Veil Owner Decisions
All 19 binding architectural, risk, and deployment decisions ratified by protocol governance. Each policy decision forms the immutable operational baseline for smart contract parameters.
selfAttest is open to anyone with zero eligibility barriers. Gating acts exclusively as an anti-bot speedbump and launch windows safeguard.
Every label deposited on-chain plus the genesis sentinel is included automatically by mechanical publication scripts. Zero human discretion.
No immediate renounce schedule. Guardian, treasury, registry, and hook ownership remain securely with the operator wallet indefinitely.
Matches live defaults: 30 BPS hook swap fee with 70% share automatically routed to VeilTreasury for VEIL token burn.
Adopted Veil as the canonical protocol brand; namespace collision risk evaluated and accepted.
Satisfied via deep automated fuzz suites, differential testing, and formal root verification with zero unresolved severity issues.
Dedicated isolated fixed-denomination Merkle pools deployed for native ETH and the VEIL token.
Advanced zero-knowledge proof-of-clean-funds deferred to v2. v1 enforces open self-attestation via AttestationRegistry v2.
Emergency deposit pause maintained by operator to contain potential zero-day threats while exits remain cryptographically unblockable.
No private contract allowlists; open pool access is bounded by strict lifetime deposit caps (10 ETH per pool) to contain protocol risk.
Mandatory public Terms of Service and Privacy Architecture disclosures with zero price speculation promises.
Withdrawals execute directly from the browser via client-side Groth16 proofs. Zero dependency on centralized relay nodes.
Canonical OpenZeppelin ERC1967 UUPS proxy standard adopted for 0xbow Entrypoint with transparent storage manifests.
Strict zero-custody and balance conservation invariants (totalDeposits − totalWithdrawn = pool balance) continuously monitored.
All deployed smart contracts must be verifiable on-chain. Sourcify 10/10 verified bytecode published permanently.
In incident triage, pausing new deposits is the primary containment lever. Withdrawals remain autonomous and cannot be blocked.
Reuses battle-tested Groth16 commitment and withdrawal circuits with established trusted setup ceremony transcripts.
Keys rotated to active mainnet deployer and operator address (0xea48...3aa4). Historic testnet keys retired.
Canonical 0xbow suite (Entrypoint, fixed ETH pool, fixed VEIL pool, Groth16 verifiers) established on Robinhood Chain Mainnet 4663.