> For the complete documentation index, see [llms.txt](https://quantixfinance.gitbook.io/quantixfinance-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://quantixfinance.gitbook.io/quantixfinance-docs/protocol-economics-and-fees/economic-design-objective.md).

# Economic Design Objective

ontracts that hold user funds need to be changeable when a flaw is discovered, and resistant to being changed on a whim. Those two requirements pull in opposite directions, and the protocol's change-control design is the answer to that tension, not an attempt to avoid it.

**Upgrade pattern.** Quantix's contracts are upgradeable through a proxy pattern, allowing fixes and improvements to be deployed without forcing lenders, borrowers, or delegates to migrate to new contract addresses. The tradeoff is explicit: an upgradeable system depends on the integrity of whoever holds upgrade authority, so the value of this design rests entirely on the constraints placed around that authority.

**Who can change what.** No single address can unilaterally upgrade a contract, alter a parameter, or trigger an emergency pause. Every one of these powers sits behind a 2-of-3 multi-signature wallet, meaning at least two independent signers must agree before any privileged action takes effect.

**Constraints on change.** Beyond requiring multiple signers, sensitive changes are also subject to a 24–48 hour timelock between being proposed and taking effect. This delay exists specifically to give lenders, borrowers, and integrators a window to see a change coming and react to it, rather than discovering it only after it has already happened.

**Observability.** Every privileged action — an upgrade, a parameter change, a pause — executes as a transaction on a public chain. Nothing here happens in a private system that only the protocol can see; the same record a lender can check for their own position is the record that shows whether the protocol itself has changed underneath them.

Taken together, this is what change control is for: giving an institution a concrete basis to trust that the protocol won't be quietly re-parameterized or unilaterally altered by a single party. A 2-of-3 multisig with a 24–48 hour delay is a real, verifiable answer to that question — not a promise, but a mechanism a lender can check for themselves.