docs/security.md's "Known Limitations" #1 states: "There is no multi-sig or time-lock on admin operations." This is no longer accurate. src/admin.rs:721-817 implements create_council_proposal/approve_council_proposal/execute_council_action (referencing "Issue #790" in a code comment), which requires a simple-majority quorum of the admin council to approve a CouncilOperation::RemoveIssuer or CouncilOperation::PauseContract, plus an admin-configurable timelock delay (Storage::get_council_timelock_delay) enforced via Error::TimelockNotReady before execution. The blanket "no multi-sig or time-lock" claim needs to be narrowed to state which specific admin actions (e.g. set_fee, register_issuer, transfer_admin) still bypass the council/timelock path, since two sensitive operations already go through it.
docs/security.md's "Known Limitations" #1 states: "There is no multi-sig or time-lock on admin operations." This is no longer accurate.
src/admin.rs:721-817implementscreate_council_proposal/approve_council_proposal/execute_council_action(referencing "Issue #790" in a code comment), which requires a simple-majority quorum of the admin council to approve aCouncilOperation::RemoveIssuerorCouncilOperation::PauseContract, plus an admin-configurable timelock delay (Storage::get_council_timelock_delay) enforced viaError::TimelockNotReadybefore execution. The blanket "no multi-sig or time-lock" claim needs to be narrowed to state which specific admin actions (e.g.set_fee,register_issuer,transfer_admin) still bypass the council/timelock path, since two sensitive operations already go through it.