Architecture
| Contract | Responsibility |
|---|---|
CovenantToken | ERC-20, fixed supply, no mint function; reports outbound transfers to the bonds contract |
CovenantHook | The Uniswap v4 hook: tax, launch tax, the 20% retention and its exemption, the launch band |
CovenantBonds | Bond positions: accrual, compounding, claims |
CovenantBondVault | Cold storage for the reward reserve, released in tranches |
CovenantRouter | UX entrypoints wrapping PoolManager.unlock |
CovenantMath | Pure helpers |
All contracts are immutable: no proxy, no upgrade path, nothing about them can be
rewritten after deployment. There is no assembly, no delegatecall, no selfdestruct,
and all arithmetic is checked.
Immutable is not the same as ungoverned, and it would be dishonest to leave it there. Three powers are held by the deploying key and survive forever, because they cannot be removed any more than the rest of the code can:
| Power | What it can do | What it cannot do |
|---|---|---|
| Emergency stop | Halt claiming, compounding and merging. The protocol clock stops with it, so nothing accrues while it is on and nothing is lost when it lifts. | Take anything. Principal and rewards stay where they are, and trading is deliberately left running so holders are never trapped. |
| Metadata source | Point the NFT artwork at a renderer, then freeze that choice permanently. | Touch balances, rates or ownership. A renderer that misbehaves degrades to "no image". |
| Reserve release | Choose when the cold reserve moves to the reward pool, one tranche at a time. | Choose where. The destination is frozen before a single token is deposited. |
The one to weigh honestly is the emergency stop: while it is on you cannot withdraw rewards you have already earned, and a key lost in that state would freeze them for good. It is a trusted role, not a trustless guarantee, and you should treat it as one.
How the pieces talk
trader ──→ CovenantRouter ──→ PoolManager ──→ CovenantHook
│
20% retained on a non-exempt sell ───┘
↓
CovenantBondVault ──(5% tranches)──→ CovenantBonds ──(rewards)──→ bond holders
The hook is the only contract that touches Uniswap. The bond contracts hold plain ERC-20 balances and never interact with the pool — which keeps the reward accounting completely independent of anything happening on the exchange.