Concept
Security & Governance
CenterChain is built on four principles that cut across every module: capabilities over roles, bounded state growth, alarmed invariants, and explicit governance. These are not aspirations -- they are enforced by code.
The four principles
1. Capabilities, not roles
Authority is an address, not a role engine. Every privileged message compares the signer against a stored address: denom admin, class issuer, pool owner, or gov. No authz grants anywhere in these modules.
2. Bounded state growth
Every module enforces hard caps on collection sizes and refuses the write before any transfer happens. Denoms, blacklists, pools, farms, listings, streams -- all capped.
3. Invariants are alarmed, not fatal
liquidity and income run invariant checks in EndBlock and emit an alarm event instead of returning an error, so a violation never halts block finalization.
4. Explicit governance
The gov module account is the only signer that can change module params, move a class issuer, register an IBC denom, pause a pool in an emergency, close a pool, or recover IBC-denom coins. No hidden admin keys.
Critical invariants
Liquidity: pool reserves integrity
After every swap, add/remove liquidity, the pool's constant product (x*y) is verified. Deviations emit an alarm event.
Income: solvency
Every 10,000 blocks: yield pool balance ≥ total unpaid liability (fungible accruals + NFT earmarks). Including holders never checkpointed.
NFT Market: deposit invariant
Module account balance = sum of active listing deposits. Every listing creation/deposit/purchase/cancel maintains this equality.
Token Factory: admin integrity
Denom admin can only be changed by the current admin (or gov). No self-transfer, no unauthorized takeover.
Hard caps that bound state growth
Every collection has a hard cap. Writes that would exceed the cap are rejected before any state change.
Token Factory
- Denoms: 100,000
- Blacklisted addresses: 100,000
- Subdenom: 44 bytes
Liquidity
- Pools: 10,000
- Farm positions: 10,000 (1,000/pool)
- Lots: 100,000 (10,000/position)
NFT Market
- Active listings: 10,000
- Listing size: 2,048 bytes
- Denoms per class: 32
Income
- Streams: 1,000
- NFT claims/msg: 50
Governance actions
Only the gov module account can:
- Change module parameters (fees, caps, intervals)
- Move a class issuer to a different address
- Register an IBC denom
- Pause a pool in emergency (liquidity)
- Close a pool permanently
- Recover a pool's IBC-denom coins
- Move a class issuer to a different address
- Update global market config (deposit, caps, expiry)
No module has its own admin key. The gov module account is the single governance surface.
Read the full specification
Full invariant definitions, alarm event schemas, governance message schemas, and emergency procedures.