Volt & Channel
These programs are owned by a special Solana runtime entity, the BPF Upgradable Loader program. To update the program code, the team uses the keypair associated with the "upgrade authority" public key to sign a transaction approving a copy of code from an on-chain buffer to the program address. The keypair will be moving to a multisig shortly.
There is currently no timelock or governance process used to secure program upgrades, as Friktion is in ship mode and there is not yet a public token to facilitate governance decisions. However, any new fix or feature is reviewed carefully by the entire backend team before being pushed to mainnet. Additionally, we conduct a quarterly audit of the codebase. Our last audit took place in June 2021. Read more about it here.
We are currently closed source as we ready the codebase to go open source and embrace anyone in the community willing to contribute.