Risk and Admin Roles

Nami coordinates smart contracts, liquidity, and operations across multiple blockchains.

This architecture introduces technical, operational, and economic risks that require controls tailored to each component. Protocol security is structured across multiple layers, including code review, permission separation, multisigs, timelocks, transaction monitoring, and incident response procedures.

Human and Operational Risks

The people involved in administering a protocol form are also part of its risk surface.

A compromised key, an error during transaction verification, a phishing attack, or the unavailability of certain signers may affect protocol security or operational continuity.

Nami limits these risks through dedicated procedures for multisig configuration, key management, transaction verification, and emergency preparedness. These procedures follow established multisig security practices adapted to the protocol's architecture and risk profile.

Signer Protection

Sensitive administrative operations are protected by Safe multisigs and require approval from multiple independent signers. The required quorum prevents any single signer from exercising the permissions controlled by the multisig.

The primary measures include:

• Hardware wallets for key storage and use.
• Dedicated, up-to-date devices reserved for signing operations.
• Physical seed phrase backups stored offline and separately from the corresponding hardware wallets.
• Addresses used exclusively for multisig activity, with no DeFi, NFT, or personal transactions.
• Geographic and operational separation among signers.
• Signing devices produced by different manufacturers.
• End-to-end encrypted communication channels for sensitive operations.
• Training to recognize phishing, social engineering, malware, deepfakes, and impersonation.
• Procedures for reporting periods of unavailability and maintaining the required operational quorum.

Signer addresses can be verified onchain. Personal information associated with signers is treated as sensitive to reduce exposure to targeted attacks, coercion, and social engineering.

Transaction Verification

Every administrative transaction is reviewed before signing.

Signers must understand its purpose, origin, and effect on the protocol before execution.

Depending on the operation, the process may include:

• Confirming the proposer's identity through authorized internal channels.
• Simulating the transaction before execution.
• Decoding and verifying the calldata.
• Checking the destination address and transferred amounts.
• Verifying the called function and its parameters.
• Checking the nonce and operation type.
• Comparing the information displayed by the multisig interface with that shown on the signing device.
• Independently verifying the transaction hash for critical operations.

Every administrative change is accompanied by operational context documenting the purpose of the transaction and its approval process.

Operational Preparedness

Signers periodically verify their ability to participate in signing operations and take part in simulations of the principal emergency procedures.

The loss or suspected compromise of a key is reported immediately through a secure channel so that established containment and replacement procedures to be activated.

Smart Contracts and External Dependencies

All smart contracts may contain vulnerabilities, logical errors, or unexpected behavior.

Complexity and risk increase when multiple contracts interact or when an operation involves tokens and protocols developed by different parties.

Nami's proprietary smart contracts undergo a security process combining specialist consultation, AI-assisted analysis, code review, and independent manual audits. The corresponding reports are available in the Audit Reports section.

Material changes to proprietary codebases and their configurations are reviewed and verified before activation.

Integrated Infrastructure

Nami integrates smart contracts, infrastructure, and services developed or administered by external parties.

These dependencies include:

• Liquidity engines and DEX components.
• Aggregators, solvers, and routers.
• Bridges and messaging protocols.
• Tokens, stablecoins, and bridged assets.
• RPC providers, indexers, and services used by the interface.

Nami selects and integrates these components through technical and operational assessment processes. The security, availability, and administration of external dependencies remain partly outside Nami's control.

The compromise, malfunction, or unavailability of an external dependency may cause delays, failed transactions, route suspension, or execution outcomes that differ from estimates produced before execution.

OmniSwap and Execution Providers

OmniSwap queries multiple aggregators, solvers, and cross-chain providers in parallel.

Quotes are simulated, verified, and compared by estimated net output.

Execution of the selected route depend on the smart contracts, liquidity, and availability of the providers involved. Network state may change between quote generation and transaction confirmation.

User-authorized parameters, including slippage, minimum amount received, and deadline, define the limits within which an operation may be executed. If a provider is compromised or unavailable, routes that rely on it may be temporarily removed.

Multichain Operations and Assets

Cross-chain operations span independent networks and progress through multiple stages. Congestion, outages, chain reorganizations, message delays, relayer unavailability, or finality issues may delay or interrupt an operation.

A transaction that has already reached finality on one blockchain cannot be reversed by Nami. Completion of subsequent stages depends on conditions on the destination chain and the infrastructure used to transfer the asset or message.

Assets used through Nami may also carry risks associated with liquidity, volatility, depegging, custody, issuers, blacklists, bridges, and non-standard contract behavior.

Simulation evaluates the expected outcome of a transaction under the conditions observable at that time. Subsequent events or behavior that cannot be detected through simulation may affect execution or asset value.

Admin Roles, Multisigs, and Timelocks

Nami distributes administrative permissions among separate roles, with each role limited to the functions it requires. The effective permissions depend on the contract and chain.

The addresses configured in the contracts are the authoritative reference for verifying each role and its permissions.

The use of modules, guards, or allowance mechanisms is limited to the functions required by the protocol and remains subject to monitoring.

Timelocks introduce a delay between the approval and execution of scheduled changes.

This period makes the operation publicly observable and allows its effects to be assessed before activation.

Timelock duration varies according to the type of operation and the component involved.

Functions intended to contain an incident immediately may be assigned to emergency roles with a narrower scope and shorter response times.

Monitoring and Incident Response

Multisigs, administrative roles, and the protocol's principal components are monitored through transaction event alerting systems.

Monitoring covers events such as:

• New multisig proposals and transactions.
• Signer additions or removals and threshold changes.
• Module and guard activation or deactivation.
• Changes to administrative roles.
• Upgrades and changes to critical parameters.
• Unexpected activity from dedicated signer addresses.
• Anomalous behavior in monitored components.

Relevant events generate notifications through restricted channels, allowing signers and security personnel to review them promptly.

Emergency Controls

Certain components include emergency functions designed to contain an incident within the affected component or area of the protocol.

Depending on the component and the nature of the incident, available controls may suspend:

• New deposits or operations.
• Borrowing functions.
• Automations.
• Cross-chain operations.
• Reward or emission distributions.
• Interactions with a specific integration.
• A gauge's eligibility to receive new allocations.

Suspension is applied to only the scope required to contain the identified risk.

The availability of withdrawals, claims, and other functions depends on the architecture of the affected component and the conditions of the incident.

Response Procedure

When a vulnerability, suspected key compromise, economic anomaly, or incident involving an external integration is identified, the team verifies and classifies the event, identifies the affected components, and activates the designated response procedures and responders.

Available functions are used to contain the incident within the affected scope. The cause and effects are analyzed before any correction is prepared, reviewed, and verified. Reactivation of affected functions requires authorization from the relevant role and may proceed gradually when conditions require it.

BailSec Emergency Room

Nami has access to the BailSec Emergency Room to support incident response involving smart contracts or other critical protocol components.

The service provides an escalation channel to security specialists who can assist with triage, technical analysis, containment, and verification of corrections.

Operational control remains with the authorized roles and multisigs.

BailSec provides technical and investigative support without independently holding administrative permissions over the protocol.

Nami Value Protection System

The Nami Value Protection System brings together controls designed to protect emissions, rewards, and allocations coordinated through gauges.

The system is designed to protect resources administered or distributed by the protocol. It is not designed to support the market price of NAMI or any other asset.

Gauge Protection System

The Gauge Protection System protects the voting and distribution system from compromised or manipulated gauges as well as gauges that present economic risk.

Before a gauge becomes eligible to receive emissions, Nami may review the underlying pool, the tokens involved, their contracts, and the dependencies required for operation.

Monitoring considers events such as:

• Incentive manipulation.
• Anomalous reward distribution activity.
• Sudden concentrations of voting power near the end of an epoch.

When a risk is identified, the authorized role may suspend the gauge's eligibility to receive new emissions or rewards within the limits established by the relevant contracts.

Suspension does not alter allocations that have already been executed.

The time-weighted allocation average, blackout period, and applicable cooldowns reduce the impact of sudden changes in voting allocations, particularly those made near the end of an epoch.

A gauge may be reinstated after the event has been analyzed, its cause has been addressed, and the conditions required for correct operation have been verified.

Residual Risk

The measures described are intended to reduce the likelihood and potential impact of incidents. Risks inherent to smart contracts, blockchains, external dependencies, and market conditions remain.

Audits, monitoring, and administrative controls operate within the technical limits of the components involved and cannot guarantee the absence of vulnerabilities, failures or interruptions.

Users should verify contract addresses, transaction parameters, and granted permissions before interacting with the protocol.