Security & Governance

What's locked, what governance can and can't touch, and an honest account of what still needs work before mainnet.

Governance

The protocol launches under a 2-of-3 multisig — deliberately not a single key, even though the design this protocol is modeled on launches that way. Security was an explicit goal from day one.

The multisig can adjust:

The resting sell fee, within its immutable 0–10% band
The approved stock candidate list and basket split, within its locked bounds
Oracle and swap-adapter configuration, Vault buy limits and pacing, the executor bounty
Pause / unpause

The multisig can never:

Change the total $BAG supply or mint more of it
Alter the 5,000 / 750 / 4,250 activation split
Reduce any Ape's Lifetime $BAG Burned, or reverse its activation
Rewrite a frozen Base Rarity Weight
Seize assets from an Ape's own account
Redirect a distribution that has already completed
Raise the sell fee above its hard 10% ceiling

Sell / buy fee schedule

Parameter	Value
Opening rate (both sides)	90%
Ramp duration	30 minutes, linear
Resting sell fee	5% at launch, adjustable 0–10%, hard-capped
Buy fee after ramp	0% — never charged again
Fee split	80% to the Vault, 20% to protocol operations

Trading is gated behind a one-way switch — every swap reverts until it's explicitly opened, and it can never be closed again once it is. The ramp timer starts at that switch, not at deployment.

Current test status

Every contract is built and covered by an automated test suite — 149 tests passing across nine contracts as of the last check. Two specific gaps are tracked openly rather than hidden:

The swap fee hook currently only applies fees correctly to exact-input swaps (the overwhelming majority of real trading activity) — exact-output swaps pass through fee-free for now. Separately, the hook has been thoroughly unit-tested but not yet exercised against a live Uniswap v4 pool end-to-end; that requires a fork test before mainnet.

Nothing here is deployed to any live network yet. A full adversarial test pass and a complete testnet run — mint, activate, vote, buy, distribute, transfer, repeat — are required before mainnet is a candidate.