Roles

Ripstr has fewer privileged roles than most protocols, and the privileged ones are narrower than you might expect. Here is everyone who can do anything, and the exact limit of what they can do.

Depositor

The only party who can move a position's NFT or backing. Ever.

• ✦Lists an NFT with backing, raises or shrinks that backing, and withdraws the position.
• ✦Claims fee earnings and $RIP emissions accrued during the position's tenure.
• ✦After the purchaser's 24-hour window lapses, may resolve an allocated position themselves.

No other role — including any administrator — has an instruction capable of moving a depositor's NFT, backing, or credited balance.

Purchaser

• ✦Requests acquisitions, with their own price and slippage bounds attached.
• ✦Chooses one of the four settlement outcomes during the 24-hour exclusive window.
• ✦Claims epoch-based $RIP rewards and spends any accrued $RIP buy allowance.
• ✦Pulls refund credits from acquisitions that did not settle.

Pool admin

Each pool has its own admin, set at creation. Their power is limited to configuration and lifecycle:

• ✦Change that pool's parameters within their allowed ranges.
• ✦Turn acquisitions on (ending the loading phase) or off.
• ✦Trigger an emergency halt, or move the pool into withdraw-only mode.
• ✦Curate the collection whitelist, or delegate that to a whitelist manager.

They cannot withdraw or seize positions, cannot redirect credited earnings, and cannot influence randomness or selection.

Protocol admin

The admin of the genesis pool, which is also the protocol-wide reference for pool creation: the pool-creation fee, the payout address, and the free-creation check all read off that pool's configuration. Beyond that they are a pool admin like any other, plus administrative control of the $RIP claim program's merkle root and rescue path.

Whitelist manager

An optional, separately configurable address that may add or remove collections on a pool. It exists so curation can be delegated without handing over the pool's configuration. It confers nothing else.

Pool creator

Whoever paid to create a pool permissionlessly. The creator role is purely economic: it accrues 40% of that pool's protocol fee take and is pull-withdrawable by the creator. It carries no configuration authority — that belongs to whichever address was named as the new pool's admin at creation, which may or may not be the same person. See Create a pool.

Anyone

A surprising amount of the protocol is open to any wallet, by design:

• ✦Advance the acquisition queue. Processing is permissionless.
• ✦Expire a timed-out request, which refunds it and unblocks the requests behind it.
• ✦Finalize a stale settlement once the 7-day window has passed.
• ✦Trigger a $RIP buyback, and collect the 0.5% SOL bounty for it.
• ✦Trigger the protocol fee payout to the payout address.
• ✦Create a pool, for 20 SOL plus the equivalent in $RIP.

An operator runs a sponsored processing route so pulls advance without users thinking about it — but it holds no special privilege. It cannot supply randomness, choose an outcome, or skip an earlier request in the queue.