Treasury

1. The fee sink

Each pool’s treasury() is a plain address, not a contract. Pool.initialize seeds it from AccessControl.treasury() and reverts on zero; it moves afterwards only through the UPDATE_TREASURY op (GOVERNANCE tier, 7 days). Only that exact address may pull the pool’s accrued protocol fees (Admin.sol, collectProtocolFees).

2. Untrusted by design

The treasury is a pointer the owner rotates, not a principal (Access Control §1). It is untrusted: it calls collectProtocolFees and nothing else. Reserves, liabilities, LP positions and parameters are out of its reach.

3. Rotation

AccessControl.treasury() is a pointer, not a principal. The owner rotates it through queueRole(TREASURY) → executeRole at the GOVERNANCE tier, guardian-cancellable while pending. previousTreasury() keeps the outgoing address payable for one GOVERNANCE delay plus the grace period, so a pool mid-rotation still settles.

Tier durations: Access Control §3.