ADR-0018: The Solieum token is a governance token: it governs the economic surface and pays for work, and is never gas and never collateral

Solieum is a rollup. Its security is Solana's finality plus anyone's ability to prove a bad root wrong; nothing is mined and no validator set of its own decides state (the GitBook once claimed one, and ADR-0001…

Status: accepted. Dated 2026-09-05.

2026-09-05. Status: ACCEPTED (owner, 2026-09-05; the token is not issued and nothing on the site changes until the issuance conditions in §4 hold). The owner directed that a Solieum token will serve every role other than gas, which stays SOL only, and named it: a governance token — the pattern of ARB, OP and ZK, whose chains charge gas in ETH and are governed by their token. This ADR fixes what the token governs, what it pays for, and what it must never touch. The token is not issued; nothing here changes the site, which truthfully says so and has promised to announce a token there first (the consistency checklist is §7). Supply, emissions, allocation and address are deliberately not decided here. This is not legal or tax advice.

1. Context

Solieum is a rollup. Its security is Solana's finality plus anyone's ability to prove a bad root wrong; nothing is mined and no validator set of its own decides state (the GitBook once claimed one, and ADR-0001 scrubbed it). A token therefore secures nothing by being gas, which is why the 2026-09-02 decision made SOL the gas asset and why ADR-0017 keeps the whole fee path in SOL. What a rollup does have is work — proposing roots under bond, verifying every root, challenging bad ones, sequencing under a stake, fronting withdrawals — and today that work is done by the operator or by nobody. The token exists to turn "please run a verifier" from a favour into an income once those roles open to outsiders.

The withdrawn draft of 2026-08-13 (TOKEN-IDEA.md) already had this shape. This ADR promotes it to a decision and draws the two lines the owner's direction needed drawn.

2. Decision

The token governs the chain's economic surface and pays for its settlement work. It is never the asset users pay with, and never the collateral that secures user funds.

2a. What it governs

Token holders decide, through an on-chain vote program that does not exist yet, the parameters and spending that are economic rather than security-bearing:

Token holders do not decide, because these are the security of the chain and live in code changed by redeploy: the challenge window and its unit (ADR-0016), the air gap and who may deny a root (ADR-0015), the dispute authority, the one-step classes and their boundaries (ADR-0008, ADR-0011), the state commitment (ADR-0007), the supply rule (ADR-0013). Program upgrade authority stays with the operator's keys until a separate ADR hands it to a governance-controlled multisig with a timelock; a vote that could change the security constants would make the token the security, which it must not be.

2b. What it pays for

Three rules keep it honest:

1. No fee-path role. Gas is SOL; priority bids are SOL; the bridge fee is SOL. The Starknet-style discount reserved on 2026-09-02 is withdrawn. A user never needs the token to use the chain.
2. No collateral role for user funds. A bond collateralised by a token that crashes exactly when slashing matters is a circular guarantee (ADR-0013). Bonds that secure user funds or pay a challenger are SOL, and stay SOL even if the token is worth more.
3. Rewards are paid for settlement that held, never for settlement promised. A reward is pending until the window closes; a refuted root pays the challenger.

3. Why these roles and not others

• Why not gas. Answered in ADR-0017 §4 and TOKEN-IDEA.md: a bridge-then-swap step before a user's first transaction, an exposure between the fee asset and the L1 cost asset, a harder regulatory posture, for gas revenue that is negligible. The one rollup that made its token the fee asset did so years in, once the token was liquid, and converts fee revenue back to the L1 asset every block.
• Why not bonds. The bond's job is to pay the challenger enough to make challenging worth doing (fees.rs, max_defensible_steps). It has to be worth that amount on the day a fraud is found, which is the day a protocol token is least likely to be.
• Why liquidity incentives. The 48-hour window is a product only if fast exits exist, and fast exits exist only if capital is parked behind them. That capital is SOL and earns its spread in SOL; the token is the bootstrap, the way every liquidity programme has worked.
• Why governance first. It is the role the largest rollups gave their tokens: Arbitrum, Optimism and zkSync charge gas in ETH and are governed by ARB, OP and ZK. It answers the question "why does this chain have a token" without touching the fee path, and it gives the work roles a constituency that sets their rewards.
• Why governance is bounded. A token vote that could shorten the window or move the dispute authority would make the token the security, which it must not be. The governable set is the economic surface.

4. Issuance conditions

The token is issued when at least one of these is true, and not before:

1. sequencing opens to staked outsiders;
2. verifier coverage needs paying rather than volunteering;
3. fast-exit liquidity needs bootstrapping beyond what SOL fees attract;
4. decisions on the economic surface (§2a) need a constituency wider than the operator — a treasury to allocate, a fee schedule to set, a sequencer set to admit.

Until then the chain runs on SOL, the roles are the operator's, and the site says no token exists. Non-transferable points for early verifiers, challengers and providers may be recorded before issuance and honoured at issuance; that is a decision for the issuance ADR.

5. What is deliberately undecided

Supply, emissions, allocation, vesting, the mint address, the chain it is minted on, and whether the treasury buys it with SOL revenue. Each is a decision with reasons, recorded when taken. Until the address row on the token page has a value, every address claiming to be the token is a scam, and the page will say so.

6. Consequences

• ADR-0017 and this ADR partition every economic role between SOL and the token; a proposal that puts the token in the fee path or in a bond reopens both.
• The reward paths need protocol work when their conditions arrive: a reward ledger keyed by root number, a coverage attestation the verifier signs, a sequencer registry with stake and slashing, a provider registry with incentive accounting. None exists today; none is needed until §4.
• The 2026-09-02 memory line "a token, if any, is the stake/bond asset with a later fee-discount option" is superseded: governance yes, stake yes, bond no, fee discount no.
• A governance program, a treasury account under its control, and a timelocked path from the operator's upgrade keys to governance are new protocol surface, each its own ADR when the issuance conditions arrive.

7. Consistency checklist for issuance day

Nothing below is done now; the site must keep saying "no token" until the owner says otherwise, and it has promised to announce there first.

• [ ] FAQ answers "Is there a token?" and "Is there a fee token…": from "none issued" to planned or issued, and drop "optional fee discount".
• [ ] Investors fact row Token: None issued.
• [ ] Restore website/src/pages/Token.tsx, the /token route, the nav item, pageMeta.token, sceneForPath('/token').
• [ ] The fees page: unchanged — it already says fees are SOL and no token is required; that sentence stays true forever under this ADR.
• [ ] TOKEN-IDEA.md becomes historical; this ADR is the reference.