Security and admin powers

Who holds the admin powers?

On Ethereum mainnet, the crowd loan contract is at 0x48d65f88244e45f2CF8E4c4A7E414E94b923E3dB (view on Etherscan). The contract has two roles. The default admin role can grant and revoke roles, and those changes take effect immediately. The admin role holds the operating powers listed below. Both roles were granted to one wallet when the contract was created: 0x76c29BdE5873e2d53893a9795e66140bfA5B20A2 (view on Etherscan). It is a single externally owned wallet, not a multi-signature wallet. Anyone can check whether an address holds a role by calling the contract's hasRole function.

What can the admin do?

• Pause and unpause the contract. What a pause blocks is listed below.
• Cancel a loan administratively, but only while it is still funding, which includes the selection window before the borrower accepts offers. Cancelling moves no tokens; each lender then withdraws their full offer. A loan that has started cannot be cancelled by anyone.
• Mark a loan as not repaid in time once its repayment deadline has passed. Anyone can do this too.
• Change the limits for new loans: the loan size range, the funding, selection and repayment window limits, the range for a borrower's maximum APR (never above 50%), the maximum number of offers per loan and the minimum offer size. These changes take effect immediately but apply only to loans created afterwards, because each loan is checked and records its settings when it is created.
• Change the protocol fee and the address that receives it. Both changes are queued and can be carried out only after a 3-day timelock, by anyone. The fee is 10% of interest; the contract caps it at 25%, so a change can never raise it above that. It is charged only on interest and never on principal, and each loan keeps the fee rate it was created with.
• Upgrade the contract, after a 3-day timelock. See how upgrades work below.
• Decide which tokens loans can use. On mainnet the allow-list is USDC, USDT and DAI. When a token is delisted, new loans and new offers in it stop, but repayments, claims and refunds stay open.

What does a pause block, and what does it never block?

A pause blocks only three things: creating loans, making offers and accepting offers.

A pause never blocks repaying a loan, claiming repayments, withdrawing a refundable offer, cancelling or expiring a loan, marking a loan as not repaid in time, collecting fees, or carrying out a fee change whose timelock has passed. Interest keeps accruing while the contract is paused.

If a pause lasts through a borrower's selection window, the borrower cannot accept offers. The loan then expires, and every lender can withdraw their full offer.

How do upgrades work?

The contract is upgradeable, using the UUPS proxy pattern. An upgrade can replace all of the contract's logic, including the logic that holds escrowed funds. The admin must first queue the exact new implementation. Queuing is public: it emits an UpgradeQueued event on-chain. The upgrade can be carried out only after 3 days, and only to the implementation that was queued.

The 3-day delay gives anyone watching the contract time to see an upgrade coming. It does not let every lender leave: an offer in a loan whose funding window is still open, or whose selection window is open after offers reached 80% of the request, cannot be withdrawn during that time, upgrade or not. Money already lent in an active loan comes back only as the borrower repays it.

Where are the funds held?

Funds sit in the smart contract, not in a company account. The only tokens the contract holds are lender offers, repayments that lenders have not claimed yet, and protocol fees that have not been collected. It holds no borrower collateral. Lenders withdraw refunds and claim repayments themselves; the contract never pushes payouts. If a borrower does not repay, nothing is seized, so lenders recover only what the borrower repays. These rules are the contract's, but the admin powers above exist, and an upgrade could change the rules after the 3-day timelock.

Is Unlloo live with real money?

Yes. Unlloo crowd loans run on Ethereum mainnet. A borrower picks one of three stablecoins for each loan, and every offer and repayment on that loan is in the same token:

• USDC (USD Coin): 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
• USDT (Tether USD): 0xdAC17F958D2ee523a2206206994597C13D831ec7
• DAI (Dai): 0x6B175474E89094C44Da98b954EedeAC495271d0F

Loans have no collateral, so lending can lose money. Read the risks before you lend.

How do I report a vulnerability?

Contact the team on Telegram at t.me/unlloo_protocol and ask for a private chat before you share details. Please do not post vulnerability details in public. Our security.txt file is at /.well-known/security.txt.