E0a5882B](https://basescan.org/address/0x510F52C36A8c77346A0209DbD77C1865E0a5882B) |

#### Router modules and parameters

| Contract or role | BaseScan address |
|---|---|
| BotradixDexIntentFacet | [0x7Cc3c4b13AC75C02283797ACa5e8253e65CB5974](https://basescan.org/address/0x7Cc3c4b13AC75C02283797ACa5e8253e65CB5974) |
| BotradixDexAgentFacet | [0x4E73fa57C3458Cec0e09518C65A878859D939947](https://basescan.org/address/0x4E73fa57C3458Cec0e09518C65A878859D939947) |
| BotradixDexAgentEditFacet | [0xFb63b83aDb8Aa6f34E305c599dDec9De6E154776](https://basescan.org/address/0xFb63b83aDb8Aa6f34E305c599dDec9De6E154776) |
| BotradixDexRiskModule | [0xEdA449CF2F93C57D7B4D8984Fb60e28615C13615](https://basescan.org/address/0xEdA449CF2F93C57D7B4D8984Fb60e28615C13615) |
| BotradixDexAdlModule | [0xc1733C0bf5df9AEDD8B1386818A5C19A7CBbeA57](https://basescan.org/address/0xc1733C0bf5df9AEDD8B1386818A5C19A7CBbeA57) |
| BotradixDexListingModule | [0xc21Afd694cCFDB601725A596e2ba02C9bEc16A9F](https://basescan.org/address/0xc21Afd694cCFDB601725A596e2ba02C9bEc16A9F) |
| BotradixDexGuardModule | [0xF4a7a7Cac96Da442367557798214667b3a928fb4](https://basescan.org/address/0xF4a7a7Cac96Da442367557798214667b3a928fb4) |
| BotradixDexExitModule | [0x65d1f0dF2E078ba5c80bDB0091A941948160CeE4](https://basescan.org/address/0x65d1f0dF2E078ba5c80bDB0091A941948160CeE4) |
| BotradixDexEmergencyModule | [0xe35353e8864559a8833510F23E62e7E41D4f133C](https://basescan.org/address/0xe35353e8864559a8833510F23E62e7E41D4f133C) |
| BotradixDexKeeperBatchModule | [0x736372e8cbd577BbEd55860C1d82C5ab46CfA513](https://basescan.org/address/0x736372e8cbd577BbEd55860C1d82C5ab46CfA513) |
| BotradixDexParamSpec | [0xeB2EdE33468721B8116dD135b70c286a51946f3A](https://basescan.org/address/0xeB2EdE33468721B8116dD135b70c286a51946f3A) |

#### Cross margin

| Contract or role | BaseScan address |
|---|---|
| BotradixCrossMargin | [0xc1030c90C644Df556c5fe311601B55B84387f6d7](https://basescan.org/address/0xc1030c90C644Df556c5fe311601B55B84387f6d7) |
| BotradixCrossSettlementFacet | [0xcD9dE1b0f9A7Fc5afE22cF4eb781198FF99FA851](https://basescan.org/address/0xcD9dE1b0f9A7Fc5afE22cF4eb781198FF99FA851) |
| BotradixCrossAutomationFacet | [0xF18D2E033418DF345473FA696FF5c0aD1d504671](https://basescan.org/address/0xF18D2E033418DF345473FA696FF5c0aD1d504671) |
| BotradixCrossDexCollateralFacet | [0x09E04102cE4Af4567F3f6698B23E3213cb723177](https://basescan.org/address/0x09E04102cE4Af4567F3f6698B23E3213cb723177) |
| BotradixCrossDexBridgeFacet | [0x3744a1c6a8646a53404D530FF1e007d0c7af1E11](https://basescan.org/address/0x3744a1c6a8646a53404D530FF1e007d0c7af1E11) |
| BotradixCrossDexReadFacet | [0xc1d7ccfCE31873129B08426C115C2B6f5D72eB78](https://basescan.org/address/0xc1d7ccfCE31873129B08426C115C2B6f5D72eB78) |
| BotradixCrossModuleFacet | [0xA466E60cAe42E695Fb8f1Fc71d2f6816eE17E3dF](https://basescan.org/address/0xA466E60cAe42E695Fb8f1Fc71d2f6816eE17E3dF) |

#### Business logic, extension and policies

| Contract or role | BaseScan address |
|---|---|
| BotradixPairForgeLogic | [0x0744e9a3f4ad391414FA2d1443de2259bB1620e6](https://basescan.org/address/0x0744e9a3f4ad391414FA2d1443de2259bB1620e6) |
| BotRadixRegistryLogic | [0xFBD00C93D96EF1a62EA1f017a6736927f5b98c2D](https://basescan.org/address/0xFBD00C93D96EF1a62EA1f017a6736927f5b98c2D) |
| BotRadixAutomationLogic | [0xDC9604745165a2eA737485dB4232aa8555e0e529](https://basescan.org/address/0xDC9604745165a2eA737485dB4232aa8555e0e529) |
| BotRadixAutomationExtension | [0x5256C7EbC2437F4820439D9754213B7759Db5dF5](https://basescan.org/address/0x5256C7EbC2437F4820439D9754213B7759Db5dF5) |
| BotRadixUniswapV3Logic | [0xa9Ad93A078aB62830fbC7A4D9B9924bbBca2FAf1](https://basescan.org/address/0xa9Ad93A078aB62830fbC7A4D9B9924bbBca2FAf1) |
| BotradixPairForgeParams | [0xD114ea201713EA7B9B5ea6244Fb850f0526Cc695](https://basescan.org/address/0xD114ea201713EA7B9B5ea6244Fb850f0526Cc695) |
| BotradixRegistryPolicyV2 | [0x33F96413b548F1d7bbAca66E117424E4609E93b2](https://basescan.org/address/0x33F96413b548F1d7bbAca66E117424E4609E93b2) |

### Facets retained in the deployment

The manifest also retains these earlier components, outside the 57 release components. They are included so the complete routes can be followed.

| Contract or role | BaseScan address |
|---|---|
| BotradixCrossCustodyFacet | [0x4aFd0DeB7647De9d6C5Eb34C58cf28300357E717](https://basescan.org/address/0x4aFd0DeB7647De9d6C5Eb34C58cf28300357E717) |
| BotradixCrossQuantFacet | [0xC31e4A46C514129983A5086d79D444854e54087b](https://basescan.org/address/0xC31e4A46C514129983A5086d79D444854e54087b) |
| BotradixLiquidityFacet | [0x9EaC5c10855d1C494b30Af3e9C28123fe98ef5B9](https://basescan.org/address/0x9EaC5c10855d1C494b30Af3e9C28123fe98ef5B9) |
| BotradixPreviewFacet | [0xEfdCe096526849dc313F0B0581f19aBb1bF1C4bd](https://basescan.org/address/0xEfdCe096526849dc313F0B0581f19aBb1bF1C4bd) |
| BotradixReadAccountFacet | [0xdD1D8aB402FCED0b2DbD02b9D0D7783f54909B81](https://basescan.org/address/0xdD1D8aB402FCED0b2DbD02b9D0D7783f54909B81) |
| BotradixConstantsFacet | [0xe65314C1ae2FE001d60Ad49d017a4869A30cB4a2](https://basescan.org/address/0xe65314C1ae2FE001d60Ad49d017a4869A30cB4a2) |
| BotradixProviderRegistryFacet | [0x5B815ef9c353b62Ca1d5885077a8D7C19B5269F8](https://basescan.org/address/0x5B815ef9c353b62Ca1d5885077a8D7C19B5269F8) |

## Contact and related terms

Report security issues to [support@botradix.com](mailto:support@botradix.com) with the subject **Security**, the network, affected address and reproduction steps. Include only information needed to investigate; never private keys, seed phrases or credentials.

See the [Terms, sections 21–26](https://botradix.com/terms) for the protocol, exits, administrative powers, deferred payments, parameters and rollback, and the [Risks](https://docs.botradix.com/risks/) page. This explanation of the mechanism does not remove those risks.