Security and the SIGIL

Who holds what

token	held by	can
stream NFT	the person being paid	Claim, Collect
SABLITAL-ADMIN-n	the employer, day to day	create streams, Withdraw free DIESEL, Amend, Extend, Bonus, Advance, Cancel, Authorize, Revoke
SABLITAL-SIGIL-n	the employer, offline	SigilSweep and SigilRepoint on the pool and its streams

What can never happen

Nobody chooses the price. A payday is priced at the oracle's value as of that day, read from an on-chain history. Collecting early or late, or settling at a convenient moment, can't change it.
The admin can't take back vested pay. Paydays already due survive a Cancel. A shortfall becomes debt that Withdraw can't touch. Lowering a stream's cap or revoking it doesn't wipe its debt.
A stream can't drain the pool. It can only draw what it has vested, and only up to its cap. Only streams the admin authorized can draw at all.
A broken oracle can't trap funds. Collect and Cancel don't touch the oracle, and the SIGIL can move streams to a new price source.
A crashed price can't overpay. Each stream has a price floor and an optional DIESEL cap per payday.

The SIGIL failsafe

Each pool mints a second token, the SIGIL, which belongs in an offline wallet. It exists for the case where something has gone badly wrong: a bug, a lost admin key, a dead oracle.

SigilSweep on the pool takes any token the pool holds, ignoring debt and reservations.
SigilSweep on a stream takes what that stream holds and freezes the stream for good.
SigilRepoint moves the pool (for new streams) or a stream to a new pricebook.

Neither sweep calls any other contract, so nothing else can block it.

The SIGIL is the one key that can take back pay that has already vested. That is the price of a failsafe that works no matter what. Keep it offline, and use it only when the alternative is losing the funds.

The price feed

DIESEL/USD comes from TUNDRACLE, which takes a 144-block median of the DIESEL/frBTC pool and multiplies it by BTC/USD. The pricebook copies every oracle write into an append-only history keyed by the block the oracle wrote it in, along with a log of block times. If the oracle goes quiet for too long, paydays wait for its next update rather than pay at a stale price.

Audit

The payroll contracts were reviewed in October 2026 before launch. Every high and medium finding was fixed and has a regression test, and the remaining design trade-offs are documented. The original vest contracts went through an audit and a pentest in June 2026.