/// Reading the chain
/// Upgradeability
Upgradeability
The trust boundary, drawn in one line: ROHME can improve a DAO's mechanics for everyone at once, but can never touch its money — the backing, the redemption floor, or the supply. The logic sits behind upgradeable beacons; the money sits in contracts that can never be upgraded.
/// The boundary
Two sets of contracts
Upgradeable logic6behind ROHME-owned beacons
Immutable money4can never be upgraded
Migration to upgradeNoneone beacon reaches every DAO
Beacon ownerROHMEa key today, transferable to a multisig
/// What can change, what cannot
The upgradeable set vs the immutable set
Upgradeable — behind beacons6 contracts
Each of these runs behind an OpenZeppelin UpgradeableBeacon owned by ROHME. Point the beacon at new logic and every DAO picks it up at once — no per-DAO migration, no redeploy, no action required from any creator.
- Stakingstake into the rebasing sTOKEN
- Distributormeters reward emissions
- BondDepositoryruns bond markets
- Governorthe Senate lifecycle
- PolicyGuardguards protected actions
- LpBondListerlists LP-bond markets
Immutable — the money setnever upgraded
These have no beacon and no upgrade path. There is no admin key, no proposal, and no ROHME action that can alter a DAO's backing, its redemption floor, or its supply. What you see at founding is what stands for the life of the DAO.
- Treasuryholds the backing
- RedemptionModulethe rage-quit floor
- CurveLegReceiptvalues the curve legs
- The tokensupply itself
/// One upgrade, every DAO
Why the logic lives behind beacons
The beacon pattern is what lets the protocol keep improving after DAOs are already live. When ROHME ships a better staking curve, a bond-market fix, or a governance improvement, it upgrades the beacon and every DAO inherits the change in place. No creator has to migrate, re-deploy, or opt in — the whole fleet moves together. It is the same reason a fresh DAO can launch on battle-tested rails rather than a one-off contract nobody has audited.
/// The honest caveat
Who holds the upgrade key
The trust you are extendingbounded to mechanics, never money
- ✦the beacons are owned by ROHME — today, a single ROHME key
- ✦that ownership is transferable to a multisig or a timelock
- ✦ROHME can improve the 6 logic contracts for every DAO at once
- ✦ROHME can NOT alter backing, redemption, or supply — ever
- ✦the money set has no upgrade path for anyone to hold a key to
Be clear-eyed about what beacons cost you: the upgradeable set is a real trust assumption. ROHME can change how staking, distribution, bonds, governance, the policy guard, and the LP-bond lister behave. The bound on that power is that it stops at the mechanics. The Treasury, the RedemptionModule, the CurveLegReceipt, and the token are immutable, so the things that decide whether you can get your money out — the backing and the redemption floor — are outside anyone's reach, ROHME's included.