Skip to main content

​
Scope

There is a single, transferable admin authority (AdminConfig.authority) that gates:
  • pool creation,
  • protocol-fee withdrawal,
  • empty-bin-array deletion,
  • pool config updates (dynamic fee config, protocol share).
Everything else — swapping, depositing, withdrawing, claiming, and repositioning the active bin across empty bins — is fully permissionless.
The admin authority cannot touch LP funds. It cannot withdraw, freeze, or redirect a position’s principal or accrued LP fees. Its powers are limited to the four items above — notably including that pool creation itself is admin-gated, unlike some other DLMM designs where anyone can spin up a pool. This is deliberate: it lets Token-2022 transfer-hook mints be curated rather than accepted permissionlessly, since a hook is program logic the pool doesn’t control. See Token-2022.

​
Bootstrap

create_admin_config solves the chicken-and-egg problem of gating the very first admin action — nothing in AdminConfig exists yet to check a signer against, and a naive permissionless bootstrap would be front-runnable. Instead, this one instruction is gated by the program’s own on-chain upgrade authority (verified via the SPL BPF Upgradeable Loader’s programdata_address/upgrade_authority_address, not a hardcoded pubkey) — only whoever holds upgrade authority over the deployed program binary can bootstrap AdminConfig.

​
Two-step authority transfer

Two steps, not one, so a transfer can’t be completed by mistake or to an address the new party never actually controls — the nominee has to actively accept.

​
Metadata-update authority

AdminConfig.metadata_update_authority is a deliberately separate role from authority, even though both default to the same key at bootstrap — it’s the authority position NFTs’ Token-2022 metadata pointer is set to, rotatable independently via set_metadata_update_authority without touching the main admin authority.

​
Recovery

reset_admin_authority — also gated to the program’s upgrade authority, not the current AdminConfig.authority — resets both authority and metadata_update_authority back to the caller. This is a break-glass recovery lever for a lost admin key: whoever controls the program’s upgrade authority can always regain admin control, independent of whether the previous admin key is recoverable.