Protocol owner

Can — Configure non-custodial parameters that the program exposes.

Cannot — Cannot mint $ASSET, cannot withdraw the backing pool to an arbitrary address.

Treasury

Can — Hold operational funds separate from the backing pool.

Cannot — Cannot access the Asset Backing Pool.

Fee router

Can — Verify eligible creator-fee receipts and forward SOL into the backing pool.

Cannot — Cannot redirect fees to an external destination or hold user funds.

Redemption program

Can — Release the proportional SOL share to eligible wallets atomically — without burning tokens.

Cannot — Cannot pay out more than the caller's proportional share of eligible reserves.

Token authority

Can — Should be revoked at deployment so supply is fixed.

Cannot — Must not retain mint authority; any retained authority is disclosed here.