Security
Upgrade safety
Gates every upgrade must pass.
Controls
Upgrades go through UpgradeGovernor: 1 day delay, 7 day vote, 7 day timelock.
Storage-layout gate
A new implementation must append storage only; the build fails on any reordering.
Test gate
The full invariant suite runs against the new implementation on a fork with live state.
Reviewer checklist
- Initializer locked.
- No new privileged role.
- Events unchanged or extended.
- Escrow untouched.
Signals to watch
Queued upgrades appear on Proposals with their full calldata.