Skip to main content

Resources

Resource Overview

Identity and Access Management (IAM)​

  • User is the fundamental resource. They can be human or machine. Each request to Treasury must be signed with a
  • Credential, which comes in multiple variants: k256 is suitable for programmatic or CLI requests, webauthn (and the time-limited session) is used for UI request.
  • Role can be attached to users. One user may have multiple roles.
  • AccessRules consitute the Access Policy, determining which Operations may be initiated, approved or canceled by which users or roles

Note that an Operation cannot be directly created. Instead, each user request for a CRUD operation (if valid according the the access policy) creates an Operation. If an operation is authorizing, it requires approving requests; ultimately an operation will have succeeded or failed. In the successful case, the originally requested operation (CRUD on some other resource) will be executed.

Transfers​

  • Chain is the parent resource of both
  • Address, which is internal (if Treasury controls the key) or external, and
  • Asset, which is the native (gas) asset or a contract-based token asset.
  • Account is an optional grouping mechanism for addresses (each address can be in at most one account)
  • TransferRules constitute the Transfer Policy, determining which from-to routes are allowed for which assets
  • Transfer then is the core resource of Treasury, a semantic representation of sending an amount of an asset from one address to another.

Administrative​

  • Treasury is a singleton resource, with information such as its ID and current software version.
  • Signer corresponds to the off-chain worker process creating keys and signatures using MPC protocols.
  • SoftwareUpdate is a request to update the Treasury software at a given block (executed by the distributed supervisor processes)
  • Feature are opt-in features of the Treasury.

Raw MPC​

Whereas Address and Transfer are also based on keys and signatures (with a dedicated transfer policy), as an escape hatch users may still create

  • Keys for any supported curve, and corresponding
  • Signatures in any supported format

Crucially, the access policy still applies to "Raw MPC", allowing for instance

  • require access rules on the chosen key threshold, or
  • required machine processes approving signature payloads