Baofa has a small set of privileged roles, each with an explicit scope, and a plan for custody of those roles. This page describes both the launch state and the target state, and it is updated when the ownership transfers are executed.
Roles in the Contracts#
| Role | Scope | Cannot |
|---|---|---|
| Diamond owner | change facets (diamondCut), transfer or renounce ownership, rescue stranded BNB |
touch curve reserves or fee ledgers, which are WBNB on ledgers |
| Core authority | protocol parameters (setParams), fee recipients, buyback and creator fee configuration, holder reward configuration, quote asset registry, the Frenzy, cashback and volume flags, adminCto |
mint coins, pause trading, move a user's coins or balances |
| Withdraw authority | collect the accrued migration fee (collectMigrationFee) |
anything else |
| Fees admin | fee rates and tiers per consumer, the social claim authority, fee module wiring | spend a ledger |
| Holder reward claim authority | distribute a holder-reward coin's accrual to its holders in batches | pay itself; every payout goes to a listed holder |
| Social claim authority | release a social fee account to a verified wallet, within a rate limit | create balances |
| Frenzy admin and trader | the programme's parameters, stop and resume, the trader key, vault withdrawals within the interval | trade outside the caps and the price band |
| Relayer | close donation epochs, swap and distribute; written once at deployment | change the settlement asset or itself |
| Anyone | create coins, trade, graduate a complete curve, sweep fees to their recipients, burn a Frenzy vault after its window, trigger claims for a user |
Launch State#
Target Structure#
| Role | Instrument | Threshold | Delay |
|---|---|---|---|
| Protocol admin (parameters, recipients, flags) | Safe proposing to timelock A | 3 of 5 | 48 hours minimum |
Upgrades and ownership (diamondCut, ownership transfers, delay changes) |
the same Safe proposing to timelock B, which owns the diamonds | 3 of 5 | 7 days minimum |
| Guardian (Frenzy stop and resume only) | a separate Safe | 2 of 4 | none |
| Treasury (fee recipient) | a Safe with a signer set disjoint from the guardian | 4 of 7 proposed | none on receipt |
The transfer is executed as the last step of the deployment once the signer sets are supplied, through the two-step ownership transfer of each diamond and the authority setters of the core and fees modules. Until then the launch state applies, and this page says so.
Operating Rules#
- Every governance transaction is simulated against a fork of BNB Smart Chain before it is sent, and every change is read back from a second RPC provider afterwards.
- A third-party watcher alerts on every scheduled timelock operation at least 24 hours before it becomes executable.
- Native BNB never travels with a governance call.
- Keys are generated with a hardware wallet or a standard wallet tool, never with a vanity generator.
What No Role Can Do#
- Stop trading on a curve or on a graduated pair.
- Take coins or BNB out of a curve: the migration fee is the only protocol take at graduation, capped at 3 percent of the raise by the contract.
- Change a coin after creation: supply, decimals, the absence of mint, pause and tax are properties of the coin contract, which has no owner.
- Reclaim graduation liquidity: it is burned.