Economic Design Objective

ontracts that hold user funds need to be changeable when a flaw is discovered, and resistant to being changed on a whim. Those two requirements pull in opposite directions, and the protocol's change-control design is the answer to that tension, not an attempt to avoid it.

Upgrade pattern. Quantix's contracts are upgradeable through a proxy pattern, allowing fixes and improvements to be deployed without forcing lenders, borrowers, or delegates to migrate to new contract addresses. The tradeoff is explicit: an upgradeable system depends on the integrity of whoever holds upgrade authority, so the value of this design rests entirely on the constraints placed around that authority.

Who can change what. No single address can unilaterally upgrade a contract, alter a parameter, or trigger an emergency pause. Every one of these powers sits behind a 2-of-3 multi-signature wallet, meaning at least two independent signers must agree before any privileged action takes effect.

Constraints on change. Beyond requiring multiple signers, sensitive changes are also subject to a 24–48 hour timelock between being proposed and taking effect. This delay exists specifically to give lenders, borrowers, and integrators a window to see a change coming and react to it, rather than discovering it only after it has already happened.

Observability. Every privileged action — an upgrade, a parameter change, a pause — executes as a transaction on a public chain. Nothing here happens in a private system that only the protocol can see; the same record a lender can check for their own position is the record that shows whether the protocol itself has changed underneath them.

Taken together, this is what change control is for: giving an institution a concrete basis to trust that the protocol won't be quietly re-parameterized or unilaterally altered by a single party. A 2-of-3 multisig with a 24–48 hour delay is a real, verifiable answer to that question — not a promise, but a mechanism a lender can check for themselves.