Hey, thanks for the questions! I’m the Lead Solution Engineer at Babylon Labs, and I’m happy to help answer them
A pause cannot move or release the collateral. While paused, the depositor cannot withdraw or redeem, so the BTC stays locked in the vault and continues to back the Aave debt.
The TBV contracts are governed by two multisigs. Interim Governance is a 4-of-7 Safe whose seats are held by Babylon, OZ21 (Informal Systems), DSRV, Xangle, Hashkey, B14G and Cradle. The Emergency Guardian is a 3-of-5 Safe whose seats are held by Aave Labs, LlamaRisk, Babylon, BedRock and [TBD].
No timelock applies to a pause. Both multisigs can pause and unpause immediately. A pause exists to stop an exploit in progress, and a delayed pause would take effect only after the damage is done. Unpause is immediate for the same reason in reverse: while paused, repayments and liquidations are blocked, so exit paths must reopen as soon as the incident is resolved.
Interim Governance therefore cannot keep the exit paths closed on its own. The Emergency Guardian holds its own unpause right, and Aave Labs and LlamaRisk sit on it. If Interim Governance pauses without a valid incident, or does not lift a pause once the incident is resolved, the Emergency Guardian can unpause without Interim Governance’s approval.
Aave DAO will also receive its own pauser role on the TBV Aave integration contracts (the Aave adapter and its supporting contracts), so it can pause the integration without either Babylon-side multisig if it detects an incident.
On the Aave side, Aave DAO fully controls the Babylon Spoke and the Hubs, including upgardes, params, pause, freeze and unpause. On the BTC Vault Swap Spoke, Aave DAO is the admin with upgrade rights but it’s planned to delegate configuration to the 2-of-3 multisig of Aave Labs, LlamaRisk and Babylon Labs.
Every TBV contract upgrade and configuration change executes only after a 5-day timelock, and the Emergency Guardian can cancel any queued proposal. This gives everyone time to review each change and react before it takes effect.
Final multisig membership and all Safe, timelock and contract addresses will be included in the AIP