HANS Governance: minting, timelock & Safes
New HANS (or UBAI) supply can only be created through a single, fully on-chain pipeline. Nobody — not the founders, not the deployer, not the treasury — can mint by themselves.
The three keys #
| Role | Who holds it | Power |
|---|---|---|
| Governance Safe (proposer) | A Gnosis Safe multisig — 2-of-3 on testnet, expanding to 3-of-5 before real funds | The only address that can propose a mint by scheduling it on the timelock |
| Timelock (owner of the tokens) | An OpenZeppelin TimelockController |
Holds the mint power. Executes only proposals that have waited out the full delay |
| Guardian (canceller) | A separate cold-storage key | Can cancel any queued proposal during the delay. Cannot propose anything |
Execution is open: once the delay has passed, anyone can execute a queued mint — there is no privileged executor to go missing.
The lifecycle of a mint #
- The Governance Safe collects its signatures and schedules the mint on the timelock, naming the amount and the memo hash of the published acquisition memo.
- The proposal is now public and cannot execute until the delay passes — 72 hours on mainnet, 600 seconds on the test network.
- During the delay the guardian can cancel it. This is the emergency brake against a compromised or coerced Safe.
- After the delay, anyone executes it. The token contract mints to the treasury and emits the memo hash.
Both halves of this were rehearsed for real on Base Sepolia: a full mint of 1,000 HANS ran the entire pipeline, and a second queued mint was successfully vetoed by the guardian key with supply untouched.
Accepted trade-offs (documented, not hidden) #
- A hostile guardian can only stall, never mint. The guardian's sole power is cancellation. The worst case is a deadlock on new mints until the key is replaced — and replacing it goes through the same timelock, which a hostile guardian could keep vetoing. This is a known, accepted property: stalling supply growth is the safe failure mode.
- Renouncing ownership would permanently freeze supply. If the timelock ever renounced ownership of the token, minting would be impossible forever. That's treated as a feature — an available, irreversible "supply lock" — not a bug.
Future on-chain governance #
The timelock administers its own roles. When the society is ready for token-holder voting, a Governor contract can be granted the proposer role through the timelock itself — proposals that pass a public vote would then queue mints through this same pipeline. No change to the token contracts is required, and this path is covered by the test suite.
Addresses (Base Sepolia rehearsal) #
| Timelock | 0xb79827304058Ddc7425ae39425A538BDa6Ee93F2 (delay 600s) |
| Governance Safe | 0xbc768e681a06a91208247e7ee9f434fce3bd71a9 |
| Treasury Safe | 0x74aed8787ba283fa283f875dfe76632e00e9e7b7 |
The treasury Safe is the destination for all mints, the source of merge-offer escrow, and the recipient of everything swapped in.