ENNI is a project that exists to steward and build applications that are immutable, efficient, minimal and as permissionless as possible. the community are skeptical of DAOs, done with governance politics, and just want to build and use things that work.

the primary product is the ENNI Protocol, a decentralized lending and multi-currency stablecoin system on Ethereum.

ENNI Protocol

ENNI is a decentralized lending and stablecoin protocol on Ethereum. It’s best to clarify as an overcollateralized CDP project. It has no governance, no admin keys, and no upgradeability. Once deployed and ownership is renounced, the code is the final authority.

The protocol is currency-agnostic. Each stablecoin is an independent deployment of the same code with its own CDP, oracle, and collateral pool. Adding a new currency requires no upgrades and no governance. just deploy.

ENNI — fixed supply of 21,000,000. Distributed over 30 years through farming. Stakers earn protocol revenue and donations.

Currently live stablecoins:

• enUSD — USD-pegged. Minted 1:1 against USDC/USDT via DirectMint, or borrowed against WETH at 0% interest.
• enCHF — CHF-pegged. Borrowed against WETH at 0% interest. No DirectMint. Same dual-feed oracle (Chainlink + Chronicle for ETH/USD), translated through a Chainlink CHF/USD feed.

More currencies (enEUR, enJPY, …) can be added in the future by anyone. same contracts, new constructor args.

How It Works

Deposit WETH into a CDP, borrow stablecoins at 0% interest with no fees. Instead of forced redemptions that punish borrowers, ENNI uses a voluntary buyout system where arbitrageurs restore the peg by purchasing collateral at a premium. Borrowers are compensated, not penalized.

All protocol revenue like liquidation proceeds and redemption fees flows directly to ENNI stakers. No treasury, no team allocation, no governance fund.

Each market is fully isolated. enUSD and enCHF have separate collateral pools, separate oracles, and separate liquidation states. A problem in one market cannot affect another.

While ENNI starts as a lending and stablecoin protocol, anyone can freely build on top of it. GameFi, NFTs, DeFi, or anything else. The ENNI Registry indexes community built projects that align with the core doctrine: immutable, governanceless, and autonomous.

How ENNI Compares

Feature	MakerDAO	Liquity v1	ENNI
🏦 Collateral	Multi-asset	ETH	ETH (Wrapped ETH)
💵 Stablecoin	DAI	LUSD	enUSD, enCHF, …
💸 Interest / Fees	Variable interest	0.5% one-time fee	0% always
🗳️ Governance	MKR voting	None	None
🔑 Admin Keys	Yes (multisig)	None	None post-renouncement
🔄 Upgradeable	Yes	No	No
🔁 Redemption Model	N/A	Forced (borrowers penalized)	Voluntary buyout (borrowers compensated)
🛡️ Peg Defense	PSM + governance	Redemption + liquidation	DirectMint floor + buyout arb + liquidation
⚡ Liquidation Buffer	Auction system	Stability Pool	External liquidators (~10% profit)
💰 Staker Revenue	MKR buyback	LUSD + ETH fees	ENNI + WETH + stablecoin donations
🌐 Multi-currency	No (DAI only)	No (LUSD only)	Yes (deploy per currency)
📜 Core Contracts	30+	12+	6 per currency

Principles

• Immutable contracts. No upgrades, no proxies.
• No admin keys after ownership renouncement.
• No governance votes. No DAO politics.
• All value flows back to token holders.
• Trust. But verify!

How Stablecoins Work

ENNI issues overcollateralized stablecoins pegged to fiat currencies. Each stablecoin is an independent deployment of the same CDP contract with its own oracle and collateral pool.

This is the primary product that launched with ENNI. All current markets share the same parameters (85% max LTV, 88% liquidation threshold, 400 minimum debt, etc.) and are immutable. Future CDPs built by the community may use different parameters, different collateral types, or entirely different designs. anyone can deploy on top of ENNI.

Currently live:

• enUSD — pegged to USD. Has DirectMint (1:1 USDC/USDT minting and redemption) and CDP borrowing.
• enCHF — pegged to CHF. CDP borrowing only. No DirectMint.

Both have 6 decimals and no supply cap.

Minting

DirectMint (enUSD only)

Deposit USDC or USDT, receive enUSD 1:1. No fees on minting. The deposited stables stay in the DirectMint contract and back future redemptions. This is the simplest path to enUSD.

enCHF does not have a DirectMint because there are no widely available on-chain CHF stablecoins to back it.

CDP Borrowing (all currencies)

Deposit WETH as collateral, borrow stablecoins against it at 0% interest. No borrowing fees. Maximum loan-to-value is 85%. Minimum debt is 400 units of the stablecoin (e.g. 400 enUSD, 400 enCHF). Stablecoins are minted fresh when borrowed and burned when repaid.

This works the same way for every currency. The only difference is the oracle. enUSD uses ETH/USD pricing directly. enCHF uses the same dual-feed ETH/USD oracle (Chainlink + Chronicle) translated through a Chainlink CHF/USD feed.

Redeeming (enUSD only)

Redeem enUSD back to USDC or USDT through DirectMint at a 1:1 rate minus a 0.5% fee. The fee is donated to the Rewards Vault as protocol revenue for ENNI stakers. Redemption is only available against the specific stablecoin that was deposited. If 1M USDC was minted through DirectMint but 0 USDT, you can only redeem to USDC.

enCHF has no redemption mechanism. The only way to exit an enCHF position is to repay the CDP debt.

Peg Defense

All stablecoins share the buyout and liquidation peg defense mechanisms. enUSD has an additional layer through DirectMint.

1. Hard Floor — DirectMint Redemption (enUSD only)

Anyone holding enUSD can redeem it for USDC or USDT at $0.995 (1:1 minus the 0.5% fee). This creates a hard price floor. If enUSD trades below $0.995 on the open market, arbitrageurs buy it cheap and redeem for a profit until the price recovers.

enCHF does not have this layer. Its peg relies entirely on buyout arbitrage and liquidation.

2. Market Recovery — Buyout Arbitrage (all currencies)

If a stablecoin drops below its peg, the buyout system kicks in. Arbitrageurs buy the discounted stablecoin on the market and use it to purchase borrowers’ WETH collateral at oracle price through the CDP. Even after paying a 4–9% premium to the borrower, the discount makes the trade profitable. This creates sustained buy pressure on the stablecoin.

3. Liquidation (all currencies)

Positions that reach 88% LTV are liquidated. Liquidators repay the debt in the corresponding stablecoin and receive collateral at a discount. This removes undercollateralized debt from the system and maintains the overall health of the stablecoin’s backing.

Supply and Backing

For enUSD: supply minted through DirectMint is fully backed 1:1 by USDC/USDT sitting in the contract. Supply borrowed through the CDP is overcollateralized by WETH at a minimum of 117.6% collateral ratio (85% LTV).

For enCHF: all supply is borrowed through the CDP and overcollateralized by WETH at the same 117.6% minimum collateral ratio.

No stablecoin has fractional reserve or unbacked minting.

Buyout System

The buyout system is ENNI’s alternative to forced redemptions. In protocols like Liquity v1, anyone can redeem their stablecoin against the lowest collateral ratio position without the borrower’s consent. The borrower loses collateral and gets nothing extra. ENNI replaces this with a voluntary, market-driven mechanism that compensates borrowers.

This works identically across all markets (enUSD, enCHF, and any future currency).

How It Works

A buyer selects a borrower’s position and specifies how much debt they want to repay. The buyer pays the repay amount plus a premium in the market’s stablecoin. In return, the buyer receives WETH collateral equal to the repay amount at oracle price. The borrower’s debt is reduced and they receive the premium as claimable stablecoin credit.

Example (enUSD market): A borrower has 1 ETH collateral and 2,000 enUSD debt at 80% LTV. ETH price is $2,500. A buyer repays 1,000 enUSD of the debt.

• Premium tier at 80% LTV: 6%
• Premium: 1,000 × 6% = 60 enUSD
• Buyer pays: 1,060 enUSD total
• Buyer receives: 0.4 ETH (1,000 / 2,500)
• Borrower’s debt drops to 1,000 enUSD
• Borrower earns 60 enUSD premium credit

The borrower’s position is now healthier. The buyer got ETH. The premium compensates the borrower for the collateral reduction.

Premium Tiers

The premium scales inversely with risk. Riskier positions are cheaper to buy out because the protocol wants them cleared first.

LTV Range	Premium
85.00% – 87.99%	4%
60.00% – 84.99%	6%
Below 60.00%	9%

At 85%+ LTV the position is close to liquidation. A 4% premium makes buyout attractive so the market clears these positions before they become liquidatable. Healthy positions below 60% LTV cost 9% to buy out, discouraging unnecessary interference with safe borrowers.

Peg Recovery

The buyout system is the primary peg recovery mechanism for all stablecoins. When a stablecoin trades below its peg on the open market, the arbitrage works like this:

1. Buy the discounted stablecoin on a DEX
2. Use it to buy out a borrower’s WETH collateral at oracle price (face value per unit)
3. Pay the premium (4–9%) from the discount
4. Net profit: ~6–11% depending on depeg severity and premium tier

The worse the depeg, the more profitable the arbitrage, the stronger the buy pressure. This is self-correcting without any governance action.

Rules

• If a position is liquidatable (88%+ LTV), buyout is blocked. Use liquidation instead.
• Remaining debt after partial buyout must be at least 400 units of the stablecoin or zero.
• Buyer cannot repay more than the total debt.
• Oracle must be fresh (within 24 hours).
• Premium credit is claimable anytime by the borrower via claimPremium() or returned on close().

Liquidation

Liquidation is the protocol’s last line of defense. When a position’s loan-to-value ratio reaches 88%, anyone can liquidate it. There are no fees for the liquidator. Profit comes from buying collateral at a discount.

This works identically across all markets (enUSD, enCHF, and any future currency).

How It Works

A liquidator selects an underwater position and specifies how much debt to repay. They pay that amount in the market’s stablecoin. In return, they receive a proportional share of the borrower’s collateral minus a 3% donation to the Rewards Vault.

The collateral seized is calculated pro-rata based on debt repaid:

collateralSeized = (position.collateral × repayAmount) / position.debt

Example (enUSD market): A borrower has 1 ETH collateral and 2,200 enUSD debt. ETH price is $2,500. LTV is 88%. A liquidator repays the full 2,200 enUSD debt.

• Collateral seized: 1 ETH (full position)
• Collateral value: $2,500
• Cost to liquidator: 2,200 enUSD ($2,200 face value)
• Donation: 1 ETH × 3% = 0.03 ETH to Rewards Vault
• Liquidator receives: 0.97 ETH (~$2,425)
• Liquidator profit: ~$225 (~10.2%)

Profitability

At the 88% LTV liquidation threshold, the liquidator is paying 88 cents per dollar of collateral value. After the 3% donation, net profit is approximately 10%. This is intentionally generous to ensure positions are liquidated quickly even in volatile markets.

As LTV increases beyond 88% (if price drops fast between blocks), the profit margin shrinks. At 100% LTV the position is underwater and liquidation becomes unprofitable. The 3% gap between max borrow (85%) and liquidation (88%) gives borrowers a buffer to add collateral or repay before liquidation triggers.

Partial Liquidation

Liquidators can repay any portion of the debt, not just the full amount. The collateral seized is always proportional to the share of debt repaid. Remaining debt after partial liquidation must be at least 400 units of the stablecoin or zero.

Donation

3% of all seized collateral is donated to the Rewards Vault in WETH. This applies to liquidations across all markets. The donation is the only fee in the liquidation process and it goes entirely to ENNI stakers. The donation is non-blocking. If the vault is unavailable, the liquidation still completes and the donation amount remains in the CDP contract.

Rules

• Position must be at 88%+ LTV to be liquidatable.
• Below 88% LTV, use the buyout system instead.
• Oracle must be fresh (within 24 hours).
• Liquidator cannot repay more than the total debt.
• Remaining debt after partial liquidation must be at least 400 units of the stablecoin or zero.

ENNI Token

ENNI is the protocol’s ecosystem token with a fixed supply of 21,000,000. No additional tokens can ever be minted beyond this cap. The supply model follows Bitcoin: scarce, predictable, and enforced by immutable code.

Supply Distribution

1,000,000 ENNI is allocated at deployment for contributors, early community members, and ecosystem bootstrapping. The remaining 20,000,000 is emitted over 30 years through the MasterChef farming contract.

Period	Annual Emission	Total
Year 1–2	2,000,000 ENNI	4,000,000
Year 3–10	1,000,000 ENNI	8,000,000
Year 11–30	400,000 ENNI	8,000,000

Total emitted by MasterChef: 20,000,000. Combined with the initial allocation: 21,000,000. The maxMintable cap is immutable and checked on every mint call.

Farming

ENNI is earned by staking LP tokens in the MasterChef. Up to 8 pools can exist, each with an allocation weight that determines its share of global emissions. Rewards are distributed per-second based on the emission schedule.

After ownership is renounced, no pools can be added or rebalanced. The allocation weights are locked permanently.

Staking

Stake ENNI in the Rewards Vault to earn protocol revenue. The vault auto-compounds farming rewards and distributes donations from the protocol:

• WETH from CDP liquidations across all markets (3% of seized collateral)
• enUSD from DirectMint redemptions (0.5% fee)
• ENNI from MasterChef farming (auto-compounded)

All protocol value flows to ENNI stakers. No treasury, no team cut, no governance fund.

Ownership and Immutability

At deployment, the token contract has an owner who can set two minter addresses and transfer or renounce ownership. This exists solely for initial configuration. The same EnniToken contract is reused for ENNI, enUSD, enCHF, and all future tokens. Once the minters are set for each token and ownership is renounced:

• No one can change minter addresses.
• No one can mint beyond the 21M cap (for ENNI) or outside authorized minters (for stablecoins).
• No one can pause, freeze, or modify the contract.

The token is a standard ERC20 with ERC20Permit for gasless approvals. Anyone can burn their own tokens.

Rewards Vault

The Rewards Vault is where ENNI stakers earn protocol revenue. Deposit ENNI, the vault stakes it in MasterChef on your behalf, auto-compounds farming rewards, and distributes all protocol donations directly to stakers.

What You Earn

Stakers earn three tokens simultaneously:

Token	Source
ENNI	MasterChef farming rewards, auto-compounded
WETH	CDP liquidation donations (3% of seized collateral, from all markets)
enUSD	DirectMint redemption fees (0.5% of redeemed amount)

Rewards accumulate per-share. You can claim anytime. Depositing and withdrawing auto-claims pending rewards.

How It Works

When you deposit ENNI, the vault forwards it to MasterChef and stakes it in the designated pool. Your shares are 1:1 with the ENNI deposited. The vault is not an ERC4626 vault. Rewards are tracked separately through per-share accumulators, not baked into the share price.

When anyone interacts with the vault (deposit, withdraw, claim), it harvests pending ENNI rewards from MasterChef and distributes them across all stakers proportionally. WETH and enUSD donations from other protocol contracts are distributed the same way. Note that all CDPs donate in WETH during liquidation, not in their native stablecoin. enCHF liquidation revenue arrives as WETH, same as enUSD.

Donations

Other protocol contracts send revenue to the vault through donation functions:

• donateWETH() — called by each CDP during liquidation. 3% of seized collateral is sent as WETH. This applies to all markets (enUSD, enCHF, and any future currency).
• donateEnUSD() — called by EnniDirectMint during redemption. The 0.5% fee is sent as enUSD.

Both functions use transferFrom, so the calling contract must approve the vault beforehand. This is handled automatically in each contract’s constructor.

If donations arrive while no one is staked, they are queued and distributed to the first staker who deposits.

Withdrawing

Withdraw your ENNI anytime. The vault pulls your share from MasterChef and returns it along with any pending rewards. There are no lockups, no cooldowns, and no withdrawal fees.

DirectMint

DirectMint is the simplest way to get enUSD. Deposit USDC or USDT, receive enUSD 1:1. Redeem enUSD back for a flat 0.5% fee. No slippage, no bonding curves, no AMM mechanics.

Minting

Call mintWithUSDC() or mintWithUSDT() with the amount of stables you want to deposit. The contract takes your stables and mints an equal amount of enUSD directly to your wallet. No fees on minting.

1,000 USDC in → 1,000 enUSD out.

The deposited stables stay in the DirectMint contract and back future redemptions.

Redeeming

Call redeemToUSDC() or redeemToUSDT() with the amount of enUSD you want to redeem. The contract takes your enUSD, deducts a 0.5% fee, burns the rest, and sends you the corresponding stablecoin.

1,000 enUSD in → 5 enUSD fee → 995 USDC out.

The fee is donated to the Rewards Vault as enUSD for ENNI stakers. If the vault is temporarily unavailable, the redemption still completes. The fee stays in the contract.

Liquidity

Redemption is limited to what has been deposited for each stablecoin. If 10M USDC has been minted through DirectMint but 0 USDT, you can only redeem to USDC. The contract does not swap between stables internally.

Role in Peg Defense

DirectMint establishes the hard price floor for enUSD. If enUSD trades below $0.995 on any DEX, arbitrageurs can buy it cheap and redeem through DirectMint for a guaranteed profit. This creates a natural price floor at approximately $0.995.

Combined with the buyout system (which recovers the peg from below) and liquidation (which maintains system health), DirectMint is the first and simplest layer of peg protection.

Contract Details

• No admin, no owner, no proxy. Fully immutable.
• ReentrancyGuard on all functions.
• All three tokens (USDC, USDT, enUSD) verified as 6 decimals in constructor.
• ETH sent to the contract is rejected.

Oracle

The ENNI Oracle provides fiat-denominated ETH pricing to each CDP. It uses a dual-feed design with a cached fallback and an optional translator for non-USD currencies. No governance, no admin, no manual overrides.

Each market deploys its own oracle instance. enUSD uses a pure ETH/USD oracle. enCHF uses the same ETH/USD feeds translated through a Chainlink CHF/USD feed. Future currencies would follow the same pattern with their own translator.

Feed Priority

The oracle checks two price feeds in order and returns the first valid result:

1. Chainlink (primary) — ETH/USD aggregator. Trusted as the most widely used and battle-tested feed on Ethereum.
2. Chronicle (fallback) — ETH/USD feed. Used only if Chainlink is unavailable or stale.

If both feeds fail, the oracle falls back to the last known good price stored in the contract.

Translator (non-USD currencies)

For currencies other than USD, the oracle includes a translator feed. This is a Chainlink aggregator for the target currency’s exchange rate against USD (e.g. CHF/USD).

The final price is calculated as: ethUsdPrice / fxRate. For example, if ETH/USD is 2,500 and CHF/USD is 0.90, the oracle returns ETH/CHF ≈ 2,778.

If the translator is set to address(0), no translation is applied and the oracle returns raw ETH/USD. This is the enUSD configuration.

If the translator feed goes stale, both Chainlink and Chronicle base prices are rejected since neither can be translated. This is an inherent constraint. Chainlink is currently the only provider of on-chain forex feeds, so there is no fallback for the translator itself.

Staleness

Each feed has its own staleness threshold:

• Chainlink ETH/USD — 6 hours. Based on the confirmed March 2020 incident where the feed was delayed ~6 hours during extreme gas conditions.
• Chronicle ETH/USD — 24 hours. Chronicle’s heartbeat is 12 hours. Threshold is set to 2 full heartbeats.
• Translator — 24 hours.

A price older than its threshold is rejected and the oracle moves to the next feed. The CDP enforces its own 24-hour maximum age independently, so even if the oracle returns a cached price, the CDP will reject it if the timestamp is too old. For translated prices, the timestamp used is the older of the base feed and translator feed. See Parameters for the full list.

Validation

Every price read goes through strict validation before being accepted:

• Price must be greater than zero.
• Timestamp must not be zero or in the future.
• Chainlink: roundId must be valid, answeredInRound must match, answer must be positive.
• Chronicle: value and age must pass the same sanity checks.
• Translator: same Chainlink validation as the primary feed.
• All external calls are wrapped in try/catch. A reverting feed is treated as unavailable, not as an error.

Price Scaling

All prices are normalized to 18 decimals regardless of the source feed’s native precision. Chainlink ETH/USD uses 8 decimals, Chronicle uses 18, translator feeds vary. The oracle handles all conversions internally.

Cache

The oracle stores the last valid price and its timestamp. This cache serves as the final fallback when both live feeds are unavailable. The cache is updated through fetchPrice(), which is the only state-changing function. The CDP currently uses peekPriceWithTimestamp() which is read-only and does not update the cache.

For the cache to stay warm, an external caller (keeper or bot) should call fetchPrice() periodically. This is not strictly required for the protocol to function since the CDP validates freshness independently, but it provides an additional safety net.

No Deviation Check

The oracle does not compare prices between Chainlink and Chronicle. This is intentional. In volatile markets, one feed may update faster than the other. A deviation check could reject a valid Chainlink price because Chronicle hasn’t caught up yet, effectively bricking the oracle during the moments when accurate pricing matters most. In an immutable system, a bricked oracle means frozen liquidations and frozen withdrawals. The risk of a false rejection outweighs the risk of a single-feed price being slightly off.

Parameters

Every parameter in the protocol is hardcoded as a constant or immutable. Nothing can be changed after deployment. All current markets (enUSD, enCHF) share the same CDP and oracle parameters.

CDP

Parameter	Value	Description
MAX_LTV_BPS	8,500 (85%)	Maximum loan-to-value for borrowing and withdrawing
LIQ_LTV_BPS	8,800 (88%)	LTV threshold that triggers liquidation
MIN_DEBT	400 units	Minimum debt per position (e.g. 400 enUSD, 400 enCHF). Prevents dust positions.
DONATION_BPS	300 (3%)	Percentage of seized collateral donated to vault during liquidation
ORACLE_MAX_AGE	24 hours	Maximum acceptable oracle price age

Buyout Premiums

LTV Range	Premium
85.00% – 87.99%	4%
60.00% – 84.99%	6%
Below 60.00%	9%

DirectMint (enUSD only)

Parameter	Value	Description
REDEEM_FEE_BPS	50 (0.5%)	Fee on enUSD redemption, donated to vault
Mint Fee	0%	No fee on minting enUSD
Mint Ratio	1:1	enUSD minted equals stablecoin deposited

Oracle

Parameter	Value	Description
STALE_CHAINLINK	6 hours	Chainlink ETH/USD price rejected if older than this. Based on confirmed March 2020 incident where the feed was delayed ~6 hours during extreme gas conditions.
STALE_CHRONICLE	24 hours	Chronicle ETH/USD price rejected if older than this. Chronicle heartbeat is 12 hours. Threshold set to 2 full heartbeats.
STALE_TRANSLATOR	24 hours	Translator feed (e.g. CHF/USD) rejected if older than this. Only applies to non-USD markets.
Price Scale	18 decimals	All prices normalized to 1e18

Token

Parameter	ENNI	enUSD	enCHF
Decimals	18	6	6
Max Supply	21,000,000	Unlimited	Unlimited
Minter Slots	2	2	2

MasterChef

Parameter	Value	Description
MAX_POOLS	8	Maximum number of farming pools
MAX_CHEF_MINT	20,000,000 ENNI	Total mintable by MasterChef (excludes initial allocation)
ACC_PRECISION	1e12	Reward accumulator precision

Rewards Vault

Parameter	Value	Description
ACC_PRECISION	1e18	Per-share accumulator precision
Share Ratio	1:1	Shares equal ENNI deposited

Emission Schedule

ENNI has a fixed supply of 21,000,000 tokens distributed over 30 years. The emission rate decreases over time, front-loading rewards for early participants while maintaining long-term incentives.

Distribution

Allocation	Amount	Percentage
Initial Allocation	1,000,000 ENNI	4.76%
MasterChef Farming (30 years)	20,000,000 ENNI	95.24%
Total	21,000,000 ENNI	100%

Emission Phases

Phase	Period	Annual Rate	Duration	Phase Total
Phase 1	Year 1–2	2,000,000 ENNI	2 years	4,000,000
Phase 2	Year 3–10	1,000,000 ENNI	8 years	8,000,000
Phase 3	Year 11–30	400,000 ENNI	20 years	8,000,000
			Total	20,000,000

Cumulative Supply

Year	Emitted That Year	Total Circulating (incl. initial allocation)
1	2,000,000	3,000,000
2	2,000,000	5,000,000
3	1,000,000	6,000,000
5	1,000,000	8,000,000
10	1,000,000	13,000,000
15	400,000	15,000,000
20	400,000	17,000,000
25	400,000	19,000,000
30	400,000	21,000,000

After year 30, no more ENNI is emitted. The total supply is 21,000,000 forever.

Enforcement

The MasterChef contract has an immutable MAX_CHEF_MINT of 20,000,000 ENNI. Every mint call checks:

require(totalMinted + amount <= maxMintable)

This is enforced at both the MasterChef level and the EnniToken level. Even if a minter were compromised, the hard cap cannot be exceeded.

Design Rationale

The three-phase schedule balances early bootstrapping with long-term sustainability:

• Phase 1 (2M/year) — high emissions to attract initial liquidity and bootstrap the ecosystem.
• Phase 2 (1M/year) — steady emissions during growth. 8 years of predictable rewards.
• Phase 3 (400K/year) — low emissions for 20 years. Enough to maintain incentives without diluting existing holders. By this point, protocol revenue through the Rewards Vault should be the primary value driver for ENNI stakers.

Security

ENNI is designed to minimize trust assumptions. The security model is simple: immutable code, no admin keys, verify everything on-chain.

Immutability

Every contract is non-upgradeable. No proxy patterns, no delegatecall, no selfdestruct. Once deployed, the bytecode cannot change. There is no mechanism to pause, freeze, or modify any contract.

Ownership Renouncement

EnniToken and EnniMasterChef have owner roles at deployment for initial configuration only. The owner can set minter addresses on the token and add/rebalance farming pools on MasterChef. Once configuration is complete, ownership is renounced permanently by calling renounceOwnership(). This is a one-way action. After renouncement:

• Minter addresses on ENNI, enUSD, enCHF, and all future tokens are locked forever.
• Farming pools and allocation weights are locked forever.
• No admin function can ever be called again.

Verify renouncement on Etherscan by checking that owner() returns 0x0000000000000000000000000000000000000000.

Smart Contract Practices

All contracts follow established security patterns:

• ReentrancyGuard on every state-changing external function.
• SafeERC20 for all token transfers.
• Math.mulDiv for overflow-safe multiplication and division.
• Checks-Effects-Interactions pattern followed consistently. State is updated before external calls.
• Try/catch on all non-critical external calls (oracle reads, vault donations) to guarantee liveness.

Oracle Safety

The oracle wraps every external call in try/catch. A reverting Chainlink or Chronicle feed is treated as unavailable, not as a system error. The CDP independently validates price freshness with a 24-hour threshold. Stale prices are rejected.

No deviation check is used between feeds. This is intentional. In volatile markets a deviation check could falsely reject valid prices and freeze the system. For an immutable protocol, liveness is more important than theoretical manipulation resistance.

Known Dependencies

These are external factors outside the protocol’s control:

• Chainlink and Chronicle — if both ETH/USD feeds are down for over 24 hours simultaneously, borrowing, withdrawing, buyouts, and liquidations are paused across all markets. Deposits and repayments still work.
• Translator feeds — non-USD markets (e.g. enCHF) depend on a single Chainlink forex feed (e.g. CHF/USD). If this feed goes stale, that market pauses independently. Other markets are unaffected.
• USDC and USDT — if Circle or Tether blacklists the DirectMint contract address, stables held in that contract become inaccessible. enUSD minted through DirectMint would lose its hard peg floor. enUSD minted through the CDP remains fully functional. This does not affect enCHF or other markets.
• Ethereum — the protocol is deployed on Ethereum mainnet. It inherits all risks and guarantees of the base layer.

For audit status and vulnerability reporting, see Audits.

Audits

Status

No formal audit has been completed yet. One is planned before mainnet launch.

All contract source code is verified on Etherscan and available on GitHub. The protocol has been reviewed informally through community testing on Sepolia testnet.

Scope

The audit will cover the core contract codebase. Since all markets (enUSD, enCHF, future currencies) are deployed from the same source code, one audit covers every deployment.

Contract	Lines	Description
EnniToken	—	ERC20 + ERC20Permit with dual minter slots and hard supply cap. Reused for ENNI, enUSD, enCHF, and all future tokens.
EnniCDP	—	CDP with buyout and liquidation. One instance per currency.
EnniOracle	—	Dual-feed Chainlink/Chronicle with optional translator for non-USD currencies and cached fallback. One instance per currency.
EnniDirectMint	—	1:1 USDC/USDT ↔ enUSD minting and redemption. enUSD only.
EnniMasterChef	—	30-year emission schedule with up to 8 farming pools
EnniRewardsVault	—	Auto-compounding staking vault for ENNI

Past Reviews

Date	Reviewer	Scope	Report
—	—	—	—

This table will be updated as audits are completed.

Github

• Github: https://github.com/enni-ch

Verification

Don’t trust. Verify.

• All contracts are verified on Etherscan with full source code.
• Check owner() on all ownable contracts to confirm renouncement.
• Verify that each currency’s CDP, oracle, and token use the same verified bytecode as the audited source.
• If you are developing or deploying, use enni-preflight to independently validate contract wiring, minter configuration, and parameter correctness against on-chain state.

Contract Addresses

All contracts are deployed on Ethereum mainnet. Source code is verified on Etherscan. Each currency has its own CDP, oracle, and token deployment.

Core Contracts (enUSD)

Contract	Address	Etherscan
enUSD Token	TBD	View
EnniCDP (enUSD)	TBD	View
EnniOracle (enUSD)	TBD	View
EnniDirectMint	TBD	View

Core Contracts (enCHF)

Contract	Address	Etherscan
enCHF Token	TBD	View
EnniCDP (enCHF)	TBD	View
EnniOracle (enCHF)	TBD	View

Shared Contracts

Contract	Address	Etherscan
ENNI Token	TBD	View
EnniMasterChef	TBD	View
EnniRewardsVault	TBD	View

External Dependencies

Contract	Address	Etherscan
WETH	0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2	View
USDC	0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48	View
USDT	0xdAC17F958D2ee523a2206206994597C13D831ec7	View
Chainlink ETH/USD	0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419	View
Chainlink CHF/USD	TBD	View
Chronicle ETH/USD	TBD	View

Ownership Status

Contract	Owner	Status
ENNI Token	TBD	Pending renouncement
enUSD Token	TBD	Pending renouncement
enCHF Token	TBD	Pending renouncement
EnniMasterChef	TBD	Pending renouncement

Verify ownership renouncement by checking that owner() returns 0x0000000000000000000000000000000000000000 on Etherscan.

Minter Configuration

ENNI Token

Slot	Address	Role
minter1	TBD	EnniMasterChef
minter2	TBD	Dead (unused)

enUSD Token

Slot	Address	Role
minter1	TBD	EnniCDP (enUSD)
minter2	TBD	EnniDirectMint

enCHF Token

Slot	Address	Role
minter1	TBD	EnniCDP (enCHF)
minter2	TBD	Dead (unused)

Testnet

⚠️ This is Sepolia testnet. Not mainnet. All tokens are worthless. Contracts may be redeployed at any time. For mainnet, see Contract Addresses.

The ENNI testnet is a full deployment of the protocol on Ethereum’s Sepolia test network. Every contract — CDPs, Oracles, DirectMint, MasterChef, Vault — is deployed with the same code and parameters as mainnet. Both enUSD and enCHF markets are live. The only differences are the token addresses and oracle feeds.

What’s Different from Mainnet

• USDC and USDT are dummy tokens. They are EnniToken deployments with 6 decimals, not real Circle/Tether contracts. You can get them from the Faucet.
• WETH is Sepolia wrapped ETH. Get Sepolia ETH from any Sepolia faucet, then wrap it.
• Oracle feeds are Sepolia versions of Chainlink and Chronicle. Prices may lag or behave differently than mainnet.
• Contracts may be redeployed. If addresses change, this page and the app will be updated. Old deployments are abandoned.

How to Use

1. Get Sepolia ETH from a faucet (Google, Alchemy, or others).
2. Get test USDC/USDT from the Faucet.
3. Connect your wallet to Sepolia network.
4. Use the app at testnet.enni.ch.

Contract Addresses

All contracts are deployed on Sepolia testnet. Source code is verified on Sepolia Etherscan.

Core Contracts (enUSD)

Contract	Address	Etherscan
enUSD Token	0x3E251FE5cA23bf959B5350164C68897718c1EEE4	View
EnniCDP (enUSD)	0xC17eE2f2B4F55ad21fCE100d22fBbb7C129fAE23	View
EnniOracle (enUSD)	0xd6DF2d295a667dCbA2EaCDbABaBcFb97d5580feD	View
EnniDirectMint	0x840fd66DABb0027211E7c805Ba429FAd5Cdcfe5C	View

Core Contracts (enCHF)

Contract	Address	Etherscan
enCHF Token	0xb4171bb0d4155dC231fd6ca8eB97F17f05f0647E	View
EnniCDP (enCHF)	0x0d23D2d92e856035F38bE1631d9E1d1fFaAcD5d9	View
EnniOracle (enCHF)	0x6F0EA1ab123870b956C9467A76257477fCB43329	View

Shared Contracts

Contract	Address	Etherscan
ENNI Token	0x92d67b14650cb996dCF9Adc04E163EFe4Be079a7	View
EnniMasterChef	0x6c08ACE29F1c2DF9da711a542188F48a0fcA4e0F	View
EnniRewardsVault	0x005c1c2053B4385ee3De6aC348531EF86784453d	View

Dummy Tokens

Token	Address	Decimals	Etherscan
USDC (test)	0x1c7D4B196Cb0C7B01d743Fbc6116a902379C7238	6	View
USDT (test)	0xafBD407A5faB228570d79b88Bd100bf5EbAfEA80	6	View

External Dependencies

Contract	Address	Etherscan
WETH (Sepolia)	0xfFf9976782d46CC05630D1f6eBAb18b2324d6B14	View
Chainlink ETH/USD	0x694AA1769357215DE4FAC081bf1f309aDC325306	View
Chronicle ETH/USD	0xdd6D76262Fd7BdDe428dcfCd94386EbAe0151603	View

Ownership Status

Contract	Owner	Status
ENNI Token	0x0000...0000	Renounced ✅
enUSD Token	0x0000...0000	Renounced ✅
enCHF Token	—	Pending renouncement
EnniMasterChef	—	Pending renouncement

Verify on Etherscan: call owner() — should return 0x0000000000000000000000000000000000000000.

Minter Configuration

ENNI Token

Slot	Address	Role
minter1	0x6c08ACE29F1c2DF9da711a542188F48a0fcA4e0F	EnniMasterChef
minter2	0x000000000000000000000000000000000000dEaD	Dead (unused)

enUSD Token

Slot	Address	Role
minter1	0xC17eE2f2B4F55ad21fCE100d22fBbb7C129fAE23	EnniCDP (enUSD)
minter2	0x840fd66DABb0027211E7c805Ba429FAd5Cdcfe5C	EnniDirectMint

enCHF Token

Slot	Address	Role
minter1	0x0d23D2d92e856035F38bE1631d9E1d1fFaAcD5d9	EnniCDP (enCHF)
minter2	0x000000000000000000000000000000000000dEaD	Dead (unused)

Parameters

All parameters are identical to mainnet and shared across all markets. See Parameters for the full list. The testnet deployment uses the same constants, the same LTV thresholds, the same emission schedule, and the same oracle staleness windows.

Bug Reports

Found something broken on testnet? Report it in Telegram. Include the transaction hash if possible.