View as Markdown

Admin and upgradesLink to this section

TL;DRLink to this section

Most of the system can't be changed: the token and the Squeeks aren't upgradeable, and the $SQK cap, premint, Squeek supply, maximum level and cooldown table are permanent.
Only Core, Mining and Staking can be upgraded, and only by the admin through a Timelock: each change is scheduled publicly onchain and applies only after a delay.
Pauses are narrow: none of them blocks claiming rewards, withdrawing Squeeks, or unstaking $SQK from Staking.
Every upgrade is public and delayed before it applies. The delay gives notice rather than reviewing the new code, so upgraded contracts still rely on the admin. On the Sepolia testnet the delay is a short testing setting.

Why is there an admin?Link to this section

Squeekchain is a new idea: proof of work powered by a hamster. With little precedent to learn from, its trust model balances two needs: rules that no one can change, and a careful, public way to fix problems if they appear. The admin handles the second. It can't act on its own schedule: every change it makes goes through a Timelock, a contract that publishes the change onchain and holds it for a set time before it can run, so anyone can see it coming.

A second role, the Guardian, is a safety switch. If something looks wrong, it can pause specific actions straight away, but it can't move anyone's $SQK or Squeeks or change a rule.

What stays fixed?Link to this section

The token (SqueekToken) isn't upgradeable: its lifetime cap and premint are fixed, and it binds one Mining contract permanently, which mints only to itself. Mining, not the token, checks work, processes rounds, and applies the issuance schedule.

SqueekNFT isn't upgradeable either. Its 9,999-Squeek supply, the split between IDs 1–8,888 and the protocol's 8,889–9,999, maximum level and merge cooldowns are fixed at construction. The admin can set the launch contract, which receives IDs 1–8,888 at issuance, only while issuance is paused and before any NFT exists, and can open or close merges at any time.

Token binds once to Mining, and Mining binds once to Staking; neither binding can change. The NFT's launch binding becomes fixed once NFT issuance starts. The admin starts Mining once, after Staking is bound.

Pauses are narrower than upgrades. The Core Guardian can stop settlement, NFT issuance, and new Staking intake; the Mining Guardian can stop issuance. Claims of funded rewards, Squeek withdrawals, and unstaking of mature $SQK continue through every pause; Pauses and unavailable services lists the full matrix.

What can an upgrade change?Link to this section

Only Core, Mining and Staking can be upgraded, and only by the admin through its Timelock. Each upgrade is scheduled publicly onchain and can be executed only after the delay, so it's visible before it applies. Nothing else can change their code.

An upgrade can change how Core records work, how Mining issues $SQK within the cap, and how Staking holds deposits and calculates power, rewards, and exit fees (how staking works). The Timelock gives notice rather than reviewing the change, so these contracts rely on the admin.

Who holds these powers on Sepolia?Link to this section

On Sepolia, the admin Timelock owns the Core, Mining, and Staking ProxyAdmin contracts, is the admin address of Mining, Staking and the NFT, and is the token's Mining binding authority. Its delay is a short testing setting. Operational addresses lists the proposers, the exact delay, the Guardian, the Reporter, and the reserve recipient.

These are testnet settings for testing only, not a mainnet policy. Before relying on any deployment:

Read owner() on each ProxyAdmin and getMinDelay() on the timelock; a proxy's code can change.
Watch the timelock's CallScheduled events, which announce an upgrade or binding before it can execute.
After an Upgraded event, treat the new implementation as unknown until its runtime hash, version and storage layout match a reviewed record. The Quickstart shows the check.
SqueekToken and SqueekNFT have no proxy or owner; read their admin-set bindings and flags rather than assuming them.

Technical detail: admin rolesLink to this section

The admin is a Timelock (OpenZeppelin TimelockController). Its only proposer and canceller is the admin Safe, the team's multisig; once a change's delay has passed, anyone can execute it. The admin owns the Core, Mining, and Staking ProxyAdmin contracts, is the address governance() returns in Mining, Staking, and the NFT, and is the token's miningBindingAuthority. The Guardians are separate roles that act without a delay.

The Core Guardian pauses and unpauses settlement and NFT issuance, and can replace the Reporter while Core is paused; the NFT and Staking contracts read that Guardian from Core on every call. It can pause Staking intake, but only the admin resumes it. Mining stores its own Guardian, which the admin can replace; it pauses issuance, and only the admin resumes it. The Reporter signs settlements; relayers submit them.

Timelock proposers schedule changes and cancellers can cancel them. After the configured delay, an eligible operation can execute through a ProxyAdmin or an admin-only (onlyGovernance) function without Guardian or Reporter approval.

PermissionsLink to this section

Component	Admin boundary
`SqueekCore`	The `Timelock`'s `ProxyAdmin` upgrades code; the Core Guardian separately pauses/unpauses `SqueekCore` and changes the Reporter while paused
`SqueekMining`	Upgradeable through its `Timelock`-owned `ProxyAdmin`. The admin calls `bindStaking` once, then `start` once; unpauses; replaces the Mining Guardian. The Mining Guardian pauses issuance and start
`SqueekStaking`	Upgradeable through its `Timelock`-owned `ProxyAdmin`, which `bindStaking` requires. The admin unpauses intake and recovers NFTs held without a registered depositor. The Core Guardian pauses intake only
`SqueekToken`	Cannot be upgraded. `miningBindingAuthority` calls `bindMining` once, which atomically completes Mining's bootstrap; after that the mint caller and recipient never change
`SqueekNFT`	Cannot be upgraded. The admin calls `configureLaunch` while paused and before issuance, and `setMergesOpen`; the Core Guardian pauses and unpauses issuance; owners merge their own Squeeks and the NFT burns the donor

A compatible Core upgrade preserves stored positions and the exact pricing, steering, and block-unit rules. Core has no difficulty setter; difficulty changes only under that fixed rule. Release policy is that changing the rule or its constants requires a separately approved fresh ledger, so existing history isn't reinterpreted; the contracts don't enforce this, and an upgrade could change the rule.

GuaranteesLink to this section

Core exposes settlement and Guardian administration, with no manual difficulty adjustment or arbitrary-call entrypoint. Settlement signatures name the executing implementation, so a signature naming a different implementation can't authorize settlement after an upgrade.

The token mints its premint once at construction, to at most eight recipients, and enforces its lifetime minting cap; holder burns never reopen it. Its mint function can't rewrite holders' existing balances, spending allowances, or permit nonces.

Mining binds only a Staking proxy whose ProxyAdmin is owned by the admin and whose Mining, Token, Core, and admin bindings match. Every checkpoint that mints must transfer exactly that amount to Staking and notify it, or the whole checkpoint reverts.

After every reward payout and every unstake, Staking checks that its $SQK balance covers all staked principal plus funded, unpaid rewards. $SQK sent to it directly doesn't become a reward.

AssumptionsLink to this section

Upgrade administrators must preserve stored data and economic rules; what each upgrade can change is above. Mining's checks can't detect consistent false work from Core. A Mining upgrade could also change how round records are processed, and the token enforces neither a per-block issuance limit nor Mining's schedule. A Staking upgrade could also change exit fees, and its balance check runs inside the upgradeable code, so it guards against faults in the code it ships with.

Mining, not the token, requires work-backed issuance, processes each round once, and prices completed blocks by its schedule; Staking, not Mining, shares funded $SQK across stakers by their current power.

Failure behaviorLink to this section

Condition	Effect
Core Guardian pauses `SqueekCore`	Settlement stops; `SqueekMining` checkpoint reverts `CorePaused`
Mining Guardian pauses `SqueekMining`	`checkpoint` and `start` revert `EmergencyPaused` until the admin unpauses; funded Staking rewards keep streaming and stay claimable
Core Guardian pauses `SqueekStaking` intake	Deposits, staking, compounding, and deposited merges stop until the admin resumes; claims, withdrawals, unstaking, and funding continue
Reporter change while unpaused	Fails; `SqueekCore` must be paused and the new Reporter address unused
Second `bindMining` or `bindStaking`	Reverts; neither binding can be replaced
`start` before Staking is bound	Reverts `StakingNotBound`
`Timelock` operation not ready	Cannot execute through the normal admin path
Mint request exceeds remaining supply	`SqueekToken` rejects the entire mint; Mining clips scheduled issuance to the remaining cap
`SqueekMining` mint request within the cap that work doesn't back	`SqueekToken` accepts it; the token doesn't check work

Applies SqueekCore, SqueekMining or SqueekStaking upgrades authorized by the admin Timelock that owns it. Generates Squeek images and metadata from fixed onchain visual data. Records physical work and earned block units on Ethereum, with difficulty adapting after rounds with at least 40 work. Issues $SQK for completed Squeek blocks on a schedule and funds SqueekStaking with all of it. The Squeeks ERC-721 contract. Tracks ownership, levels and merges. Holds deposited Squeeks and staked $SQK, streams Mining's issuance to stakers by power, and pays claims. The $SQK ERC-20 contract, capped at 2.1 billion $SQK including the premint; only the bound SqueekMining can mint. Queues the admin's changes and enforces a delay before they run. Checks that visual data conforms to the required DotGrid format. Mining processes settled rounds, mints the scheduled $SQK for completed post-start blocks, and funds Staking. The Squeek permanently burned in a merge. Its image is not combined or kept. $SQK issued for completed Squeek blocks after Mining starts: a launch bonus, then three halving periods, up to the lifetime cap. The fee for unstaking $SQK, burned in full: 2% when few people are leaving, rising to 60% when a fifth of staked $SQK leaves within a week. Squeekchain's record of accepted wheel-magnet passages. Combining two eligible same-level Squeeks, both in your wallet or both deposited in Staking, into one Squeek a level higher. The donor is burned. The completed Squeek blocks a merged Squeek waits through before it can merge again. It follows the Squeek through transfers. Your share of the reward stream: your deposited Squeeks' power plus the $SQK you staked, boosted by them. Each funding restarts a 20-minute stream of all unreleased $SQK, shared among stakers by power. A ten-minute period used to group measured work. The device saves a completed round's work total when measurement remained uninterrupted. The token issued for completed Squeek blocks after Mining starts and streamed to stakers. It has a lifetime supply cap. A Genesis NFT. Its level sets the power it adds for you while it is deposited in Staking. One billion block units earned from settled work at each round's difficulty. After Mining starts, each completed block issues $SQK on its schedule. Squeekchain's ecosystem for hamster-powered onchain finance, built on the public work record. The Squeek you keep in a merge. It gains a level and keeps its ID and image; if deposited, its higher power counts for your account. $SQK streamed to you that you haven't claimed. Rewards collect in Staking until you claim them; a Squeek holds none. The hamster mining device. It records accepted wheel-magnet passages as work. One wheel-magnet passage that met the device's counting rules.