Contract Set

Responsibilities, ownership, mutability, and trust boundaries across the latest Deepstate deployment.

The latest deployment combines the Deepstate matching engine with token, vault, governor, and one NVDA/USDG rewarder. None of the Deepstate contracts uses a proxy.

Components

Contract	Responsibility	Privileged surface	Upgradeable
`DeepstateV1`	Multi-pool radix-tree order book, matching, collateral, settlement, fees, and hooks	Global fee config; one hook and side flags per pool	No
`DeepstateToken`	DEEP ERC-20, role-based minting, holder burn	Administer `MINTER_ROLE` and other AccessControl roles	No
`DeepstateVault`	Burn DEEP, mint voting STATE, hold value and fee assets, redeem selected assets, sell listed fee balances for USDG	Ownership exists, but current economic entry points have no owner-only configuration	No
`DeepstateGovernor`	STATE proposals, voting, execution, and self-settings	Governance-only settings and arbitrary proposal execution	No
NVDA/USDG `DeepstateRewarder`	Track top bid and ask and distribute a fixed 1B DEEP allocation	Ownership transfer; economic settings and funding path are immutable	No

Ownership after deployment

The deployment script makes DeepstateGovernor:

DEFAULT_ADMIN_ROLE holder for DEEP;
owner of DeepstateV1;
owner of DeepstateVault; and
owner of the NVDA/USDG rewarder.

The deployer renounces DEEP's admin role. It also revokes the temporary mint role used to fund the rewarder. The rewarder receives the complete 1 billion DEEP allocation but no MINTER_ROLE. An optional external DEEP_MINTER is granted only when a nonzero address is supplied.

The script verifies ownership, role handoff, rewarder funding, engine pointers, pool hooks, governance start, proposal threshold, and quorum before it exits.

Router

DeepstateV1 has two owner-only configuration surfaces:

setFeeConfig(recipient, bps), with a hard 100 bps maximum; and
setPoolHookConfig(token0, token1, hook, token0Active, token1Active).

Order placement, matching, cancellation, proceeds collection, pool identity, and views are permissionless. There is no pool allowlist or owner-only pool creation.

Hooks are gas-capped and best-effort. Their failure does not revert matching. The engine reports outgoing orders in sold-token units and exposes current top nonce and amount for claim-time checks.

Token and vault

DEEP is an OpenZeppelin ERC-20 with holder burn and AccessControl. The token has no total supply cap. The launch reward allocation is fixed by deployment and prefunding, not by a token-level cap.

STATE combines ERC-4626 deposit accounting with ERC20Votes and an ERC-6372 timestamp clock. DEEP deposits are burned, while vault value exits through the explicit redemption paths below.

The vault has two explicit exit paths:

redeemValue burns STATE for pro-rata USDG; and
redeemAssets burns STATE for pro-rata balances of a caller-supplied list of ERC-20s and native ETH.

buyFees lets anyone pay exactly 10,000 USDG to receive complete vault balances of explicitly listed non-protected assets. DEEP, STATE, USDG, and duplicate entries are rejected. There is no auction controller, oracle, owner sweep, or wrapped-native conversion.

Governor

The governor uses OpenZeppelin modules for settings, simple vote counting, token votes, quorum fraction, and late-quorum protection. It adds an immutable launch start, a percentage-based proposal threshold, and a timestamp-clock requirement.

There is no timelock or guardian. Successful proposals execute directly from the governor.

Rewarder

The NVDA/USDG rewarder has immutable engine, reward token, pool, token pair, per-side cap, duration, and quantity schedule. It packs each side's current nonce, top start, activation time, and total accrued amount into one storage word.

Only the immutable engine may advance reward cursors. registerClaimant caches an engine-verified owner before order deletion. registerClaimants provides a same-owner batch path. Distribution resolves the claimant, settles a still-live top against topOrder, clears accounting before transfer, and pays from the prefunded DEEP balance. distributeRewardsBatch aggregates multiple same-owner claims into one transfer.

See Reward Model and Claiming Rewards.

Interface boundary

The contracts contain no listing registry for deepstate.sh and no Deep State Incorporated interface fee. Those are company and interface policies. The onchain router's protocol fee is separate and governed by STATE.