Guardian/pause-keeper distinct from upgrader
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether a distinct guardian or pause-keeper role exists in the protocol's access control system — separate from the upgrader address — and whether that role is held by an address distinct from the upgrader. The presence of a separate pauser is a role-separation signal: it means an emergency pause can be executed by a party that does not also hold upgrade authority, which limits the blast radius of a compromised pauser key.
**Why it matters** Role separation is a defense-in-depth principle: a single compromised key should grant an attacker the minimum possible authority, not all administrative powers simultaneously. When the same address or multisig is both the pauser and the upgrader, an attacker who compromises that address can not only pause the protocol (preventing user withdrawals) but also upgrade it — turning a defensive mechanism into an offensive one. Protocols that separate these roles constrain a compromised pauser to the pause action only, buying time for the legitimate governance process to respond.
**Green / Yellow / Red** Green is assigned when a guardian or pause role exists, is held by an address distinct from the upgrader, and is held by a multisig with at least a 2-of-N threshold. Yellow covers cases where the pause role is distinct from the upgrader but held by a single EOA, or where a pause mechanism exists but is gated behind the same multisig as the upgrade path. Red is assigned when no distinct pause role exists (upgrade is the only emergency mechanism) or when the pause and upgrade roles share the same controlling address.
**Common gray cases** This factor is grayed when the protocol has no pause mechanism at all (fully immutable or fully permissionless) — absence of a pause capability is its own risk dimension assessed elsewhere.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a pauser/guardian role exists and is held by an address distinct from the upgrader address.