> ## Documentation Index > Fetch the complete documentation index at: https://docs.cashmere.exchange/llms.txt > Use this file to discover all available pages before exploring further. # Operations > How the pieces fit together, what the operators can and cannot do, and how the code was tested. ## Architecture Goat Street is seven contracts with a single direction of dependency. **Nothing is upgradeable**, and no component can be swapped without an explicit, observable transaction. | Contract | Responsibility | | ------------------------------------- | ---------------------------------------------------------------------------------------- | | `GoatSoftStake` | The registry. Positions, rarity, weight, entry pricing and the tenure clock | | `GoatDistributor` | The engine. Payout choices, royalty conversion, the credit ledger and delivery | | `ERC6551Registry` + `Goat6551Account` | The wallet each NFT owns. Control moves with the NFT | | `GoatSwapRouter` | Buys the chosen assets directly from Uniswap V3 pools, each verified against the factory | | `GoatPriceFloor` | Derives each swap's minimum from Chainlink marks rather than a hand-set number | The registry reports weight changes to the engine as they happen, which is why a distribution never has to walk the holder set — it costs the same at sixty holders as at six thousand. Two components are minimal proxies: the collection itself, and every goat's wallet. A minimal proxy points at one implementation and cannot be made to point at another, so this changes nothing about "nothing is upgradeable". ## Custody The collection is touched through `ownerOf` and nothing else. There is no code path that could take possession. Registration requires no allowance on the collection. A holder who registers has given the protocol nothing it could misuse. Value is credited to a ledger. A failed transfer never destroys a claim; it defers it. The routine recovery paths are bounded by what is not already owed. Credited rewards are outside their reach by construction. ## Administrative powers Deliberately narrow — but read this first. **Every power below is currently held by a single externally-owned account**, not a multisig: `0xF3fcC8E2cb2b1d18932d6065fdbEc1E27483ECD7`. Handing these to a multisig or a timelock is a post-launch step. Until it happens, the bounds below describe what the key *may* do, not how many people must agree before it does. | Power | Bound | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Rarity table | Sealed permanently, and refused once any position exists | | Level schedule | Fixed in code. No setter, no owner, identical for every NFT | | Entry price | Base and slope fixed in code. Only the ceiling can move, and it is hard-capped at 5 ETH | | Entry-fee split | A constant: half to the reward pot, half to the treasury, with no setter | | Treasury address | Repointable by the owner; the ratio above is not | | Asset menu | Capped at 16 entries, each of which must be a contract | | Swap routes | Each pool is checked against the Uniswap V3 factory and the pair it claims to hold | | Price floors | A manual floor cannot be set below a configured fraction of the oracle mark | | Royalty split | **Not a contract.** Configured in the marketplace's creator-earnings panel and changeable there | | Emergency withdrawal | Only for an announced asset, destination and amount; only 24 hours after the announcement; only within the 48 hours after that; only once | | Rewards engine | Replaceable, and the replacement must already name this registry as its source | Nothing here can mint an NFT or move one. Registration can be paused, which stops new weight arriving without touching existing weight. ### The emergency hatch There is one owner-only path that can move credited assets, and it is deliberate. It exists because an audit found several ways for value to become permanently stuck, and a system with no way out of the next one is more brittle rather than safer. It is bounded by notice rather than by amount. The exact asset, destination and amount must be announced on-chain 24 hours before it can execute, and the authority expires 48 hours after that — so an announcement nobody executes becomes dead rather than standing indefinitely. Holders get a full day to collect first. **That notice is not a bound on what the owner can reach.** It is the price of the *announced* path only. The owner also configures the swap venue and the price floors, and those take effect immediately — so an owner willing to abuse the position does not need the hatch and does not have to wait. The real protection is who holds the key. It should be a timelock, and until it is, this is a trust assumption rather than a mechanism. ### If the engine is ever replaced This is the one administrative action a holder would notice, so it is worth knowing what it looks like from the outside. Your **level is untouched** — levels live in the registry, which is not replaced. Your **existing credit is not stranded** — the outgoing engine keeps whatever it already owes you and keeps paying it. What changes is the withdrawal clock: the new engine learns your weight by being told it, which reads as a fresh increase, so **the four-hour lock restarts for everybody at once**. Nothing is lost. One case is not covered by that. A position cleared before a migration and re-registered after it is recognised only by the **new** engine, so the predecessor's credit can never be delivered to it. If your position is cleared while a migration is announced, re-register **before** the switch, not after. ## Keeping it running Three things need somebody to do them, and **none of them needs any privilege** — they are open to anyone, and whoever does them holds no role on any contract and needs only gas. | What | Why it matters | | ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Clearing stale positions | A sale notifies no contract. Until a sold position is cleared it keeps its weight at the seller's level and keeps taking a share, diluting everyone still holding | | [Ringing the Bell](/goat-street/the-bell) | Converts the pot and credits every position. Nobody else has a reason to pay for it | | Delivering rewards | Moves credit into each NFT's own wallet, and deploys that wallet the first time | Holders never have to wait for a keeper. Delivering is open to anyone, so you can push your own NFT's rewards into its wallet whenever you like — the app does it in one click. ## Assurance | | | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tests | 359 local, 55 against a Robinhood mainnet fork | | Invariants | 22 properties, each fuzzed at 256 runs × 200 depth — 51,200 calls, including cross-contract weight agreement and two-sided solvency | | Mutation testing | Safety-critical guards deleted individually to confirm the suite fails | | Live rehearsal | Full deployment and lifecycle on testnet: entry, registration, all four levels, payout choices, distribution, delivery into token-bound wallets, and a real sale with its clearing | | Adversarial review | Repeated multi-agent audit rounds, each finding independently verified before it was accepted | The audit record, including every finding and the reasoning behind each accepted risk, is maintained alongside the source. ## Network | | | | ---------------- | -------------------------------------------- | | Chain | Robinhood Chain | | Chain ID | 4663 | | Settlement asset | ETH, with WETH accepted and unwrapped | | Price source | Chainlink feeds published on Robinhood Chain | Every deployed address is listed on [Contracts](/goat-street/contracts) and verified on the block explorer. Check any address you are about to interact with against that page and against the explorer itself — never against a link somebody sent you.