Spark Governance

[X Layer] Spark Savings - Add spUSDC to the Savings Vault Intents contract - September 28, 2026 Spark's Operational Facilitator has placed a proposal into the voting system on behalf of nested contributor Phoenix Labs. Review The Spark community can hereby express support or opposition to the following changes: This proposal adds spUSDC to the X Layer Savings Vault Intents contract and makes the spUSDC PAU Administered Agent a relayer on it, giving spUSDC holders on X Layer the same relayer-fulfilled redemption path spUSDT holders already have. Required Context spUSDC is live on X Layer at xlayer:0xf90E63079D97a0A1f479b2b168457F420CAFf6ba. spUSDT was whitelisted on the Savings Vault Intents contract (xlayer:0x5bCD2f30FA1Bf675d5d6E793DAD7DdD487D21865) when that contract was deployed, while the deployer still configured it. The X Layer Spark Executor is now its only admin, so any further vault addition requires a spell. Proposed Actions Executed by the Spark spell through PAYLOAD_XLAYER, as the X Layer Spark Executor: Grant RELAYER on the Savings Vault Intents contract to the spUSDC PAU Administered Agent (xlayer:0x79b4055Eda153f739B5EA63C9B647c1a095059f5). The ALM Relayer Multisig keeps its existing RELAYER role. The agent's actors are the ALM Relayer Multisig and an EOA (xlayer:0x062cE42caE04c51D04E77e3D64cc8953a2296FfE); after this grant either actor can fulfil intents through the agent. The EOA is flagged as holding a privileged role; the most it can do on the intents contract is fulfil a holder's own request, as requested, before its deadline. Whitelist spUSDC on the Savings Vault Intents contract with bounds matching spUSDT: - minIntentAssets: 1,000,000 USDC - maxIntentAssets: 500,000,000 USDC Neither call moves funds or touches the vault or any ALM Proxy. fulfill() can only redeem the exact shares a holder requested, to the recipient the holder chose. The spUSDT configuration is unchanged. --- Technical implementation details can be found under item 4 at Proposed Actions in the October 8, 2026 Spell Technical Scope forum post. The required Spark Artifact changes can be found in the following pull request: https://github.com/sky-ecosystem/next-gen-atlas/pull/348 Outcomes If "For" receives more than 50% of votes cast, excluding abstentions, the proposal will be approved. The associated pull request will be merged into Spark's Artifact once the Executive Vote that contains this proposal is approved. When required, the listed changes will proceed to implementation by the relevant actors. If "Against" receives the most votes, the proposal will be rejected. No changes will be implemented.

[Arbitrum] Spark Liquidity Layer - Transfer Beacon admin to the Sky governance relay - September 28, 2026 Spark's Operational Facilitator has placed a proposal into the voting system on behalf of nested contributor Phoenix Labs. Review The Spark community can hereby express support or opposition to the following changes: This proposal transfers admin of the Arbitrum Diamond PAU Beacon from the Arbitrum Spark Executor to the Sky governance relay on Arbitrum, placing the Beacon under Sky governance. It acts on the same new Arbitrum Diamond PAU stack as the separate polls for the Diamond PAU parallel controller with CCTP V2 and the PAS Configurator authorization, and should be read together with them. Required Context The Beacon (arb:0x86036CE5d2f792367C0AA43164e688d13c5A60A8) is the canonical registry of which facet belongs to each integration. DEFAULTADMINROLE on the Beacon gates setIntegration and removeIntegration. The Arbitrum Spark Executor is currently its only holder. After this change, registering a new integration for Spark's Arbitrum controller becomes a Sky governance action. Spark can still pull an integration the Beacon already carries into its own controller with updateIntegrations, but cannot add a new one to the Beacon. Spark keeps admin of its own access controls and rate limits. The CCTP facet used by the Diamond PAU parallel controller is already registered and synced, so that item does not depend on the Beacon after this transfer. Proposed Actions Executed by the Spark spell through PAYLOAD_ARBITRUM, as the Arbitrum Spark Executor, in this order: Grant DEFAULTADMINROLE on the Beacon to the Sky governance relay on Arbitrum (arb:0x10E6593CDda8c58a1d0f14C5164B376352a55f2F), controlled by Sky governance through the L1 governance relay (eth:0x9ba25c289e351779E0D481Ba37489317c34A899d). Revoke DEFAULTADMINROLE on the Beacon from the Arbitrum Spark Executor (arb:0x65d946e533748A998B1f0E430803e39A6388f7a1). The grant comes first so that the Beacon is never left without an admin, which could not be recovered. The transfer cannot be undone without Sky governance acting. Pre-requirements Sky, through Pullup Labs, must publicly confirm (for example in a forum post or the Atlas) the Sky governance relay as the intended admin of the Arbitrum Beacon before the payload is finalised for review. The grantee is a compile-time constant, currently a zero-address placeholder in the payload. --- Technical implementation details can be found under item 6 at Proposed Actions in the October 8, 2026 Spell Technical Scope forum post. The required Spark Artifact changes can be found in the following pull request: https://github.com/sky-ecosystem/next-gen-atlas/pull/350 Outcomes If "For" receives more than 50% of votes cast, excluding abstentions, the proposal will be approved. The associated pull request will be merged into Spark's Artifact once the Executive Vote that contains this proposal is approved. When required, the listed changes will proceed to implementation by the relevant actors. If "Against" receives the most votes, the proposal will be rejected. No changes will be implemented.

[Arbitrum] Spark Liquidity Layer - Return excess USDS to Ethereum - September 28, 2026 Spark's Operational Facilitator has placed a proposal into the voting system on behalf of nested contributor Phoenix Labs. Review The Spark community can hereby express support or opposition to the following changes: This proposal returns idle USDS from Arbitrum to the Ethereum ALM Proxy, where it can be deployed. Together with the concurrent poll to bridge sUSDS to Arbitrum, it is one rebalancing of Arbitrum inventory in opposite directions, replacing an asset with no demand on the chain with one that is being consumed. Required Context USDS on Arbitrum is idle and almost entirely Spark's own. Of 99,766,514 USDS on the chain, Spark's ALM Proxy and PSM3 hold 99,326,628 and external holders about 440,000. Arbitrum demand is for sUSDS, not USDS. The proposal returns all but a 1,000,000 USDS float in PSM3, 98,326,628.11 USDS at the read block. The 1,000,000 USDS floor is a Phoenix Labs commercial decision. No rate limit governs this leg. The Sky Arbitrum token gateway sits outside the spark-alm-controller rate-limit framework, and ForeignController v1.8.0 has no function that calls it. The spell therefore reaches the ALM Proxy through a CONTROLLER role that the Arbitrum Spark Executor grants to itself, uses and revokes in the same transaction. This follows the pattern the June 18, 2026 and July 2, 2026 spells used to remove excess liquidity from Base, Optimism and Unichain. The size of the withdrawal is a governance decision rather than a parameter constraint. Proposed Actions Before execution (Phoenix Labs, not blocking): the ALM Relayer Multisig (arb:0x8a25A24EDE9482C4Fc0738F99611BE58F1c839AB) withdraws PSM3's USDS above the 1,000,000 USDS floor into the Arbitrum ALM Proxy with withdrawPSM on the legacy ALM Controller, within the existing unlimited USDS withdraw rate limit. If this has not happened, the spell moves only the ALM Proxy's own USDS, and PSM3's excess can be withdrawn and bridged later. Spark spell (PAYLOAD_ARBITRUM, as the Arbitrum Spark Executor): grant CONTROLLER on the Arbitrum ALM Proxy (arb:0x92afd6F2385a90e44da3a8B60fe36f6cBe1D8709) to the Executor, approve the Sky Arbitrum L2 token gateway (arb:0x13F7F24CA959359a4D710D32c715D4bce273C793) and call outboundTransfer for the ALM Proxy's entire USDS balance at execution to the Ethereum ALM Proxy (eth:0x1601843c5E9bC251A3272907010AFa41Fa18347E), then revoke the role in the same transaction. At the read block that is 90,000,000 USDS held by the ALM Proxy plus 8,326,628.11 USDS from PSM3, 98,326,628.11 USDS; the actual figure is whatever the ALM Proxy holds when the payload executes. Finalisation (outside the spell): after the Arbitrum challenge period of about seven days, Phoenix Labs executes the outbox proof on Ethereum, which releases the USDS from the Sky Arbitrum escrow to the Ethereum ALM Proxy. This step is permissionless. The escrow holds 99,816,977.997 USDS, which covers the release. After execution, PSM3 should hold at least 1,000,000 USDS and the Arbitrum Executor should not hold CONTROLLER on the ALM Proxy. --- Technical implementation details can be found under item 3 at Proposed Actions in the October 8, 2026 Spell Technical Scope forum post. Outcomes If "For" receives more than 50% of votes cast, excluding abstentions, the proposal will be approved. When required, the listed changes will proceed to implementation by the relevant actors. If "Against" receives the most votes, the proposal will be rejected. No changes will be implemented.

[Arbitrum] Spark Liquidity Layer - Authorize the PAS Configurator on the Diamond PAU - September 28, 2026 Spark's Operational Facilitator has placed a proposal into the voting system on behalf of nested contributor Phoenix Labs. Review The Spark community can hereby express support or opposition to the following changes: This proposal grants the PAS Configurator admin over the Arbitrum Diamond PAU access controls and rate limits, bringing the Parallelized Allocation System into service on the Arbitrum Diamond PAU. It acts on the same new Arbitrum Diamond PAU stack as the concurrent polls for the Diamond PAU parallel controller with CCTP V2 and the Beacon admin transfer, and should be read together with them. Required Context Today the Arbitrum Spark Executor is the sole admin of the Diamond PAU Beacon, access controls and rate limits. After this change, the PAS Configurator also holds admin over the access controls and the rate limits, operated by an accordant cBEAM within bounds set by Sky Core Council. This allows rate limits and pre-approved controller actions, including disabling the CCTP facet during an incident, to be managed without a spell each time. PAS is an integral part of the Diamond PAU architecture. Spark keeps admin of its own access controls and rate limits, and Spark governance can revoke either grant in one call. Proposed Actions Executed by the Spark spell through PAYLOAD_ARBITRUM, as the Arbitrum Spark Executor (the body of PASAuthorizeInPAU.authorize in sky-ecosystem/pas): Grant DEFAULTADMINROLE on the PAU Access Controls (arb:0x8386f819860D54B1180539Ff4852E4CAECef8A1D) to the PAS Configurator. The access controls gate every facet admin setter and every controller admin function. Grant DEFAULTADMINROLE on the PAU Rate Limits (arb:0x4824C4336a1a11979068A544958dCe5D49B42752) to the PAS Configurator. The rate limits gate setRateLimitData. The PAS Configurator is not yet deployed on Arbitrum; the payload currently carries a zero-address placeholder. What This Enables DEFAULTADMINROLE would itself allow granting and revoking any role on each contract, but the Configurator can use it only through two functions, each callable only by an accordant cBEAM within bounds held in PAS BeamState: setRateLimit: Set a rate limit, raising it to no more than the higher of its current value multiplied by maxChange and its registered default, and only once hop has passed since its last raise; lowering is immediate (Atlas A.2.2.10.1.1.1.2.4.4.1, Atlas A.2.2.10.1.1.1.2.4.1.2.1). A key that already reads as unlimited is locked there and cannot be lowered by the cBEAM (Atlas A.2.2.10.1.1.1.2.4.1.3). callControllerAction: Execute a call only if its exact calldata has been pre-approved by Core Council for a target Core Council has registered. This is the path for disabling the CCTP facet with removeIntegrations during an incident. The Configurator has no function to set a relayer or freezer or to grant a role directly; any such change would have to be one of the pre-approved calls. The grant is only as narrow as the PAS parameters, registered inits, pre-approved controller actions and cBEAM holder make it, and none of these has yet been published for this PAU. For the Ethereum PAS, the Atlas sets hop at 16 hours (Atlas A.2.2.10.1.1.1.2.4.1.1.2), maxChange at 1.20, a maximum 20% increase per step (Atlas A.2.2.10.1.1.1.2.4.1.2.2). Whether these apply to the Arbitrum PAS is to be confirmed. The Arbitrum Timelock is deployed paused. Pre-requirements Sidestream must deploy PAS (BeamState, Configurator and Timelock) on Arbitrum through PASFactory in one transaction. The Configurator address must be fixed in the payload before it is finalised for review, since grantRole accepts the zero address, and the full deployment record with role checks must be published before handover. Spark deploys, initialises and configures no PAS contract in this spell. Before the final review of the payload, the Core Council Risk Advisor must recommend hop and maxChange for this PAU (the Ethereum PAS defaults are 16 hours and 1.20), and the Core Council must publish the init rate limits, permitted controller actions and cBEAM holder, as the Atlas records for the Grove and Osero Diamond PAUs A.2.2.10.1.1.1.2.4.2. The Timelock is deployed paused. Before execution, the published configuration must be in place in PAS on Arbitrum (set through the PASFactory deployment), and Phoenix Labs must check the on-chain state against it. --- Technical implementation details can be found under item 5 at Proposed Actions in the October 8, 2026 Spell Technical Scope forum post. The required Spark Artifact changes can be found in the following pull request: https://github.com/sky-ecosystem/next-gen-atlas/pull/349 Outcomes If "For" receives more than 50% of votes cast, excluding abstentions, the proposal will be approved. The associated pull request will be merged into Spark's Artifact once the Executive Vote that contains this proposal is approved. When required, the listed changes will proceed to implementation by the relevant actors. If "Against" receives the most votes, the proposal will be rejected. No changes will be implemented.

[Arbitrum] Spark Liquidity Layer - Bridge sUSDS to Arbitrum - September 28, 2026 Spark's Operational Facilitator has placed a proposal into the voting system on behalf of nested contributor Phoenix Labs. Review The Spark community can hereby express support or opposition to the following changes: This proposal bridges sUSDS from the Ethereum ALM Proxy to the Arbitrum ALM Proxy to replenish the inventory the Arbitrum PSM3 sells. Together with the concurrent poll to return excess USDS to Ethereum, it is one rebalancing of Arbitrum inventory in opposite directions. Required Context Arbitrum demand is for sUSDS, not USDS. PSM3's sUSDS balance fell from 60,126,297.04 on 2026-09-14 to 50,365,339.61 on 2026-09-24, a net 9,760,957.43 sUSDS paid out through swaps, or about 1 million sUSDS a day. Demand has been far higher at times: the largest single day of net sUSDS outflow was 17.52 million (2026-08-27), and the largest seven-day run 33.74 million (2026-09-03 to 2026-09-09, 4.82 million a day). Why this amount. A top-up can only come through a spell, and the cycle from pre-submission to execution takes at least four weeks, often up to six. At the peak seven-day rate of 4.82 million sUSDS a day, four weeks is about 135 million sUSDS. PSM3's 50,365,339.61 sUSDS plus this 100,000,000 gives about 150.4 million, roughly 31 days at that rate. The amount is sized so that a sustained return to peak demand, or further demand growth on Arbitrum, does not exhaust PSM3 before the next spell can replenish it. No rate limit governs either bridge leg. The Sky Arbitrum token gateway sits outside the spark-alm-controller rate-limit framework, and MainnetController v1.10.0 has no function that calls it. The spell therefore reaches the ALM Proxy through a CONTROLLER role that the Spark SubDAO Proxy grants to itself, uses and revokes in the same call, using an existing helper in the base payload. This is the same class of admin authority over an ALM Proxy used in the June 18, 2026 and July 2, 2026 spells to remove excess liquidity. The size of the transfer is a governance decision rather than a parameter constraint. Proposed Actions Executed by the Spark spell's Ethereum payload, as the Spark SubProxy (eth:0x3300f198988e4C9C63F75dF86De36421f06af8c4): Transfer 100,000,000 sUSDS (in share units; about 111,054,786 USDS of value at the read block) from the Ethereum ALM Proxy (eth:0x1601843c5E9bC251A3272907010AFa41Fa18347E) to the Spark SubProxy, granting and revoking CONTROLLER on the ALM Proxy in the same call. The Ethereum ALM Proxy holds 647,228,286.94 sUSDS. No USDS is minted. Bridge the sUSDS through the Sky Arbitrum token gateway (eth:0x84b9700E28B23F873b82c1BEb23d86C091b6079E) with the Arbitrum ALM Proxy (arb:0x92afd6F2385a90e44da3a8B60fe36f6cBe1D8709) as recipient. The retryable ticket is funded from the Spark SubProxy's ETH balance (about 0.05 ETH plus the submission fee). After arrival, the sUSDS is available for the relayer to deposit into PSM3. If the retryable ticket does not auto-redeem, it is redeemed manually within the retryable lifetime. --- Technical implementation details can be found under item 2 at Proposed Actions in the October 8, 2026 Spell Technical Scope forum post. Outcomes If "For" receives more than 50% of votes cast, excluding abstentions, the proposal will be approved. When required, the listed changes will proceed to implementation by the relevant actors. If "Against" receives the most votes, the proposal will be rejected. No changes will be implemented.

[Arbitrum] Spark Liquidity Layer - Diamond PAU Parallel Controller with CCTP V2 - September 28, 2026 Spark's Operational Facilitator has placed a proposal into the voting system on behalf of nested contributor Phoenix Labs. Review The Spark community can hereby express support or opposition to the following changes: This proposal brings the Diamond PAU parallel controller into service on the existing Arbitrum ALM Proxy and opens a CCTP V2 USDC route from the Arbitrum ALM Proxy to the Ethereum ALM Proxy. It acts on the same new Arbitrum Diamond PAU stack as the concurrent polls to authorize the PAS Configurator on the Diamond PAU and to transfer Beacon admin to the Sky governance relay, and should be read together with them. Required Context Circle is phasing out CCTP V1. Burn limits are reduced from 2026-10-31 and the V1 contracts are paused on 2026-12-01. Every Spark CCTP route runs on V1 today. Opening a V2 route on Arbitrum now leaves room to migrate volume before V1 burn limits tighten, and brings the Diamond PAU architecture into production on an existing deployment with a single, bounded integration. What is new. A Diamond PAU Controller (arb:0x04ACB9e9bbd64A425677edC535D6B30cfD74E42f), diamond-pau v1.14.0, with one integration, the CCTP V2 facet, was deployed on Arbitrum on 2026-09-18 alongside the existing ForeignController v1.8.0. After this spell both controllers hold CONTROLLER on the same existing Arbitrum ALM Proxy (arb:0x92afd6F2385a90e44da3a8B60fe36f6cBe1D8709). The Beacon registration, the integration sync and the allocator grant were completed at deployment and are not repeated in the spell. Until this spell executes, cctp_transfer reverts on the zero rate limit and the PAU Controller cannot call the ALM Proxy. Why a parallel controller rather than a new proxy. A segregated proxy would require moving the Arbitrum Spark Liquidity Layer's assets into it and would strand the legacy integrations behind a proxy that no longer holds the funds. The parallel arrangement lets both controllers run side by side while volume migrates from CCTP V1 to V2, and governance can revoke either controller's role in a single call. What the new controller can do. Its fallback dispatches only selectors synced from the Beacon. With only the CCTP facet wired, the one fund-moving action available is a CCTP V2 burn of USDC from the Arbitrum ALM Proxy, minted to the Ethereum ALM Proxy, bounded by the rate limits below. The legacy CCTP V1 route (50,000,000 USDC maxAmount, 25,000,000 USDC per day slope, aggregate V1 key unlimited) is unchanged, so outbound CCTP authority from Arbitrum to Ethereum becomes the V1 route plus the V2 route: 55,000,000 USDC of combined maximum amount. Risks and audits. The contracts were deployed at audited commits of diamond-pau (ChainSecurity, Cantina, Certora, Octane and Unvariant) and pau-administered-agent v1.0.0 (ChainSecurity and Cantina). ChainSecurity v1.13.0 finding CS-SKYDPAU-044, "Reentrancy Guard Is per-Controller While the ALMProxy Is Shared" (Design, Low, risk accepted), applies to controllers sharing one proxy. Granting CONTROLLER gives the PAU Controller authority over the full value held by the Arbitrum ALM Proxy. Proposed Actions Executed by the Spark spell through PAYLOAD_ARBITRUM, as the Arbitrum Spark Executor: Grant the PAU Controller CONTROLLER on the Arbitrum ALM Proxy. The legacy ForeignController keeps its role. Reconfigure the PAU Administered Agent (arb:0x0745aae633E8318a063D383791bCc0d8C82F46C6), the sole allocator on the PAU Controller: - Add a Soter Labs freezer multisig as a second revoker, alongside the ALM Freezer Multisig. - Add a Soter Labs grantor multisig as grantor and remove the PAU Grantor Multisig (arb:0x4B61A0E48dd1e300f64090C60F414c1aC6CbC514). - Add a Spark hot wallet as a second actor, alongside the ALM Relayer Multisig. Actors can call cctp_transfer through the agent within the V2 rate limits, to the Ethereum ALM Proxy only. Flagged by the proposer: if the hot wallet is an EOA, a single key reaches the V2 route. Set the CCTP V2 rate limits on the PAU Rate Limits: - Aggregate CCTP rate limit: unlimited, matching the aggregate key on the legacy stack. - Arbitrum to Ethereum rate limit: - maxAmount: 5,000,000 USDC - slope: 50,000,000 USDC / day Set the CCTP domain parameters for Ethereum (domain 0): recipient is the Ethereum ALM Proxy (eth:0x1601843c5E9bC251A3272907010AFa41Fa18347E), with minFeeCapRate and maxFeeCapRate both 0. Standard-finality CCTP V2 transfers carry no fee today; if Circle introduces a minimum fee, transfers revert until a later spell widens the cap. The rate limits are below the 10,000,000 USDC maximum and 100,000,000 USDC per day in the pre-submission, and the 5,000,000 USDC maximum is within Circle's 10,000,000 USDC per-message burn limit. Pre-requirements Cantina's first-principles review of the Arbitrum deployment and the parallel controller architecture must approve before handover. spark-address-registry#115 must be merged before the payload is finalised for review, and the deployment checklist must be published before handover. Soter Labs must confirm its freezer and grantor multisig addresses, wallet types, thresholds and signers, and Phoenix Labs must confirm the Spark hot wallet address and wallet type, before the payload is finalised for review. The payload currently carries the deployer EOA as a placeholder for all three. The Core Council Risk Advisor must confirm the CCTP V2 rate limits, or propose different ones, before the payload is finalised for review. --- Technical implementation details can be found under item 1 at Proposed Actions in the October 8, 2026 Spell Technical Scope forum post. The required Spark Artifact changes can be found in the following pull request: https://github.com/sky-ecosystem/next-gen-atlas/pull/347 Outcomes If "For" receives more than 50% of votes cast, excluding abstentions, the proposal will be approved. The associated pull request will be merged into Spark's Artifact once the Executive Vote that contains this proposal is approved. When required, the listed changes will proceed to implementation by the relevant actors. If "Against" receives the most votes, the proposal will be rejected. No changes will be implemented.