Protocol Architecture Overview

GNDX Protocol is composed of 19 implementation smart contracts deployed on Arbitrum One. Each contract has a specific, narrow purpose and interacts with others through tightly-scoped role-based access control.

System Diagram

┌─────────────────────────────────────────────────────────┐
│                    USER INTERFACE                        │
│              gndx.finance (Next.js + Wagmi)             │
└────────────────────────┬────────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────────┐
│                  ARBITRUM MAINNET                        │
│                                                          │
│  ┌────────────┐    ┌─────────────┐    ┌────────────┐   │
│  │ MintEngine │    │  IndexVault │    │RedeemEngine│   │
│  └──────┬─────┘    └──────┬──────┘    └─────┬──────┘   │
│         │                 │                  │           │
│  ┌──────▼─────┐    ┌──────▼──────┐    ┌─────▼──────┐  │
│  │ NAVOracle  │    │ Rebalance   │    │ GAMEToken  │   │
│  └──────┬─────┘    │ Controller  │    └─────┬──────┘   │
│         │          └─────────────┘          │           │
│  ┌──────▼─────┐    ┌─────────────┐    ┌─────▼──────┐  │
│  │  Chainlink │    │FeeCollector │    │   VeGAME   │   │
│  │  Oracles   │    └──────┬──────┘    └─────┬──────┘   │
│  └────────────┘    ┌──────▼──────┐    ┌─────▼──────┐  │
│                    │  Governor   │    │  GNDXToken │   │
│                    └──────┬──────┘    └────────────┘   │
│                    ┌──────▼──────┐                      │
│                    │  Timelock   │                       │
│                    └─────────────┘                      │
│                                                          │
│  ┌──────────────────────────────────────────────────┐  │
│  │         Guardian Multisig (5-of-8)               │  │
│  └──────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────┘
                         │
         ┌───────────────▼──────────────┐
         │        Uniswap V3 Pools       │
         │   $GNDX/USDC   $GAME/USDC    │
         └──────────────────────────────┘

Contract Dependency Map

GNDXToken.sol
  ├── Minted by: MintEngine.sol (MINTER_ROLE)
  └── Burned by: RedeemEngine.sol (BURNER_ROLE)

GAMEToken.sol
  ├── 200M minted to treasury at genesis — no further minting
  └── Locked by: VeGAME.sol

IndexVault.sol
  ├── Deposits: MintEngine.sol (MINTER_ROLE)
  ├── Withdrawals: RedeemEngine.sol (REDEEMER_ROLE)
  ├── Weight updates: RebalanceController.sol (REBALANCER_ROLE)
  └── Emergency pause: GuardianMultisig.sol (GUARDIAN_ROLE)

NAVOracle.sol
  ├── Reads: Chainlink price feeds
  └── Called by: MintEngine, RedeemEngine, FeeCollector

FeeCollector.sol
  ├── Receives fees from: MintEngine, RedeemEngine
  └── Distributes to: Treasury (65%), Burn (10%), VeGAME (25%)

Governor.sol
  ├── Reads voting power from: VeGAME.sol
  └── Executes via: Timelock.sol

GuardianMultisig.sol
  └── Can only call: IndexVault.pause()

Data Flows

Mint Flow

1. User deposits USDC → MintEngine
2. MintEngine validates NAV via NAVOracle
3. For orders > $50K: 1h TWAP over 4 chunks; for orders below $25K: instant; $25K–$50K uses a probabilistic fuzzy zone with per-address and global rate limiting
4. Mint routing purchases routable basket tokens via DEX adapter (skips excluded/inactive)
5. Tokens deposited to IndexVault
6. GNDXToken mints $GNDX to user at completion NAV

Redeem Flow

1. User transfers $GNDX to RedeemEngine
2. Exit fee (0.20%) transferred to FeeCollector in $GNDX
3. Proportion calculated from pre-burn total supply
4. Remaining $GNDX burned
5. User receives: basket tokens (always available, even during oracle outages) OR USDC (via DEX adapter) OR overweight token with 0.22% bonus

Governance Flow

1. Proposal submitted to Governor.sol (requires 1,000 veGAME)
2. 7-day voting period — 66% supermajority required
3. Timelock: 48h standard, 7 days for upgrades and high-stakes actions
4. After timelock: anyone calls execute() — Governor enforces parameter bounds

Emergency Flow

1. Guardian Multisig (5-of-8) calls IndexVault.pause()
2. Protocol paused for max 72 hours — auto-expires
3. Guardians cannot extend pause; community can unpauses via governance

Upgrade Strategy

All contracts use UUPS (Universal Upgradeable Proxy Standard):

• Logic contracts are upgradeable; state is preserved in proxy
• _authorizeUpgrade() requires UPGRADER_ROLE (held by Timelock only)
• All upgrades require governance vote + 7-day timelock
• _disableInitializers() in every implementation constructor
• Deployer EOA renounces all admin roles at end of deployment script

---

See also: Smart Contracts · Security