The burn / recycle vote

Status#

This is the platform’s first governance surface, and it is deliberately the narrowest one that can exist: a single boolean, decided monthly by THD holders, with no keeper, no override and no key that can set it. The platform is never a destination under either outcome.

The question on the ballot#

The THD/ETH pool takes a fee on both sides of a swap, and the two legs are in different currencies. Only one of them is in question:

There is no third branch, and the platform is not one of the two.

The calendar#

1. A vote’s id is the month index, year × 12 + (month − 1). A vote opens at 00:00:00 UTC on the 1st and closes 24 hours later.
2. The snapshot is 7 days before it opens, so it falls on the 25th or the 22nd of the previous month. Nobody chooses it; it is derived.
3. The owner publishes the LP Merkle root during those 7 days — setLpRoot is refused before the snapshot and frozen absolutely from the instant the vote opens. The 7 days exist only so the root can be built and checked; the wallet half needs no root at all.
4. openVote() is permissionless and takes no arguments. It does not start a window — the calendar does — it materialises the record for a month whose window has already begun, and it refuses once the window has closed.
5. finalise(voteId) is permissionless and runs after the close.

The clock is a timestamp, not a block number, because THD overrides clock() and CLOCK_MODE(). A block-number clock would shift every offset at once, in the same direction, whenever block time moved — and every off-chain reader would compute the wrong snapshot and never find out, because the call still returns a number.

Votes finalise in order: a vote id at or below the last finalised one is refused, so a month nobody opened cannot later drag the flag backwards.

Weight, and the four-sample ramp#

Wallet weight is the arithmetic mean of THD.getPastVotes at four instants — the snapshot, and 7, 14 and 30 days before it:

samples = [ snapshot, snapshot - 7 days, snapshot - 14 days, snapshot - 30 days ];
weight  = ( Σ thd.getPastVotes(account, samples[i]) ) / 4;

A hard 30-day cutoff was considered and rejected: a cliff would stop the people the LP programme is spending 10% of supply to attract from voting on whether it continues.

No delegation transaction is needed. THD auto-self-delegates on an address’s first receipt, so an ordinary holder has voting power without ever having thought about it. A Safe or any other address with code does not auto-delegate and must delegate manually.

LPs read zero from getPastVotes, because their THD sits inside a Uniswap V4 position. They prove weight instead against the published root, with a leaf of keccak256(abi.encode(voteId, account, lpWeight)), and the proven weight is added to their wallet weight and cast as one ballot on one side. If no root is published for a month, LPs lose their vote that month and the wallet half is unaffected.

One ballot per address per vote, and it cannot be changed. A zero-weight ballot is refused rather than silently counted as an abstention.

Who does not vote#

The principle: THD votes when it belongs to somebody who could sell it.

The threshold, and the sticky default#

// ThdVoting.finalise
outcome = router.thdBurn();                 // the sticky default: whatever is in force
total   = burnVotes + recycleVotes;

if (total != 0) {
    if (burnVotes    * 10_000 >= THRESHOLD_BPS * total) { outcome = true;  decided = true; }
    else if (recycleVotes * 10_000 >= THRESHOLD_BPS * total) { outcome = false; decided = true; }
}

There is no quorum, and the threshold is expressed in basis points so the comparison is exact integer arithmetic rather than a percentage that has been rounded.

What applies the result#

finalise writes the flag by calling ThdFeeRouter.setTHDBurn(bool), and only when the vote decided something that differs from the flag already in force. Access control on that setter is one line: the caller must be the immutable voting address. There is no owner, no guardian and no override on the router at all.

ThdLpRewards pays liquidity providers against a cumulative Merkle root the owner publishes. A claim pays cumulative − claimedOf[account] and always pays the address the root names, never the caller — so a claim can be relayed, batched or sponsored without the relayer redirecting a wei. A cumulative root that went backwards is refused in the claimant’s own transaction, which is what makes a replaceable root safe: a restatement can never become a clawback. There is no deadline, no expiry and no sweep, and no owner path moves THD out.

The LP allocation is 1,000 bps of supply — 100,000,000 THD, paid to ThdLpRewards as its bucket beneficiary — and recycled fee THD arrives in the same balance with no accounting that distinguishes them. See the eleven allocations.