Architecture
Goat Street is seven contracts with a single direction of dependency. Nothing is upgradeable, and no component can be swapped without an explicit, observable transaction.
The registry reports weight changes to the engine as they happen, which is why a distribution never
has to walk the holder set — it costs the same at sixty holders as at six thousand.
Two components are minimal proxies: the collection itself, and every goat’s wallet. A minimal proxy
points at one implementation and cannot be made to point at another, so this changes nothing about
“nothing is upgradeable”.
Custody
The protocol never holds an NFT
The collection is touched through
ownerOf and nothing else. There is no code path that could
take possession.No approval to grant
Registration requires no allowance on the collection. A holder who registers has given the
protocol nothing it could misuse.
Rewards are pulled, not pushed
Value is credited to a ledger. A failed transfer never destroys a claim; it defers it.
Everyday recovery cannot reach holder funds
The routine recovery paths are bounded by what is not already owed. Credited rewards are outside
their reach by construction.
Administrative powers
Deliberately narrow — but read this first.
Nothing here can mint an NFT or move one. Registration can be paused, which stops new weight
arriving without touching existing weight.
The emergency hatch
There is one owner-only path that can move credited assets, and it is deliberate. It exists because an audit found several ways for value to become permanently stuck, and a system with no way out of the next one is more brittle rather than safer. It is bounded by notice rather than by amount. The exact asset, destination and amount must be announced on-chain 24 hours before it can execute, and the authority expires 48 hours after that — so an announcement nobody executes becomes dead rather than standing indefinitely. Holders get a full day to collect first.If the engine is ever replaced
This is the one administrative action a holder would notice, so it is worth knowing what it looks like from the outside. Your level is untouched — levels live in the registry, which is not replaced. Your existing credit is not stranded — the outgoing engine keeps whatever it already owes you and keeps paying it. What changes is the withdrawal clock: the new engine learns your weight by being told it, which reads as a fresh increase, so the four-hour lock restarts for everybody at once. Nothing is lost.Keeping it running
Three things need somebody to do them, and none of them needs any privilege — they are open to anyone, and whoever does them holds no role on any contract and needs only gas.Holders never have to wait for a keeper. Delivering is open to anyone, so you can push your own
NFT’s rewards into its wallet whenever you like — the app does it in one click.
Assurance
The audit record, including every finding and the reasoning behind each accepted risk, is maintained
alongside the source.