Control of money

No single key controls SukukDAO. Every admin role in every contract belongs to one Safe, and a guard on that Safe decides what it may do and how slowly. The rules below are enforced by the contracts, not by a promise.

The Safe

The reserve is a Safe (version 1.4.1) with 9 signers. It is the admin of every SukukDAO contract. The key that deploys the contracts hands the Safe to its 9 signers in the same run and ends with no role anywhere. A role audit listing every privileged address and what it can do is published at deployment.

There is no Member vote. Members choose a Syndicate when they buy a Sukuk; Syndicate owners choose Agencies; Agencies manage capital within approved strategies. The Safe sets the rules those choices run inside, and its own rules are below.

The treasury guard

Every transaction the Safe makes goes through the protected path:

it is queued in public, on chain, with its full contents;
it waits 7 days before it can run. Enabling a module, changing the guard or changing the Safe's fallback handler waits 30 days;
it must run within 30 days after it becomes ready, or it expires and must be queued again. A queued action cannot be cancelled;
it needs at least 5 counted signatures, at least 2 of them from verified independents;
it is a plain call: no delegatecall, no batching, no gas refunds.

That covers everything the Safe can do, including: where money may go and who may spend it; signers and independence; modules and the guard itself; every protected parameter; approving Agencies, vaults and vault credit limits; opening tranches; starting a loss and lifting an impairment; releasing held-back Agency fees; the pool position; the sleeves and their marks; the definition of backing; topping up the wall; toll exemptions and the toll hook's module.

The 7-day queue is the main early warning. Anyone can watch it. An action nobody expected is visible a week before it can run.

Signers and independents

The signer set must always have:

at least 4 verified independents among the 9;
at most 2 genesis Agency members among the 9;
a threshold of at least 5.

Independence is verified outside the chain before a person is registered. The guard checks these rules after every Safe transaction, and a transaction that would break them fails.

Recusal

Every queued action names its subject: nothing in particular, a specific Agency, or the genesis Agency. The guard re-checks every signature the Safe receives. A signature from a wallet with a recorded interest in the subject is not counted towards the 5. Changing the definition of backing is a protected action with genesis members recused.

The person who queues an action declares its subject. The independents are the check on a wrong subject: they do not sign it, and it expires.

Freezes

Any 2 signers, acting within one hour of each other, can call a freeze for 72 hours, with a reason recorded on chain. A freeze stops the routine module and the bid wall's keeper, and holds the wall back if it has not yet gone live. It does not stop or cancel actions already queued on the protected path.

While a freeze is running, signers cannot start another. When an unratified freeze lapses, signers must wait 72 hours before the next, and cannot reuse a lapsed reason. The Safe itself can ratify a running freeze, under the same signature rules but without the 7-day queue, which keeps it on until the Safe's own unfreeze runs through the queue.

The routine module

Some payments are routine. The routine module handles them without a 7-day wait, inside limits the Safe has already set through the protected path:

a route is one token to one destination, with a cumulative daily cap and a weekly cap;
paying along a route needs signatures from 3 of the 5 routine operators, at least 1 of them a verified independent, each signature naming the token, the destination and a deadline;
nothing runs during a freeze.

The module can make one kind of call: a token transfer along a route the Safe has approved. The routes and their caps are set before launch. Because a Safe does not run its guard on module transactions, enabling any module waits 30 days.

Keepers

Day-to-day work is done by keepers: one address per job, set by the Safe and revocable by it.

The deposit keeper deploys tranche USDG into whitelisted vaults within their credit limits, claims and redeems, and records realised profit. Redemptions go only to the reserve.
The buyback keeper places the daily buybacks within the buyback policy.
The wall keeper runs the WallSweeper, which sweeps and re-centres the bid wall.
The payment feed keeps each tranche's next payment date and marks missed payments. A tranche guardian can also mark a missed payment.
The venue guardian can block a trading contract from receiving SUKUK. Only the Safe can unblock it.

No keeper can choose where money goes or loosen a limit. The design calls for venue blocks and missed-payment marks to be available to any 2 of the 9 signers. In the contracts, the venue guardian and the tranche guardian are each a single address set by the Safe. How those two addresses are held is set before launch.

What no one can do

No admin mint. SUKUK has four minters, all contracts: the launch and the migration, each capped at a fixed amount; Sukuk sales, bounded by each tranche's capacity; and the raising fee, capped at 10,000,000 in total. Nothing else can create SUKUK.
No admin burn. A burner can only burn its own balance, and every burn records its reason.
No redeem. SUKUK cannot be redeemed for the reserve's assets.
No send-everything. No contract has a function that sends its whole balance to an address of someone's choosing. The pool position can be withdrawn only to the Safe.
No outside liquidity. Only protocol contracts can add or remove liquidity in the official pools.
No upgrades. The SukukDAO contracts are not upgradeable proxies. Their code is fixed when they are deployed.
No single key. The reserve moves only through the protected path or along a capped route.

Signers are people

These rules limit what the signers can do and slow it down. They do not remove trust. Five signers, two of them independent, can still approve an action that is bad for holders, and the queue only gives you seven days to see it coming. Read Risks.