Governance & security

The Council

Who can change what, how fast, and what is known to be risky. Governance cannot promise one dollar per TRA: there is no reserve to pay it.

Not deployed · Ethereum

No deployment configured

No Foundation deployment is configured for Ethereum (chain 1). Nothing on this page is invented: on-chain values appear only once real contract addresses are configured (see frontend/.env.example). Meanwhile, the Psychohistory Lab shows simulated behaviour, clearly labelled as such.

Permissions by design

Timelock (multisig proposer): parameters within hard bounds (1-day cooldown), oracle sources, module address, un-pausing.
Guardian: can pause expansion or contraction immediately. Cannot unpause, mint, move or burn anything.
ConversionModule: immutable and ownerless; the only minter; burns only with the holder's allowance.
Tokens: no pause, blacklist, fees, rebasing, upgrades or confiscation. TRA has one genesis mint, sent to the LiquidityVault at construction.
LiquidityVault: owned by the timelock; can only open single-sided positions; liquidity and fees are locked until the unlock date, which can be extended but never shortened.

Audits and incidents

Smart-contract audits: None
Economic / mathematical review: None
Hook audit: Hook not deployed
Bug bounty: Not started
Incidents: None recorded

An audited contract is not an economically safe system. Reporting: SECURITY.md. Response plan: docs/INCIDENT_RESPONSE.md.

Known risks

Death spiral	Falling confidence in TRM, more TRM issuance to defend TRA, more selling pressure.
Oracle manipulation	A distorted reference price could mint unjustified amounts; mitigated by median, divergence and staleness checks.
Insufficient liquidity	Published prices may not hold for a meaningful sale; caps follow executable liquidity, not TVL.
MEV and sandwiching	Conversions and swaps can be reordered; every conversion carries minOut and a deadline.
Reentrancy and callbacks	ConversionModule is reentrancy-locked; the hook returns no deltas and holds no tokens.
Accounting errors	Rounding always favours the protocol; supply identity is checked by invariant tests.
Compromised governance	Multisig + timelock; the guardian can only pause; parameters have hard-coded bounds.
Denial of service	Pauses and breakers stop conversions only; tokens stay transferable; the hook fails open.
External dependencies	RPC, indexer, oracle reporters and this frontend can fail; the contracts re-check everything.
Integration errors	Wrong PoolManager or periphery addresses; scripts refuse to deploy a hook without code at the address.

Full threat model: docs/THREAT_MODEL.md.

Launch criteria

Mainnet with real funds requires every item to be signed off. None has been signed off yet.

Economic specification reviewed and versioned
Simulator with reproducible adverse scenarios
Unit, fuzz and invariant tests passing
Hook and permission addresses verified
Independent audits completed and critical findings resolved
Multisig, timelock and incident response operational
Monitoring of prices, issuance, liquidity and anomalies
Legal and trademark review
Public documentation explaining that parity is not guaranteed
Explicit, documented decision to accept the residual economic risk