---
title: "Treasury"
description: "The fee sink: an untrusted plain address that claims protocol fees and nothing else."
audience: tech
type: reference
status: live
lang: en
updated: "2026-09-17"
publish: true
---
# Treasury

## 1. The fee sink

Each pool's `treasury()` is a plain address, not a contract. `Pool.initialize` seeds it from
`AccessControl.treasury()` and reverts on zero; it moves afterwards only through the
`UPDATE_TREASURY` op (`GOVERNANCE` tier, 7 days). Only that exact address may pull the pool's
accrued protocol fees (`Admin.sol`, `collectProtocolFees`).

## 2. Untrusted by design

The treasury is a pointer the owner rotates, not a principal
([Access Control §1](/docs/3-1-overview#1-principals)). It is untrusted: it calls
`collectProtocolFees` and nothing else. Reserves, liabilities, LP positions and parameters are out
of its reach.

## 3. Rotation

`AccessControl.treasury()` is a pointer, not a principal. The owner rotates it through
`queueRole(TREASURY)` → `executeRole` at the `GOVERNANCE` tier, guardian-cancellable while pending.
`previousTreasury()` keeps the outgoing address payable for one `GOVERNANCE` delay plus the grace
period, so a pool mid-rotation still settles.

Tier durations: [Access Control §3](/docs/3-1-overview#3-timelock-parameters).