# Governance, Security & Risk

How a vote is weighted is [Staking & Governance](/staking). This chapter is the other cut: which layer may act, what the contracts must disclose, and where the house can still lose money.

## Execution & Control

Three layers. An action belongs to one of them.

### Automatic

The contract runs these without a vote and without a signer:

* **NAV** — marks and the circulating-share identity
* **Sell burn** — the 0 / 1% AMM split is **fixed by the hook**, not votable; a HOLI sell burns 1% of its HOLI input in the same swap, with no LP, Treasury, or developer recipient
* **Pricing** — HOLI-route TWAPs and invalidation
* **Eligible mint checks** — quiet-period pause and premium gate for sHOLI emission, seigniorage tax before emission release, pairing that does not raise circulating supply

If the check fails, the printer does not run. That is not a committee.

### Snapshot governance

<Md expr="w" /> votes the rights in [sHOLI Staking](/staking#staker-rights-and-voting-scope) through [Snapshot](https://snapshot.org). It picks **which pools to open**. It does **not** retune the 0 / 1% hook fee. In this layer:

* **Buyback proposal** — if HOLI is under NAV: whether to spend undeployed reserves, plus size and price cap
* **Idle-fund allocation** — when undeployed is **> 30%**, whether to put idle funds into **already-approved** pools
* **Asset admission** — pairing proposals (which Stock/HOLI books may exist)
* **Emission** — on/off and rate, subject to the automatic premium gate

A vote authorizes the rule. It is recorded off-chain and cannot execute a call by itself.

### Dev Team multisig

The dev Team multisig executes work the vote already authorized:

* **Buy stock and mint pairing HOLI into the pool** — execution is [Asset Admission & POL Deployment](/treasury-mgmt/admission).

The Team Safe is expected to form Stock/HOLI pools and allocate idle funds only under the corresponding passed vote. The name vote, caps, and undeployed gate are not enforced by an on-chain vote registry; the Safe transaction and linked Snapshot proposal provide accountability.

It also approves and executes contract upgrades after the DEV Deployer has deployed a candidate implementation. The deployer cannot switch the proxy alone.

A signer click is not "the protocol rebalanced." LP-drift policy is still open in [Asset Buckets & Rebalancing](/treasury-mgmt/buckets#rebalancing-policy).

## Smart Contract Control

The Treasury's stable address is a transparent proxy. It owns the assets and delegates its logic to a separate implementation. The DEV Deployer may deploy a candidate implementation, but the dev Team multisig must approve and execute the proxy upgrade. A Snapshot vote may authorize that approval; it does not substitute for the Safe transaction.

The production upgrade authority must be controlled by the dev Team multisig (directly or through an approval-gated upgrade controller), never by the DEV Deployer EOA alone. Live deployments should name the current proxy, implementation, upgrade authority, Snapshot proposal when applicable, and executed Safe transaction. Current addresses: [Official Links](/official-links). Audits, if any, should say what they covered and what they did not.

HOLI is not immutable. Holder governance does not outrun the authority held by the dev Team multisig.

**Smart-contract, bridge, and multisig** risk sit in this same bucket. A bug, a bridge, or a signer set can still lose funds, stall, or capture pause and upgrade. If any HOLI or reserve path crosses a bridge, that path is a control surface.

## Risk surfaces

Protocol-owned assets and protocol-owned liquidity do not remove market loss. The sections below explain each risk once by surface: market, RWA, valuation, and governance.

## Market Risks

* **SHYT tax income.** SHYT is the MEME spoke and, before Genesis, the tax-funded Treasury asset. Trading-tax income can accumulate too slowly. A thin tape, a violent tape, or a tape that simply does not trade enough all hit Phase I accumulation, the SHYT/HOLI pool, and any HOLI mark that routes through SHYT.
* **HOLI below NAV.** Accounting NAV is not a floor. Exit is the POL curve. If HOLI stays under NAV long enough, new sHOLI emission stays off under the 45% gate. Previously accrued emission still requires USDG seigniorage tax before release. There is **no** redemption until the community approves a below-NAV buyback. That buyback is an [sHOLI vote](/staking#staker-rights-and-voting-scope) on undeployed reserves, size, and a price cap. It is a market buy, not a desk, and not default NAV redemption.
* **Liquidity depth.** Early hub pools can be small. A large HOLI sell walks the V4 curve and burns 1% of its HOLI input. Realized proceeds are the curve result after that burn, not the NAV print. Market depth can fade.
* **Impermanent loss.** Full-range Stock/HOLI, USDG/HOLI, and SHYT/HOLI positions move when the two sides diverge. POL takes inventory risk; the HOLI sell burn does not compensate LP or Treasury for that risk.
* **NAV vs exit.** Official NAV counts only the LP external-asset leg in <Md expr="A_t" />. That print can still diverge from the immediate exit value along the curve. What a holder can actually get is the curve, not the print.

## RWA Risks

Admitted stocks and other RWAs are not USDG. The Treasury mark is only as good as the wrapper.

* **Issuer.** Who issued the tokenized stock, what the wrapper actually claims, and whether that claim can fail.
* **Custody.** Where the underlying sits, who can freeze or seize it, and what happens to the on-chain token if the custodian stops.
* **Redemption.** Whether the wrapper can be redeemed for the underlying, by whom, at what lag, and at what discount. HOLI itself has [no NAV redemption](/nav/redemption). A stock token that cannot be redeemed is a different, extra failure.
* **Regulation.** Listings, wrappers, and venues can be restricted. An admitted name can become unlistable. Caps and pauses exist because of this, not in spite of it.

Admission is a [w-vote](/staking#staker-rights-and-voting-scope). The vote does not retire issuer, custody, redemption, or regulatory risk. It only decides whether the house will hold that name.

## Oracle / Valuation Risks

NAV is a function of marks. Bad marks make a clean identity lie. Price construction is [Asset Valuation & Price Sources](/nav/valuation#price-routes).

* **TWAP.** Formal NAV uses a time-weighted on-chain price, not a one-swap spot. A window that is too short follows manipulation. A window that is too long follows a stale book.
* **Manipulation.** Thin HOLI routes can be pushed through the TWAP. Arb across routes proves the routes agree. It does not prove the price is true.
* **Illiquid pools.** If the TWAP window has too little volume, depth is below the minimum, or the HOLI route is missing, that asset's price is **not defined**. The mark is dropped from assets, and any mint or function that needs that price does not run.

Invalidation is automatic. It is still a risk: a paused mark, a missing RWA in NAV, or a printer that will not fire, because the book was too thin to trust.

## Governance Risks

<Md expr="w" /> is claimed, non-transferable sHOLI at the Snapshot block. It can still concentrate. A few large sHOLI wallets can set admission, emission parameters, idle-fund allocation, and a below-NAV buyback. Each new [deposit](/staking#stake-and-seven-day-receipt) receives its own seven-day cooldown receipt; existing claimed sHOLI keeps voting while new shares have weight zero until claimed.

Entry-ratio accounting is also a risk surface. Incorrect weighted-average updates, partial-withdrawal rounding, or failure to separate deposited principal from untaxed emission could overcharge users or release unbacked HOLI. The implementation must preserve <Md expr="R_0" /> on proportional partial withdrawal and reconcile principal plus untaxed inventory against the sHOLI HOLI balance.

Governance can also just be wrong: an adverse call on **asset allocation** or **issuance parameters**, a buyback that spends reserves into a falling book, risk limits that are too loose or too tight. The [rights list](/staking#staker-rights-and-voting-scope) is the surface area of that mistake.

The annual [management mint](/dual-token/team#holi-team-management-mint) is a known NAV-dilutive print. It is not a hidden fee, and it is not retired by a good vote.

None of those failures become a floor. Protocol-owned assets and protocol-owned liquidity do **not** remove market loss.

**NAV is not guaranteed redemption value.** There is no redemption until the community approves.