Administrators can change the contracts that record work and calculate rewards through delayed governance operations.
An emergency pause stops settlement and new reward funding, not every owner action.
The SQK lifetime cap is fixed, but it doesn't prove that issuance is backed by work.
A delay gives notice; it doesn't make a malicious upgrade safe. On the Sepolia testnet the delay is very short.
The contracts that record work and manage rewards can be upgraded. For an owner, that means the rules you rely on also depend on the administrators who can change their code. A governance delay provides notice before an operation can execute; it doesn't prove the replacement code is safe.
SqueekCore records settled work, while SqueekMining calculates rewards and holds the SQK used to pay claims. A malicious SqueekCore upgrade could report consistent but false work. A malicious SqueekMining upgrade could mint all remaining SQK without work, misallocate funds, or block users.
SqueekToken isn't upgradeable. It fixes the lifetime supply cap and permits only SqueekMining to mint, with newly minted SQK sent to SqueekMining. It doesn't independently check work, round processing, or the reward policy. Those checks belong to the upgradeable reward code.
The Guardian's emergency pause is narrower than an upgrade. It stops settlement and checkpoint funding through SqueekCore, but owners may still claim already funded rewards if the ownership and payment checks work. It isn't a pause of the entire system.
On the Sepolia deployment, one governance timelock owns both the SqueekCore and SqueekMining ProxyAdmin contracts and is SqueekNFT's governance address, and one owner controls governance, the Guardian and the Hamster-Owned Liquidity. The timelock's delay gives almost no notice of an upgrade. Deployments lists the addresses and the current delay.
These are testnet settings, not a mainnet policy. Before relying on any deployment:
Read owner() on each ProxyAdmin and getMinDelay() on the timelock; a proxy's code can change.
Watch the timelock's CallScheduled events, which announce an upgrade before it can execute.
After an Upgraded event, treat the new implementation as unknown until its runtime hash, version and storage layout match a reviewed record. The Quickstart shows the check.
SqueekToken and SqueekNFT have no proxy, owner or setter; their bindings never change.
The Guardian pauses SqueekCore and can change its Reporter while paused. The Reporter signs settlements; relayers submit them.
Timelock proposers schedule changes and cancellers can cancel them. After the configured delay, an eligible operation can execute through the Timelock's ProxyAdmin without Guardian or Reporter approval.
| Component | Governance boundary |
|---|---|
| SqueekCore | The Timelock's ProxyAdmin upgrades code; the Guardian separately pauses/unpauses SqueekCore and changes the Reporter while paused |
| SqueekMining | Upgradeable through Timelock governance; no SqueekMining Guardian role |
| SqueekToken | Cannot be upgraded; fixes SqueekMining as its mint caller and recipient, and fixes the lifetime supply cap |
| SqueekNFT | Uses fixed dependencies and ownership rules; only SqueekMining can burn merge donors |
Compatible SqueekCore upgrades must preserve its stored positions and the exact pricing, steering, and block-unit rules. Difficulty changes automatically under that fixed rule; administrators have no difficulty setter. Changing the rule or its constants calls for a separately approved fresh ledger, not reinterpretation of existing history.
SqueekCore exposes settlement and Guardian administration, with no manual difficulty adjustment or arbitrary-call entrypoint. Settlement signatures identify the executing implementation address. A signature naming a different implementation cannot authorize settlement after an upgrade.
SqueekToken starts with zero supply and enforces its lifetime minting cap. Its mint function cannot rewrite holders' existing balances, spending allowances, or permit nonces.
Upgrade administrators must be trusted to preserve stored data and economic rules. A malicious SqueekCore upgrade could report consistent but false work that SqueekMining's checks cannot disprove.
A malicious SqueekMining upgrade could mint all remaining SQK without work, reuse round records, misallocate funds, corrupt rewards, or block users. SqueekToken checks neither SqueekCore work nor round processing, and enforces no per-block reward limit or separate reward-policy lock.
SqueekMining—not SqueekToken—requires work-backed issuance, processes each round only once, and pays a fixed 5,600 SQK for each completed Squeek block. It has no multiplier, public reward setter, or owner-controlled boost.
| Condition | Effect |
|---|---|
| Guardian pauses SqueekCore | Settlement stops; SqueekMining checkpoint reverts CorePaused |
| SqueekCore paused with funded rewards | Owners can still claim if SqueekNFT and SqueekToken checks work; pause alone does not block transfers, mints, or merges |
| SqueekCore fails required checks | Affected mint, merge, or checkpoint transactions fail |
| Reporter change while unpaused | Fails; SqueekCore must be paused and the new Reporter address unused |
| Timelock operation not ready | Cannot execute through the normal governance path |
| Mint request exceeds remaining supply | SqueekToken rejects the entire mint |
| Malicious SqueekMining mint request within the cap | SqueekToken does not check whether work backs the request |
Code review, upgrade tests, and the behavior of previous deployments provide different evidence. None guarantees that replacement code is safe.
Applies SqueekCore or SqueekMining upgrades authorized by its governing Timelock.
Generates Squeek images and metadata from fixed onchain visual data.
Records physical work and earned block units on Ethereum, with difficulty adapting after active rounds.
Calculates rewards from settled work, holds funded SQK, and pays eligible NFT owners.
The Squeeks ERC-721 contract. Tracks NFT ownership and coordinates minting and merges with SqueekMining.
The SQK ERC-20 contract. Enforces the lifetime supply cap; only SqueekMining can mint SQK.
Queues governance operations and enforces a delay before they can be executed.
Checks that visual data conforms to the required DotGrid format.
When new power starts earning. Minting and merging schedule it for the next round, and a checkpoint applies it.
A reward update that processes settled Squeek blocks, issues their SQK, and applies scheduled power changes.
The Squeek permanently burned in a merge. Its unclaimed rewards move to the survivor, but its image is not combined or kept.
SQK issued as settled Squeek blocks are processed: 5,600 SQK for each completed block, up to the lifetime cap.
Squeekchain's record of accepted wheel-magnet passages.
Combining two eligible same-level Squeeks you own into one higher-level Squeek. One NFT is burned; the survivor keeps both Squeeks' unclaimed rewards.
The completed Squeek blocks a Squeek waits through before it can merge again. It follows the Squeek through transfers.
What a Squeek earns with. Its level sets its maximum power; each Squeek block's SQK is divided across all active power in proportion.
A ten-minute period used to group measured work. The device saves a completed round's work total when measurement remained uninterrupted.
The token each completed Squeek block issues, shared by active power. It has a lifetime supply cap.
An NFT that owns a share of the Squeekchain network. It receives SQK from the hamster's work according to its active power, set by its level and the SQK staked to it.
One billion block units earned from settled work at each round's difficulty. Completed blocks supply SQK under the mining reward rules.
Squeekchain's ecosystem for hamster-powered onchain finance, built on the public work record.
The Squeek you keep in a merge. It gains a level, keeps its ID and image, and receives both Squeeks' unclaimed rewards.
A Squeek's recorded reward balance that hasn't been paid to a wallet. It stays with the Squeek when ownership changes.
The hamster mining device. It records accepted wheel-magnet passages as work.
One wheel-magnet passage that met the device's counting rules.