Protocol

Upgradeability and roles

Upgradeable core

Contract	Pattern	Authority
Ledger	UUPS + Ownable2Step	Accepted owner `0x7B64129635102f7bE831688CF20B4c900fba1653`
Vault	UUPS	`msg.sender == Ledger.owner()`; candidate must match immutable beacons, Ledger, veBTC, and veMEZO
VeNftManager / RewardSink	Beacon proxies	Beacons owned by the Ledger. Owner calls `upgradeManagerBeacon` / `upgradeRewardSinkBeacon`

Immutable ID20 package

Id20Factory, AuroveId20, Id20Gauge, AuroveZapRouter, SwapAdapter, and LiquidityAdapter have no owner, pause, or proxy. A wrapper snapshots vault.rewardSinkOfTranche at creation and does not follow a later vault remapping.

Permissionless versus restricted

Anyone: deposits, redeem, claimRebases(trancheId, tokenIds), sink claims, ID20 wrap/unwrap/harvest, gauge activate/claim/settle, factory get-or-create, zap entrypoints, executeFeeConfig, claimFreeManagedRewards.
Ledger owner: UUPS upgrades, one-time setLockedVault, fee proposals, beacon upgrades, manager maintainer allowlists, createBoostGauge.
Vote maintainers: vote, claimBribes, claimFees, selected reward claims.
Swap maintainers: withdrawTokens from a manager.

Admin functions are not user integration paths. Addresses: Deployment reference.

protocolupgradeownerrolestrust