Skip to main content
A tier is a property of a (target, selector) pair, set by governance on TierRegistry and consumed at propose and execute. It is not a property of a guardian. There is no guardian tier ladder in the protocol: every active guardian reviews every proposal. What changes with the pair is the price of extractable value, not who is allowed to vote. TierRegistry.tierOf(target, selector) is the read. The governor takes the max tier across execute calls as the proposal’s envelope tier, and sums per-call extractableBoundBps into requiredCoverage.

​
The three tiers

The registry recognizes exactly three tiers. Names and numbers are the protocol’s:
Tier 0 and tier 1 are the certified tiers. Certification is keyed keccak256(abi.encodePacked(target, selector)) — two selectors on the same adapter are independent pairs, each with its own bound and its own bond. A certified bound must be strictly between 0 and 10_000 exclusive: a full-notional “bound” is tier-2 economics and must not wear a 0/1 label (BoundRequired). Governance must not certify proxied adapters at tier 0/1. tierOf checks live EXTCODEHASH against the hash snapshotted at certification, which catches same-address bytecode mutation and does not catch a proxy implementation swap.

​
The (2, 10_000) default

Uncertified, demoted, or codehash-mismatched pairs all report (2, 10_000):
That pair is the absence of a certification, not a grant. With no TierRegistry wired, SyndicateGovernor._resolveTierAndCoverage returns (2, maxCapital) — full notional, fail-closed. A sandbox payload is also forced to tier 2; there is no certified bound that could reduce it. Coverage for a call is (cap_i * boundBps) / 10_000. Tier 0/1 uses the certified bound; tier 2 uses 10_000. See Coverage and underwriting.

​
Tier is not reachability

Tier is not reachability. tierOf prices a pair. It does not decide whether the vault may call that target, approve it, or send it funds. An uncertified pair is expensive (full-notional coverage). It is not, by that fact, reachable. Reachability is the allowlist.
The spec line the contracts implement: tiers PRICE extractable value for coverage; the allowlist bounds WHERE vault funds may be approved or sent at all. Demoting a pair back to (2, 10_000) raises the coverage price. It is a price, not a prohibition. The prohibition is clearing the funds axis. A governor batch is tier-blind on the callee check. SyndicateVault._guardBatchCalls refuses any target the registry owner has not listed, regardless of that target’s tierOf. Naming an uncertified address in executeCalls reverts DisallowedBatchCallee even though tierOf would happily return (2, 10_000). The converse is also true. Certifying a pair at tier 0 does not allowlist it. certify never writes the allowlist; restoring standing after a demotion is always an explicit owner setAdapterAllowed.

​
The three allowlist axes

ITierRegistry exposes three independent allowlist reads. They answer three different questions. None of them is a tier. Exotic-asset contracts (ERC-721/1155/777, LP-position NFTs) must not be listed on the funds axis as batch callees. A concentrated-liquidity template still has to bind a Uniswap position manager — that is why the counterparty axis exists. A counterparty grant withholds batch reachability, not fund contact: the template’s own reviewed code may approve what it binds. Proposer-authored batch calldata cannot. The funds and callee axes are granted together by setAdapterAllowed(a, true) (or setClassAllowed on a template). They diverge only on revocation:
  • Owner delisting (setAdapterAllowed(a, false)) closes both. The vault has no further business with that address.
  • Demotion (demote / demoteByChallenge / poke) clears the funds axis and leaves the callee axis standing. Revoking the right to be paid must not revoke the vault’s ability to reclaim capital the target already holds.
A counterparty-only listing opens neither batch axis.
Certification is keyed (target, selector). The funds allowlist is keyed by bare address. Demoting one selector therefore de-allowlists the whole adapter. That over-breadth is specified, not a bug: recovery is one owner setAdapterAllowed call. The alternative is vault funds still approved to a convicted or mutated adapter.

​
What this is not

  • Not a guardian ladder. Guardians are one cohort. Stake weights a review vote; it does not gate which (target, selector) a guardian may look at. Tiers do not rank guardians.
  • Not a permission to call. See Tier is not reachability.
  • Not an indemnity. A tighter extractableBoundBps lowers requiredCoverage. Slash proceeds are still burned.

​
Views

See Coverage and underwriting for how the bound becomes requiredCoverage, and Guardian Review for the Approve / Block vote that underwrites it.