Architecture
Goat Street is seven contracts with a single direction of dependency. Nothing is upgradeable, and no component can be swapped without an explicit, observable transaction.
The registry reports weight changes to the engine as they happen, which is why a distribution never
has to walk the holder set — it costs the same at sixty holders as at six thousand.
Two components are minimal proxies: the collection itself, and every goat’s wallet. A minimal proxy
points at one implementation and cannot be made to point at another, so this changes nothing about
“nothing is upgradeable”.
Custody
The protocol never holds an NFT
The collection is touched through
ownerOf and nothing else. There is no code path that could
take possession.No approval to grant
Registration requires no allowance on the collection. A holder who registers has given the
protocol nothing it could misuse.
Rewards are pulled, not pushed
Value is credited to a ledger. A failed transfer never destroys a claim; it defers it.
Everyday recovery cannot reach holder funds
The routine recovery paths are bounded by what is not already owed. Credited rewards are outside
their reach by construction.
Administrative powers
Deliberately narrow — but read this first.Every power below is currently held by a single externally-owned account, not a multisig:
0xF3fcC8E2cb2b1d18932d6065fdbEc1E27483ECD7. Handing these to a multisig or a timelock is a
post-launch step. Until it happens, the bounds below describe what the key may do, not how many
people must agree before it does.
Nothing here can mint an NFT or move one. Registration can be paused, which stops new weight
arriving without touching existing weight.
The emergency hatch
There is one owner-only path that can move credited assets, and it is deliberate. It exists because an audit found several ways for value to become permanently stuck, and a system with no way out of the next one is more brittle rather than safer. It is bounded by notice rather than by amount. The exact asset, destination and amount must be announced on-chain 24 hours before it can execute, and the authority expires 48 hours after that — so an announcement nobody executes becomes dead rather than standing indefinitely. Holders get a full day to collect first.That notice is not a bound on what the owner can reach. It is the price of the announced
path only. The owner also configures the swap venue and the price floors, and those take effect
immediately — so an owner willing to abuse the position does not need the hatch and does not have
to wait. The real protection is who holds the key. It should be a timelock, and until it is, this
is a trust assumption rather than a mechanism.
If the engine is ever replaced
This is the one administrative action a holder would notice, so it is worth knowing what it looks like from the outside. Your level is untouched — levels live in the registry, which is not replaced. Your existing credit is not stranded — the outgoing engine keeps whatever it already owes you and keeps paying it. What changes is the withdrawal clock: the new engine learns your weight by being told it, which reads as a fresh increase, so the four-hour lock restarts for everybody at once. Nothing is lost.One case is not covered by that. A position cleared before a migration and re-registered after it
is recognised only by the new engine, so the predecessor’s credit can never be delivered to
it. If your position is cleared while a migration is announced, re-register before the switch,
not after.
Keeping it running
Three things need somebody to do them, and none of them needs any privilege — they are open to anyone, and whoever does them holds no role on any contract and needs only gas.Holders never have to wait for a keeper. Delivering is open to anyone, so you can push your own
NFT’s rewards into its wallet whenever you like — the app does it in one click.
Assurance
The audit record, including every finding and the reasoning behind each accepted risk, is maintained
alongside the source.
Network
Every deployed address is listed on Contracts and verified on the block
explorer. Check any address you are about to interact with against that page and against the
explorer itself — never against a link somebody sent you.