Emergency exit and upgradeability

​

Emergency exit

initiateEmergencyWithdraw()            // vault owner only; starts the 7-day timelock
// ... wait 7 days, then within the following 7 days:
emergencyWithdrawERC20(token)          // sends the vault's full `token` balance to the vault owner
emergencyWithdrawERC1155(token, id)    // sends the vault's full balance of position `id` to the vault owner

• From initiateEmergencyWithdraw() on, the exchange rejects orders from that vault. emergencyUnlockAt() returns the unlock time.
• If the 7-day execution window lapses, call initiateEmergencyWithdraw() again.
• GET /api/me/vault/emergency shows the state (none, waiting, executable, unlocksAt, initiatedAt). Pass ?vault=0x… to inspect a specific vault (default: active vault). It is read-only; the calls are yours.

const vault = new Contract(vaultAddress, ['function emergencyWithdrawERC20(address token)'], eoa);
const gas = await vault.emergencyWithdrawERC20.estimateGas(contracts.usdc);
await (await vault.emergencyWithdrawERC20(contracts.usdc, { gasLimit: gas + gas / 10n })).wait();

​

Upgradeability

• Timelock: Changes take effect only after upgradeTimelock() (minimum 1 hour, maximum 30 days; configured on chain).
• Execution window: Staged proposals must be executed within UPGRADE_WINDOW (7 days) after maturation.
• Monitoring events: Watch for VaultUpgradeProposed(impl, activatesAt) and VaultImplementationSet(old, impl) on VaultFactoryGen2, or UpgradeProposed(impl, activatesAt) and UpgradeApplied(impl) on the exchange proxies.
• Permanent disable: An admin can call disableUpgrades(address(this)) to irreversibly permanently disable upgrades on that contract (UpgradesDisabled).