Permissions

Mog’s contracts enforce every permission. No server can grant a permission or take one away.

Your keys

Action	Wallet (root)	Session key
Place, cancel, close, top up	Yes	Yes
Name a builder on an order	Yes, but not the account or any live session key of it	Yes, but not the account or any live session key of it
Withdraw	Yes	No
Grant or revoke session keys	Yes	No
Give up a queued claim	Yes	No
Mark its own unused nonces spent	Yes	Yes

A session key expires. At launch it lasts at most 7 days. A revoked key cannot be granted again.

Anyone

Anyone may send these calls. Each one pays the rightful party or advances shared state. None of them pays the caller.

Call	Effect
Deliver a signed instruction	Applies the signer’s order, cancel, close or top-up. The signature decides; the sender does not.
Deposit	Adds the sender’s own USDG to an account
Collect for an account	Pays that account’s settled claims into its own balance
Pay a builder	Pays that builder’s earnings into its own balance. Only while the venue is not paused and every market is at rest.
Distribute	Pays the buyback and operations allocations to their payee addresses, which governance sets under the 24-hour delay. Only while the venue is not paused and every market is at rest.
Void pending orders	On a paused or delisted market, voids pending orders and refunds their collateral and open fee to each owner
Apply prices	Settles a market up to its latest posted prices
Post prices	Accepted only with the market’s oracle signature
Record a builder balance	Records the sender’s own MOG balance
Sweep a deposit address	Moves USDG from an account’s deposit address into that account

Mog’s roles

Role	Can	Cannot
Oracle signer	Sign the prices for its markets	Send funds, change settings
Guardian	Pause one market or the whole venue, and cancel a queued governance action	Stop withdrawals, deposits, collections, cancels, closes or price posting
Governance, immediately	Change a market’s risk settings: close-curve width, liquidation buffer, leverage limits, pace, side cap, and the drift and volatility charges. Change the curve exponent, the fade time and the mint fade time. Replace a market’s oracle signer. The drift and volatility charges, the side cap and the fade time apply to open positions from the next price update, so they change what open positions are paid.	Change fees, payees or code
Governance, after a 24-hour delay	Change fees and payees, change session-key lifetime, delist a market, upgrade the contracts	Act before the delay ends
Lister	List a new market. A new market opens paused.	Change an existing market

A pause stops new orders, top-ups and fills on its market, or on every market for a venue-wide pause. Pending orders on a paused market can be voided by anyone, with a refund. A venue-wide pause also stops builder payments, distributions and giving up queued claims. A pause never stops a trader from cancelling, closing or withdrawing. See Risk for what these roles mean for your funds.

Rate limits on the public endpoints

The public endpoints limit requests by address. Limits can change without notice while this page is in testing. A refusal returns HTTP 429 with Retry-After. See Errors.

Endpoint	Limit per address	Notes
Relay, POST /submit	120 instructions a minute	Each instruction in a batch counts. Each signer also has its own limit of 60 instructions a minute.
Info endpoint, POST /indexer/info	3,000 cost a minute	Each type costs by what it reads: one record 1, one account’s list 5, and a scan across all accounts 20. Writes such as profileSet and follow cost 20.
Stream, /indexer/ws	16 open connections

An IPv6 caller counts by its /48 prefix at the relay. Callers behind one shared address, such as an office network, share its limits. One mog algo run --every 1s spends about 600 info cost a minute, so several runs fit behind one address.