Upgrade & Immutability Status

4.4 Upgrade & Immutability Status

This page defines whether Modulexo contracts are upgradeable, owner-controlled, governance-controlled, or fully immutable.

All statements must be verified on-chain via:

• owner() • Proxy admin address • Implementation address • Ownership transfer events

---

I. Upgrade Model Classification

Each contract belongs to one of the following categories:

1. Immutable (No Proxy, Ownership Renounced)

2. Owner-Controlled (No Proxy)

3. Governance-Controlled (No Proxy)

4. Upgradeable via Proxy (Owner or Governance Controlled)

The status must be explicitly listed per contract in Contract Directory.

---

II. Execution Layer (Recycle Contracts)

RecyclingEngine

Verify:

• Is contract a proxy? • If proxy:

• Proxy address

• Implementation address

• Proxy admin address • If not proxy:

• Code immutable after deployment

Verify:

owner()

Possible states:

• Private Owner • Timelock • Zero address (renounced)

If ownership renounced:

Parameter updates are permanently disabled.

If ownership transferred to Timelock:

Upgrades or parameter changes require governance proposal.

---

SponsorshipLedger

Same verification steps apply:

• Proxy or not • Owner or Timelock • Renounced or active

Ledger math itself is immutable unless contract upgradeable via proxy.

---

RecycleAssetRegistry

Asset enablement and caps depend on ownership state.

If owner active:

Asset list mutable.

If renounced:

Registry frozen.

---

III. Router

Verify:

• Proxy status • Owner

Router rail configuration is mutable only if owner active.

If ownership renounced:

Rail topology becomes permanent.

---

IV. Fund (Ethereum)

Fund may be:

• Direct deployment (immutable code) • UUPS / Transparent Proxy (upgradeable)

If proxy:

List:

• Proxy address • Implementation address • Proxy admin

Ownership must equal Timelock for governance control.

If proxy admin retained by private address:

Upgrade risk remains.

This must be disclosed.

---

V. Governance Contracts

Weighted Governor

Typically immutable.

Verify:

• No proxy admin • Constructor parameters fixed

---

Timelock

Verify:

• getMinDelay() • Admin role assignments

If Timelock admin is self-governed:

Upgrade path is constrained by governance.

---

VI. Upgrade Authority Matrix

Contract	Proxy?	Owner	Upgrade Authority	Immutable?
RecyclingEngine	Yes/No	Address	Owner / Governance	Depends
Ledger	Yes/No	Address	Owner / Governance	Depends
Registry	Yes/No	Address	Owner / Governance	Depends
Router	Yes/No	Address	Owner	Depends
Fund	Yes/No	Timelock	Governance	Depends

This matrix must be filled with real deployment data.

---

VII. What Cannot Be Changed (If Immutable)

If contracts are non-proxy and ownership renounced:

The following become permanent:

• Distribution formula • Weight mint logic • Unit consumption logic • Burn routing • Rail math • Governance structure

No upgrade path exists.

---

VIII. Proxy Risk Disclosure

If any contract uses a proxy pattern:

Risks include:

• Implementation upgrade • Admin key compromise • Governance manipulation

Verify:

implementation()
admin()

on proxy contract (if applicable).

Upgrade events must be monitored.

---

IX. Parameter Freeze State

If renounceOwnership() called:

Parameter update functions become inaccessible.

Verify via:

owner() == address(0)

This permanently disables:

• setParams • setAsset • setRails

Freeze state must be documented.

---

X. Governance Lock Scenario

If:

• All execution contracts owned by Timelock • Fund owned by Timelock • Timelock controlled by Governor

Then system upgrades require:

1. Proposal

2. Vote

3. Delay

4. Execution

No unilateral change possible.

---

XI. Immutability Summary Categories

Category A — Fully Immutable

• No proxy • Owner renounced

Permanent.

---

Category B — Governance Controlled

• Owner = Timelock • No private admin

Upgradeable via governance.

---

Category C — Owner Controlled

• Owner is private address

Upgradeable or mutable without governance.

---

Each contract must be assigned one category.