Governance and upgradesLink to this section

TL;DRLink to this section

Administrators can change the contracts that record work and calculate rewards through delayed governance operations.
An emergency pause stops settlement and new reward funding, not every owner action.
The SQK lifetime cap is fixed, but it doesn't prove that issuance is backed by work.
A delay gives notice; it doesn't make a malicious upgrade safe.

What can an upgrade change?Link to this section

The contracts that record work and manage rewards can be upgraded. For an owner, that means the rules you rely on also depend on the administrators who can change their code. A governance delay provides notice before an operation can execute; it doesn't prove the replacement code is safe.

Core records settled work, while Mining calculates rewards and holds the SQK used to pay claims. A malicious Core upgrade could report consistent but false work. A malicious Mining upgrade could mint all remaining SQK without work, misallocate funds, or block users.

What stays fixed?Link to this section

Token isn't upgradeable. It fixes the lifetime supply cap and permits only Mining to mint, with newly minted SQK sent to Mining. It doesn't independently check work, round processing, or the reward policy. Those checks belong to the upgradeable reward code.

The Guardian's emergency pause is narrower than an upgrade. It stops settlement and checkpoint funding through Core, but owners may still claim already funded rewards if the ownership and payment checks work. It isn't a pause of the entire system.

Technical detail: governance rolesLink to this section

The Guardian pauses Core and can change its Reporter while paused. The Reporter signs settlements; relayers submit them.

Timelock proposers schedule changes and cancellers can cancel them. After the configured delay, an eligible operation can execute through the Timelock's ProxyAdmin without Guardian or Reporter approval.

PermissionsLink to this section

Component	Governance boundary
`Core`	The `Timelock`'s `ProxyAdmin` upgrades code; the Guardian separately pauses/unpauses `Core` and changes the Reporter while paused
`Mining`	Upgradeable through `Timelock` governance; no `Mining` Guardian role
`Token`	Cannot be upgraded; fixes `Mining` as its mint caller and recipient, and fixes the lifetime supply cap
Factory	Launches and checks fresh contracts in one transaction; has no continuing `Core` governance power
`NFT`	Uses fixed dependencies and ownership rules; only `Mining` can burn merge donors

Compatible Core upgrades must preserve stored state, work rules, and fixed difficulty.

GuaranteesLink to this section

Core has no function to change difficulty, call arbitrary contracts, or permanently lock upgrades. Settlement signatures identify the executing implementation, so a signature for one version cannot authorize another.

Token starts with zero supply and enforces its lifetime minting cap. Its mint function cannot rewrite holders' existing balances, spending allowances, or permit nonces.

AssumptionsLink to this section

Upgrade administrators must be trusted to preserve stored data and economic rules. A malicious Core upgrade could report consistent but false work that Mining's checks cannot disprove.

A malicious Mining upgrade could mint all remaining SQK without work, reuse round records, misallocate funds, corrupt rewards, or block users. Token checks neither Core work nor round processing, and enforces no per-block reward limit or separate reward-policy lock.

Mining—not Token—requires work-backed issuance, processes each round only once, and enforces a combined reward multiplier range of 1×–2× (10000–20000 basis points). The multiplier is 1× (10000 basis points), with no public multiplier setter or owner-controlled boost.

Failure behaviorLink to this section

Condition	Effect
Guardian pauses `Core`	Settlement stops; `Mining` checkpoint reverts `CorePaused`
`Core` paused with funded rewards	Owners can still claim if `NFT` and `Token` checks work; pause alone does not block transfers, mints, or merges
`Core` fails required checks	Affected mint, merge, or checkpoint transactions fail
Reporter change while unpaused	Fails; `Core` must be paused and the new Reporter address unused
`Timelock` operation not ready	Cannot execute through the normal governance path
Mint request exceeds remaining supply	`Token` rejects the entire mint
Malicious `Mining` mint request within the cap	`Token` does not check whether work backs the request

Code review, upgrade tests, and the behavior of previous deployments provide different evidence. None guarantees that replacement code is safe.

Records verified work and tracks settled rounds and Squeek blocks on Ethereum. Calculates rewards from settled work, holds funded SQK, and pays eligible NFT owners. The Miner ERC-721 contract. Tracks NFT ownership and coordinates minting and merges with Mining. Applies Core or Mining upgrades authorized by its governing Timelock. Generates Miner NFT artwork from fixed onchain visual data. Queues governance operations and enforces a delay before they can be executed. The SQK ERC-20 contract. Enforces the lifetime supply cap; only Mining can mint SQK. Checks that visual data conforms to the required DotGrid format. When new mining power starts earning. Minting and merging schedule it for a later round, and a checkpoint must process the change. A reward update that processes settled work and scheduled mining-power changes. It can make rewards available but doesn't pay them to an owner's wallet. The Miner NFT permanently burned in a merge. Its unclaimed rewards move to the survivor, but its image is not combined or kept. SQK issued under the mining reward rules. You can direct a share of your Miner's rewards to fund SqueekFi projects. The physical mining device that records accepted wheel-magnet passages as work. It is separate from the virtual Miner NFTs. Squeekchain's record of accepted wheel-magnet passages. It doesn't prove animal identity and isn't how Ethereum reaches consensus. Combining two eligible same-level Miners you own into one higher-level Miner. One NFT is permanently burned; the survivor keeps both Miners' unclaimed rewards. The completed Squeek blocks a Miner must wait through before merging. It measures completed work, not elapsed time or Ethereum blocks; transfers don't reset it. The power used to calculate a Miner's share of rewards when eligible and active. A larger share of total power can mean a larger share of rewards. A ten-minute period used to group measured work. The device saves a completed round's work total when measurement remained uninterrupted. The transferable token used for mining rewards. It has a lifetime supply cap and is separate from the Miner NFT and the device's work count. A completed amount of settled work. Enough recorded work completes one Squeek block; it is not an Ethereum block. Squeek Miner NFTs earn SQK linked to recorded wheel activity. Owners can direct a share of those rewards to fund SqueekFi projects. Squeekchain's ecosystem for hamster-powered onchain finance. Miner owners can choose to fund projects with a share of their SQK rewards. The Miner NFT you keep in a merge. It gains a level, keeps its ID and image, and receives both Miners' unclaimed rewards. A Miner's recorded reward balance that hasn't been paid to a wallet. It stays with the NFT when ownership changes. One wheel-magnet passage that met the device's counting rules and was saved. It records work, not an amount of SQK.