[paolino]

As discussed in the Discord channel.

Summary

Flip the SundaeSwap V3 order owner-policy embedded into the swap order datum from AllOf (4-of-4 owners) to AtLeast 2 (2-of-4 owners). One-file change in journal/2026/lib/swap_order.sh.

Rationale

Any 2 of the 4 treasury scope owners can already disburse funds out of the treasury at will. Requiring all 4 signatures merely to cancel a pending swap order — and return the locked ADA back to that same treasury — is therefore strictly more restrictive than the disburse permission and creates a denial-of-cancellation risk if any one owner is unavailable. Aligning the swap-cancel policy with the disburse threshold makes cancellation no easier than spending the returned funds, so the change does not weaken control.

Plutus-data shape change

Per the SundaeSwap aicone multisig schema (0=Signature, 1=AllOf, 2=AnyOf, 3=AtLeast, 4=Before, 5=After):

- AllOf [Signature(core_dev), Signature(ops), Signature(network_compliance), Signature(middleware)]
+ AtLeast 2 [Signature(core_dev), Signature(ops), Signature(network_compliance), Signature(middleware)]

In the bash recipe's JSON:

-    "constructor": 1,
-    "fields": [{ "list": [ ...4 owner signatures... ] }]
+    "constructor": 3,
+    "fields": [
+      { "int": 2 },
+      { "list": [ ...4 owner signatures... ] }
+    ]

Scope

• Only swap orders built going forward by this script are affected.
• Past orders already on chain are immutable and keep whatever policy they were created with.
• No other scripts change.

[KtorZ]

https://github.com/SundaeSwap-finance/aicone/blob/769a33046ccd08a4950e8d647f3b0c1fbc01a941/lib/sundae/multisig.ak#L11-L19

pub type MultisigScript {
  Signature { key_hash: ByteArray }                            // variant 0 
  AllOf { scripts: List<MultisigScript> }                      // variant 1
  AnyOf { scripts: List<MultisigScript> }                      // variant 2
  AtLeast { required: Int, scripts: List<MultisigScript> }     // variant 3
  Before { time: Int }
  After { time: Int }
  Script { script_hash: ByteArray }
}

Looks about right.