Config Restrictions
Overview
Config restrictions protect operations that change the system configuration of the vault, such as registering tokens, adding blockchain networks, or attaching cold-wallet master keys. They are one of three restriction categories alongside Transaction Restrictions and Policy Restrictions.
Unlike transaction restrictions, config restrictions carry no filters. They are all-or-nothing: if a config restriction exists, it applies to every config operation. The restriction specifies only which approver groups must sign off.
Evaluation Semantics
Config restrictions follow the same additive model as transaction restrictions:
- Every config restriction is checked.
- Since there are no filters, every config restriction always matches.
- All approval requirements from all matching restrictions accumulate.
- The operation proceeds when every accumulated requirement is satisfied.
- If no config restriction exists, config operations are allowed without approvals.
Governed Operations
The following operations require config restriction approval when at least one config restriction is configured:
| Operation | Description |
|---|---|
| Register token | Register a token |
| Unregister token | Remove a registered token |
| Delete token | Delete a token entry |
| Register custom chain | Register a custom EVM chain |
| Unregister chain | Remove a registered chain |
| Register blockchain network | Register a known blockchain network |
| Unregister blockchain network | Remove a registered blockchain network |
| Set ERS public key | Set the Emergency Recovery Service public key |
| Attach master key | Attach a cold-wallet master key |
Note: Account creation is not governed by config restrictions. That is an uncategorized operation that always executes without policy approval.
Example
A single config restriction protects all asset and chain management operations:
| Restriction ID | Action |
|---|---|
config-default |
2 of owner |
Result:
- Registering a token requires 2 owner approvals.
- Registering a custom chain requires 2 owner approvals.
- Attaching a cold-wallet master key requires 2 owner approvals.
- Creating a new vault account requires no approval (uncategorized, not governed by config restrictions).
🗣️We Are Here to Help!
Please contact us via email or support chat if you encounter an issue, bug, or need assistance. Don't forget to include any relevant details about the problem. To request a wallet form and Institutional Vault Approver form, please click here or contact our sales team.
Updated 2 months ago