Sierra has deployed an instance of OpenZeppelin's TimelockController to govern every non-operational, administrative role for the protocol. All privileged actions, including protocol upgrades, parameter changes and role assignments, are now enforced by a minimum 48-hour delay before they can execute

What is a Timelock?

A timelock is a smart contract that enforces a predefined delay before certain actions can be executed. The delay is encoded in the timelock smart contract and provides stakeholders with time to review upcoming changes and respond as needed.

We have chosen to use the OpenZeppelin TimelockController, as it is the industry-standard contract for delaying privileged actions. The TimelockController contract is the most battle-tested timelock across the largest protocols in DeFi. Billions of dollars in TVL and protocol treasury assets are constantly protected by the TimelockController contract.

Enhancing Sierra’s Security Stack

Protocol security has always been a top priority for Sierra, including:

• Audited smart contracts with Spearbit Cantina

• Fireblocks MPC custody, which includes address whitelisting, transaction policy enforcement and signing quorum

• Backup recovery with Station70

• 24/7 monitoring and alerting with Hypernative and Betterstack

Despite having an industry-leading security stack, we received feedback from curators, hedge funds and other stakeholders that administrative actions such as a protocol upgrade or a role change could take effect the moment it was signed. While these actions were safeguarded by signing quorum and transaction policy enforcement in Fireblocks, there was no mandatory waiting period between approval and execution.

By deploying a timelock that covers all administrative roles and functions, we have added an additional layer of security. The timelock hardens the access control of the smart contracts powering the Sierra Protocol.

Instead of the Fireblocks wallet holding these administrative permissions directly, the permissions now sit with the timelock contract, and the Fireblocks wallet acts through it. This means that every administrative call now follows a two-step flow:

• Our Fireblocks wallet schedules the action on the timelock, which starts the delay countdown

• After a minimum of 48 hours, the action becomes executable, and only then can it be carried out

During that window, the pending action is visible onchain to anyone watching. Stakeholders of the Sierra community can set up onchain alerting systems like Hypernative to be immediately notified if an event occurs. Additionally, the timelock has a Canceller role that can veto a pending action prior to execution if needed. Operational workflows, such as processing redemptions or exchange rate automation, have been excluded from the timelock. 

The timelock smart contract address for SIERRA on Avalanche is: 0xD3cE23C1cC1ae288496Baf1a276A9B8640206fdd and is available in our docs. In addition, all future LVTs issued by the Sierra Protocol will have a timelock as part of the standard deployment.