Roles & Capabilities

What are the roles around a desk?

Three: the maker, the signer, and the operator. The maker is the firm on the venue. The signer is the wallet that acts for it. The operator is CRX's governance key, which approves the firm and never trades.

Role	Who holds it	What it can do	What it cannot do
Maker	an operator-approved firm	take one side of a Master Agreement; hold MAKER on-chain; appear in /makers	grant itself the role; touch another firm's collateral
Signer	a wallet the firm controls	sign in to the relayer; price RFQs; sign Terms (EIP-712); sign the on-chain bind/allocate/deposit	grant roles; override on-chain proof
Operator	CRX governance key (DAO in code)	approve applicants into MAKER/TAKER; whitelist pairs and collateral oracles; set the global CSA, fund, settlement token; ban, terminate, force-close	price a trade; move your collateral against the proof

In prose this third key is "the operator". In Solidity its role constant is named DAO. CRX is a company, not a DAO — the name is a code symbol only.

What can the maker do?

The maker is the firm identity that holds the on-chain MAKER role.

• Take one side of a Master Agreement. Each agreement pairs one MAKER with one TAKER. The maker can hold many agreements at once, each with its own taker, SCA, and Terms.
• Be selected as a counterparty. The relayer folds every MAKER-role holder into GET /makers, so takers can direct RFQs at the desk.
• Set the margin. The maker writes imLongBps/imShortBps into each quote — collateral, per client, never credit.

The maker holds no special power over the protocol. It cannot grant roles, and it cannot reach any collateral other than its own.

What can the signer do?

The signer is the wallet that acts on the maker's behalf.

• Authenticate. POST /auth/challenge → POST /auth/login returns a 1-hour JWT. The signer's wallet signs the challenge.
• Quote. POST /rfq/:id/quote prices an RFQ; POST /rfq/:id/confirm signs the canonical Terms (EIP-712).
• Bind and fund on-chain. The same wallet signs bind, allocate (general → SCA), deposit, and withdraw.

The trade path takes no login: a quote and a bind are authenticated by the two Terms signatures, not by a session. The JWT only gates the relayer's RFQ reads and writes.

A desk may use one wallet as both maker identity and signer, or separate them. Onboarding records the desk against the signing wallet's address; see Configure Desk Roles (~4 min) for separating or rotating them.

What can the operator do?

The operator is CRX's governance key. It admits firms and sets venue-wide parameters. It never trades.

• Approve. It calls approveMaker/approveTaker, moving an applicant from VALIDATION to MAKER or TAKER. On the live venue this is automated: the crx-approver service polls the relayer's GET /firms and grants the role each onboarded desk chose, gas-free.
• Whitelist. It registers tradeable pairs, collateral oracles, the global CSA, the guarantee fund, and the settlement token.
• Govern. It can ban, terminateParty, and forceClose on a legal order. None of these move collateral against the on-chain proof.

The operator cannot move your collateral. Every transfer runs on a validated price and position set, not on the operator's signature. The operator admits and bans; it does not custody.

What is the onboarding status ladder?

Two extra role states sit alongside the live roles. Both are set by the contract, not by you.

State	Meaning	How it is set
VALIDATION	a self-registered applicant; cannot trade yet	by calling register() (permissionless)
DEFAULT	a credit flag: this party was liquidated at least once	stamped by the cascade only; never operator-granted; gates nothing

Next: Liquidity & Quoting (~5 min) — which pairs you price, when, and how big.