04 / ADMIN POWERS

One key. Narrow powers. No access to funds.

Counter currently uses a single admin wallet — the same wallet used for contract deployment on both testnet and mainnet. There is no multisig on this build.

Powers

✓

Admin can

Pause new fills, and add or remove tradable tokens from the supported-asset allowlist. Every change emits an onchain event. The payment token (WETH) can't be de-listed.

Admin cannot

Move a user's tokens, change the terms of a signed order, fill an order on someone else's behalf, cancel another wallet's order, or change the payment token — it is fixed when the contract is deployed. Cancellation always stays available even while fills are paused.

Ownership

Two-step transfer, no renounce.

Handing admin to a new wallet takes two transactions: the current owner proposes it and the new wallet accepts, so a typo can't lose control. Renouncing ownership is disabled, so fills can never be left paused with nobody able to resume them.

Known trade-off

Single-key admin is a known trade-off, not an oversight — it removes the second-approval layer a multisig would give. Expect this to move to a multisig before mainnet handles real funds.