> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hadron.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Controls

> Authority separation, the drawdown guard, and the staleness kill switch

Hadron pools are designed so that the key doing the day-to-day work (pushing prices) can never spend
your liquidity, and so that even a fully compromised operational key has a hard cap on the damage it
can do.

## Separated authorities

| Authority           | Held by                               | Can do                                                     |
| ------------------- | ------------------------------------- | ---------------------------------------------------------- |
| `authority`         | Cold key (hardware wallet / multisig) | Owns the pool: change parameters, rotate other authorities |
| `quoting_authority` | Hot key (the crank)                   | Push mid-price and spread updates, **nothing else**        |
| `pause_authority`   | Whoever you trust to hit stop         | Halt quoting immediately                                   |
| Deposit / withdraw  | Per your setup                        | Move liquidity in and out                                  |

<Warning>
  Keep `authority` cold: a hardware wallet or multisig that never touches a server. The crank only
  ever needs `quoting_authority`. If you follow one rule from this page, follow this one.
</Warning>

## The guards

* **Drawdown guard.** Caps how much the pool can lose over a time window. Even if the quoting key is
  fully compromised and pushes hostile prices, losses stop at the cap; your liquidity cannot be
  drained.
* **`delta_staleness` (staleness kill switch).** If the pool doesn't receive a price update within
  your configured number of slots, it stops quoting. A dead feed or crashed crank fails safe (no
  quotes) instead of failing open (stale quotes anyone can pick off).
* **Pause.** `pause_authority` can halt the pool instantly, independent of the cold key.

## What happens if…

<Accordion title="…my crank crashes at 3am?">
  Quoting stops automatically once `delta_staleness` expires, typically within a minute. No stale
  quotes, no losses; the pool simply goes dark until updates resume. Aggregators stop routing to you
  until then.
</Accordion>

<Accordion title="…my quoting key is stolen?">
  The attacker can push bad prices, but the drawdown guard caps total losses over its window, and
  the attacker cannot withdraw funds (that right belongs to other authorities). Pause the pool, rotate
  `quoting_authority` from your cold key, resume.
</Accordion>

<Accordion title="…my price source goes wrong (not down, wrong)?">
  This is the failure the guards exist for: the drawdown guard bounds the damage while the bad feed
  persists, and pausing takes one transaction. For belt-and-suspenders, run sanity bounds in your
  crank config so implausible prices are rejected before they're ever pushed.
</Accordion>

<Accordion title="…I want to shut down entirely?">
  Pause, withdraw both sides, done. The pool is yours alone: there are no other LPs to coordinate
  with and no exit process.
</Accordion>

## Programmatic control

Everything above is scriptable: see [Admin controls](/sdk/admin-ts) for authority management and
pool-state transitions, and [Oracle Management](/sdk/oracle-management) for `updateDeltaStaleness`.
Per-wallet and per-router quoting rules are covered in
[Toxic-flow prevention](/concepts/toxic-flow-prevention).