> For the complete documentation index, see [llms.txt](https://pallette-wars.gitbook.io/pallette-wars-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pallette-wars.gitbook.io/pallette-wars-docs/trust-model.md).

# Trust model

Immutable vault, upgradeable game, timelock, oracle-attested jury.

Palette Wars splits money rules from gameplay rules so a tool rebalance is not a rug.

```mermaid
flowchart TB
    P[Players] --> G[PaletteWarsGame UUPS]
    P --> V[PaletteWarsVault immutable]
    G -->|recordPaint| V
    T[Timelock] -->|admin after delay| G
    T -->|admin after delay| V
    O[Oracle] -->|resolveEpoch| V
    K[Cost keeper] -->|plus or minus 25 percent per 12h| G
```

## Immutable Vault

Holds all `$WAR`: ink deposits, the epoch vault, jackpot claims, monthly pool.

Frozen forever (no setters):

* 50% jackpot / 25% burn / 15% monthly / 10% treasury
* Burn address is the dead address

Tunable only through the timelock (next epoch timings, not the split):

* `warDuration` (bounded 1h-48h)
* `juryDuration` (bounded 15m-7d)
* which Game address may call `recordPaint`
* treasury address

## Upgradeable Game

UUPS proxy for tools, costs, cooldowns, peace delay, fog, supply zones. This is how Nuke can drop from 1500 $WAR if the token moons.

Upgrades and unbounded cost changes go through the Timelock. On mainnet that delay should be 48 hours with a Safe as proposer/executor. Players can withdraw ink during the delay.

`COST_KEEPER_ROLE` may move tool costs ±25% per 12h without waiting on the timelock. That cannot change the vault split.

## What the timelock does not bypass

The timelock is self-administered (`admin = 0`). Nobody can rewrite proposers to skip the delay. You can still upgrade: schedule, wait, execute.

## What you still trust

| Power                          | Who                                     |
| ------------------------------ | --------------------------------------- |
| Name the jury winner           | Oracle role (currently a dedicated key) |
| Emergency resolve after 12h    | Timelock admin path                     |
| Change tool costs ±25% / 12h   | Cost keeper (hub)                       |
| Unbounded costs / upgrade Game | Timelock proposers after delay          |

The Vault cannot be upgraded. If you disagree with a scheduled Game change, withdraw ink before the delay ends.

{% hint style="warning" %}
X polls are community signal the oracle attests. Pixel-count is the unattended fallback. Be public about that.
{% endhint %}

## Contracts (Robinhood testnet 46630 — 30 Aug 2026 smoke)

| Piece                   | Address                                      |
| ----------------------- | -------------------------------------------- |
| MockWAR                 | `0x643C21B608b1783b5420f17fC426E16BeAc5bD35` |
| PaletteWarsVault        | `0xB4edf70a395d317d4bda54E22d0D93d188f499ac` |
| PaletteWarsGame (proxy) | `0x17E456Ea4849E35deA5fa6404Fe5Dc16F603A443` |

Timelock was skipped on this smoke (`SKIP_TIMELOCK=1`). Deployer stays admin/oracle for test.

Robinhood mainnet **4663** vault + game addresses land after pons v2 `$WAR` exists and a 1:1 transfer proof passes. Create on pons factory `0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e`. Public drop: **Sunday 6 September 2026, 16:00 UTC**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://pallette-wars.gitbook.io/pallette-wars-docs/trust-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.