Security and authority
Your wallet signs the transaction; contracts hold and operate the portfolio. The important questions are which code runs and who can change its behavior.
Testnet software with mock/test assets. Uniswap’s own Permissioned Pools contracts are audited; Mintware’s engines, custom hook and composition are unaudited.
Who can call what?
| Caller | Operations | Pause behavior |
|---|---|---|
| Owner / operator | configureAdapters and activate; allocateIdle and deployLiquidity. “Operator” describes the owner’s operational role; there is no separate engine operator or keeper role. | Allocation and deployment are blocked while paused. Configuration and activation have no pause modifier. |
| Owner | Set guardian and maxPauseDuration; unpause immediately. Inherited ownership functions can change the owner. | The owner can set the timeout to zero, disabling timeout recovery. These controls have no engine timelock. |
| Owner or guardian | pause() | Blocks deposit, allocateIdle, deployLiquidity and recenter. Does not pause a hookless pool’s trading. |
| Anyone | harvest and recallIdle; recenter when due; unpauseAfterTimeout when enabled and elapsed. | Harvest and recall remain callable. Recenter requires unpaused state. Timeout recovery defaults to 30 days and is owner-adjustable. |
| Share holder | withdraw own shares to a chosen nonzero recipient. Anyone may deposit when its checks pass; owned pools add eligibility checks. | Withdraw has no pause modifier. Deposit is blocked. Token, adapter and valuation conditions still apply. |
| PoolManager / engine itself | unlockCallback is PoolManager-only with matching active data. removeLiquidityForExit, recallForExit, payExact and readPricesForExit are self-call-only helpers. | These are execution boundaries, not public withdrawal or bypass entry points. |
The RWA hook has separate owner, keeper and guardian controls: only the keeper posts subsequent appraisals; owner/guardian can pause trading; owner resumes it. Keeper changes and post-initialization hook configuration changes wait 48 hours. Adapter checker, wrapper and swap-switch controls belong to the adapter owner and are not subject to that hook delay.
What the code enforces
- Immutable pool identity, mark source, lifecycle module and core risk settings; one-time dedicated adapter configuration.
- Constructor validation of the module’s exact runtime code hash, followed by authenticated PoolManager callbacks and an active-unlock data hash.
- Fresh mark and pool-deviation checks for new risk; measured token transfers; user minimum shares and exit amounts.
- Principal and position caps at the specified deposit/deployment checks, and bounded atomic recentering.
- Reentrancy protection on capital/lifecycle entry points and isolated exit subcalls for partial-delivery handling.
- Owned-pool share transfer refusal, mint-time eligibility and separate pool activity permissions.
These are specific controls, not proof against every loss. A module pin preserves identity, not correctness. A separate engine ledger avoids pooled accounting across markets, but shared dependencies can still fail together.
Audit scope and evidence
The upstream Permissioned Pools audit scope does not include Mintware’s custom appraisal hook, pooled-share accounting, adapter choices or deployment configuration. An external audit is required before Mintware markets carry real value. Local tests and internal reviews are useful evidence, not an external audit.
Inspect the architecture and module boundary, current deployment record, and risks. Verify installed code and configuration for the actual chain and address; source code alone does not prove a deployment’s runtime state.
Source reference
Behavior above follows these files in the Mintware repository. Deployment records describe recorded state, not a fresh chain read.
contracts-v4/src/lib/MWGuardianPausable.solcontracts-v4/src/vaults/MintwareMarketEngineCore.solcontracts-v4/src/vaults/MintwareMarketEngine.solcontracts-v4/src/vaults/MintwareOwnedPoolMarketEngine.solcontracts-v4/src/rwa/MintwareRwaAppraisalHook.sollib/rwa/units.tsconfig/deployments.json