Your Business is intentionally small. The whole protocol is three composable contracts and a registry — no proxies, no upgradeable storage, no privileged callers. Every parameter is set by on-chain governance and executed by timelock. This page documents what's actually deployed.
Vault.sol is the user-facing contract. It holds deposits, mints share tokens (basinETH, basinUSDC, etc.), and routes assets to whitelisted strategies. Vaults are non-upgradeable — once deployed, the bytecode is frozen. There is no migration function, no admin role, no recovery path. If governance wants to deprecate a vault, they vote to pause new deposits and let it wind down.
Gov.sol is the governance module. It accepts proposals from any address holding ≥0.1% of $BSN (currently ≈100k tokens), runs a 5-day vote, and executes successful proposals through a 7-day timelock. The timelock cannot be bypassed. A 5-of-9 multisig of community guardians can veto a proposal during timelock — they cannot enact one.
Registry.sol maintains the list of approved strategy contracts that vaults are allowed to call. Adding a strategy requires a governance vote. Removing one requires a vote, or — for emergencies — a guardian veto on its current allocation.
These three contracts and a small periphery (helpers, multicall, view) are the entirety of the protocol surface. Total ~2,400 lines of Solidity, audited by six firms across three rounds. Every bytecode hash is verified against the deployed addresses on Etherscan, Basescan, and Arbiscan.
Your Business doesn't generate yield itself. It allocates capital across audited strategies that do — staked-ETH derivatives, perp market-making, structured CDP positions, and yield-bearing stablecoin pairs. The DAO sets caps per strategy and per asset, and the vault rebalances daily.
Your Business's vault accounting depends on accurate asset prices — for collateral checks, share-price calculations, and harvest math. We use three independent oracles per asset and require two of three to agree within 0.5%, or the vault pauses harvest until they reconcile. This is opinionated and the DAO has rejected three proposals to relax it.
Every audit report below is published in full on the protocol's GitHub. We list outstanding issues, not just resolved ones. Findings classified High or Critical have all been fixed and re-audited; Medium findings are tracked publicly in the issue queue.