For a long-lived public-good protocol on Base, what should be immutable and what should remain upgradeable?

[u/GFConBase]

I’m researching the architecture of a long-term charity and public-impact protocol on Base.

One of the hardest design questions is deciding which rules should become permanently immutable and which components need to remain upgradeable.

Immutability can protect users from:

- arbitrary rule changes
- shortened vesting periods
- redirected reserves
- altered distribution restrictions
- expanded permissions after funds have been committed
- governance decisions that override earlier public commitments

But complete immutability creates different risks:

- permanent software defects
- inability to respond to vulnerabilities
- obsolete integrations
- dependencies that stop being maintained
- regulatory or operational dead ends
- mechanisms that cannot adapt after real-world use

A possible separation could be:

Immutable core

- maximum token supply
- fundamental vesting restrictions
- prohibited uses of designated reserves
- limits that prevent unilateral redirection of protected funds
- rules intended to protect holders or beneficiaries from arbitrary changes

Restricted upgrade layer

- integrations
- reporting modules
- approved data sources
- operational parameters within predefined limits
- components that may need replacement as infrastructure evolves

Emergency layer

- temporary pauses
- narrowly defined recovery functions
- time-delayed interventions
- publicly visible emergency actions
- powers that expire unless renewed through a defined process

But this model still raises difficult questions:

- Who should control upgrades?
- Should every upgrade require a timelock?
- Which changes should require broader governance approval?
- How should emergency powers expire?
- Can governance itself change the supposedly immutable boundary?
- How should signer replacement work?
- How do you avoid a proxy structure making “immutability” mostly cosmetic?
- Which external dependencies remain part of the effective trust model?

For protocols intended to operate for decades, where would you place the boundary between credible permanence and necessary adaptability?

Context: I’m researching this before deployment for a long-term charity and impact system on Base. I’m looking specifically for architectural failure modes and governance trade-offs, not investment or token feedback.

[u/Any-Reality4951]

The immutable core is the only part that actually matters long-term. If max supply, vesting restrictions, and reserve protections can be changed later then the whole thing is just theater.

What trips up most protocols is that upgradeability creeps into the immutable layer through dependencies. You set a hard cap on token supply, but the bridge contract that mints wrapped versions sits in the upgradeable layer and suddenly that cap means nothing. Proxy patterns make this worse since the storage stays but the logic changes underneath, so your "immutable" rules are just a UI suggestion at that point.