XVSStore
XVSStore holds reward tokens and transfers them on behalf of its configured owner, normally an XVS Vault. It is a non-proxy contract with separate admin and owner roles.
Roles and API
Section titled “Roles and API”| Function | Caller requirement | Effect |
|---|---|---|
safeRewardTransfer(address,address,uint256) | Owner | Transfers an active reward token, capped by the store’s available balance |
setPendingAdmin(address) | Admin | Starts an admin transfer |
acceptAdmin() | Pending admin | Accepts the admin role |
setNewOwner(address) | Admin | Replaces the owner that can distribute or withdraw rewards |
setRewardToken(address,bool) | Admin or owner | Enables or disables a reward token |
emergencyRewardWithdraw(address,uint256) | Owner | Withdraws a reward token from the store |
The owner can therefore both distribute active rewards and change which tokens are active. The admin can replace the owner. Permission reviews must account for both roles rather than treating the vault as the only privileged actor.