Governance
Which parameters can change, who can change them, and the emergency pause.
On this page
Governance here means a short list of bounded parameters behind a timelock, not a voting system. Being explicit about that is more useful than implying holders have control they do not have.
This is not a DAO
The protocol interacts with a regulated broker, so someone has to be accountable for that relationship in a way an anonymous vote cannot be. The design response is to shrink the surface that anyone controls at all: most parameters are immutable, the rest are capped in the contract, and every change is visible for 48 hours before it can execute.
In practice the safeguard that matters is not a vote, it is the exit. A queued change is public before it lands, so a holder who dislikes it can leave before it applies.
Adjustable parameters
| Parameter | Current | Bounds | Delay |
|---|---|---|---|
| tradeFeeBps | 3% | 0 to 500 bps (5% hard cap) | 48h |
| hoodAllocationBps | 70% | Floor of 5000 bps (50%) | 48h |
| minPurchaseWei | 0.25 ETH | 0.05 to 5 ETH | 48h |
| conversionSlippageBps | 50 | 10 to 200 bps | 48h |
| priceCollarBps | 300 | 50 to 1000 bps | 48h |
| claimIntervalSeconds | 300 | 300 to 86400 (floor is 5 minutes) | 48h |
| excludedAddresses | Protocol contracts and pools | Append-only | 48h |
| brokerageAdapter | Not set | Single address | 7d |
Bounds are enforced in the contract. A proposal outside them does not fail a vote, it reverts. The claim interval has a floor rather than a ceiling because shortening it towards zero would turn claiming into a gas-griefing surface.
Change process
- Publish. The proposed value, the reason, and the expected effect are posted before anything is queued.
- Queue. The multisig queues the call on the timelock. The transaction is now public with its execution time.
- Wait. 48 hours minimum, 7 days for an adapter rotation. Holders who object exit during this window.
- Execute. Anyone can execute a matured action; the multisig is not required to be the executor.
- Record. The change is appended to the changelog with the transaction hash.
Cancellation
A queued action can be cancelled by the same multisig threshold that queued it. Cancellation is the only privileged action with no delay, because stopping a pending change is never more dangerous than letting it through.
Emergency pause
The pause is narrow on purpose. It halts new purchases and new fee flushes. It does not, and cannot, do any of the following:
- Block claims of already-credited entitlements.
- Move ETH or shares anywhere.
- Alter an accrual index or a stored balance.
- Freeze BANK transfers between holders.
In other words, a pause stops the protocol from acting; it never stops you from withdrawing what you have already earned. Unpausing takes 48 hours, so a pause cannot be used as a momentary lever.
| Trigger | Who can pause | Automatic |
|---|---|---|
| Reserve discrepancy against attestation | Any signer | Yes |
| Adapter reporting anomaly | Any signer | Yes |
| Suspected contract vulnerability | Any 2 signers | No |
| Broker account restriction | Any signer | No |
A single signer can pause. Three are needed to unpause. That ratio reflects which mistake is cheaper to make.
What cannot change
- Total supply. There is no mint and no burn.
- The transfer fee, which is fixed at zero.
- The fee router’s destination set.
- The immutability of the token, distributor and vault — none of them sit behind a proxy.
- Unclaimed entitlements, which no role can reduce or expire.
- The liquidity lock duration.
Disclosure policy
Bad news ships before the explanation. If the reserve is short, the attestation is late, a purchase batch failed repeatedly, or the adapter misreported a fill, the disclosure goes out first and the analysis follows when it exists. The alternative — waiting until the story is tidy — is how a discrepancy becomes a scandal.
Every parameter change, pause, and incident is recorded in the changelog with a transaction hash where one exists.