Two contracts. Separated concerns.
The RWA contract enforces ownership and compliance for a specific real-world asset (ERC-20 + ERC-3643). ENCL is a separate, plain ERC-20 utility token that Enclave Operators bond against their conduct — it has no claim on any asset and cannot move asset ownership.
The RWA contract
Every asset issued under ENCLAVES is its own contract instance — an ERC-20 with full ERC-3643 (T-REX) semantics, cloned by the platform's token factory as an EIP-1167 minimal proxy. The contract is the enforcement layer for a trusted platform: the platform decides; the contract records and enforces.
One contract per asset. Per-asset state machine, per-asset supply, per-asset compliance rules, per-asset maturity. The Enclave Operator — the bonded, slashable party that runs the Enclave — is the only party authorised to flip the contract’s mint switch, and even then only when every Mint Authorization flag has been independently set by Verification Events and the operator’s ENCL bond is live.
Compliance-checked transfers
Every transfer is routed through the configured Identity Registry and Compliance module before it can execute. Unverified addresses cannot receive; jurisdictional rules, Enclave approval, and freeze lists are evaluated atomically on each move.
Gated mint
Mint is conditional on a set of Mint Authorization flags (verification events, Enclave Operator approval, custody confirmation, no encumbrances) AND a live ENCL staking bond. The contract reads these flags on every mint — there is no override path for the issuer or the platform.
Supply discipline
maxSupply is set at initialisation and never raised. mintFinalized is a one-way switch; once flipped, no further mint is possible from any address, in any role, ever. Asset owners cannot be diluted by governance.
Lifecycle state machine
Each asset progresses through an explicit on-chain state: Registered → Issued → Active → Mature → Retired. Transitions are role-gated and emit events; downstream systems (Trust Score, asset registries, audit log) read the on-chain state as source of truth.
Snapshot capability
The contract inherits ERC20Snapshot semantics. A platform-driven snapshot captures every holder’s balance at a block, enabling income distributions, voting, and audit reconstruction without iterating storage at distribution time.
Maturity & buyback
Optional one-shot maturity terms (buyback token, price per share, maturity date) are configured once and locked. After maturity, holders trigger a permissionless burn-to-claim against a pre-funded escrow — the contract returns proceeds without needing platform action.
Forced-transfer recovery
Sanctions, legal orders, and fraud recovery use a platform-driven forced transfer that records an explicit on-chain reason code. The path exists, is auditable, and is bounded — a transfer the SPV does not recognize is not a transfer of ownership at all.
Holder + investor tracking
The contract maintains both per-wallet and per-ONCHAINID enumerable holder sets — distribution targets, regulatory reporting, and holder caps are derivable on-chain without off-chain reconciliation.
No single party can issue.
Roles on the contract follow ERC-3643's agent model, refined for ENCLAVES' four-way split — issuer, platform, Enclave Operator, and Enclave SPV. Every privileged action requires at least two independent parties.
Issuer (ERC-173 owner)
Owns the contract instance. Cannot mint, cannot move assets — owner role is structural, not operational.
Platform agent
Toggles Mint Authorization flags as Verification Events arrive, drives lifecycle transitions, triggers snapshots, and invokes forced transfers with explicit reason codes.
Enclave Operator
Authorises minting once every gate is green and bonds ENCL as the slashable stake. Mint requires both platform flags AND Enclave Operator approval — no single role can issue alone. It cannot itself mint, hold title, or force transfers.
Enclave SPV
Governs transfers within the jurisdiction — approves who may hold or receive a token so every holder is a legally recognized owner. It does not hold title, mint, or run lifecycle events.
Every condition checked on every mint
There is no path to mint that skips one of these. ThemintReady()check is consulted inside the contract on each call.
- All verification flags setLegal, custody, operational, and class-specific Verification Events have all been recorded by independent parties.
- Enclave Operator approval liveThe Enclave Operator has authorised mint. The approval is revocable, and the operator cannot mint on its own.
- SPV transfer-control activeThe SPV’s compliance configuration is live and no unresolved encumbrances are present on the asset.
- Issuer control removedThe issuer’s unilateral control is structurally removed and the holders’ protective interest is perfected.
- ENCL staking bond postedThe contract consults the operator’s StakingBond on every mint. No bond → no mint, even with full verification.
- Cooling period elapsedTime-based safety window between the last condition flip and the earliest possible mint.
ENCL
A plain ERC-20 with EIP-2612 permit, fixed supply minted in full at deployment to the treasury. No pause, no freeze, no blacklist, no upgrade path, no mint capability beyond initial issuance. ENCL is intentionally not ERC-3643.
Freely transferable utility token
ENCL is the platform’s bonding and service token. It lives in its own repository so it can be governed, audited, and rotated independently of the RWA contracts.
- · Standard ERC-20 with EIP-2612 permit (gasless approvals)
- · Fixed supply, minted in full to treasury at deployment
- · No pause, no freeze, no blacklist, no upgrade path
- · No mint capability beyond the deployment-time supply
- · Circulating supply can only shrink — through StakingBond.slash()
Composability is the point
ENCL needs to flow through staking contracts, DeFi rails, and exchange listings without permissioning friction. The discipline lives in the RWA contract, not the utility token.
- · Freely transferable — composable with DeFi and CEXs
- · No platform discretion over balances
- · Slashing is a transfer to slash receivers, not a balance edit
- · Governance touches protocol parameters, not balances
The two contracts read each other.
Five jobs, all tied to actual network usage.
ENCL underwrites the trust layer. Every major function of the network requires it, creating demand tied to real usage rather than speculation.
Operator bonding
Enclave Operators stake ENCL through the StakingBond contract before any RWA token under their Enclave can mint. The bond is proportional to asset value and Trust Class (α = 1.5%–20%). Bonded ENCL is released only when the asset reaches Retired; misrepresentation is slashable.
Issuance capacity
The on-chain bond ceiling sets how much asset value an operator can issue. Scale follows responsibility — capacity is not granted, it is earned by staking.
Service payments
Registration, verification coordination, attestation handling, and lifecycle event processing are paid in ENCL. Demand is tied to actual network activity.
Verifier incentives
Custodians, registrars, and legal counsel are rewarded for accurate, timely attestations. Incentives reward correctness; bonds penalise behaviour that introduces risk.
Protocol-only governance
ENCL governs protocol parameters — bonding requirements, attestation standards, lifecycle rule templates. It cannot intervene in individual Enclave operations or change the status of an issued asset.
Value is captured at issuance.
A meaningful one-time fee at the moment of value creation, and a thin recurring tail that keeps the operator aligned over the asset's life. Fees are the protocol's revenue — kept strictly distinct from bonding, which is recoverable collateral.
Issuance fee is primary
Charged against the asset’s issuance valuation (default 1%, optional cap for very large assets) and settled before tokens can mint. Recurring and event fees play a supporting role, not a revenue-pillar role.
Quote in USD, settle in ENCL
Every fee is denominated in USD and settled in ENCL at a rate fixed at charge time. The payer can settle in an approved stablecoin and the protocol converts to ENCL — usage creates real buy-side demand without forcing issuers to pre-acquire it.
The bond is not a fee
Bonded ENCL is recoverable collateral held in StakingBond; fees are non-recoverable revenue. They sit on separate ledgers and are never netted against one another.
Slashing flows to the harmed
On proven misconduct, slashed ENCL is split between harmed owners (pro-rata to holdings at the time) and the treasury, recorded as an enforcement distribution, separate from fee revenue.
Worked example ($50M Class I real estate). At issuance the fee is 1% of $50M = $500,000 (split protocol / operator), plus a verification fee on the order of $25,000 routed to the verifiers — both settled in ENCL before minting. Separately, and not a fee, the operator bonds ~1.5% of $50M = $750,000 in ENCL as recoverable collateral, released at retirement.
Principles, not pie charts.
The protocol's economic posture is durable. Detailed allocation, emission schedule, and circulating-supply mechanics are finalised at Phase 3 (Tranche 1) and published with simulation analysis before activation.
Value from use, not speculation
Demand is driven by staking, capacity allocation, service payments, and verifier rewards — all tied to real economic activity.
Economic accountability
Staking and slashing produce direct economic consequences for misconduct. Operators carry real skin in the game; the RWA contract reads the bond on every mint.
Supply discipline
Fixed total supply, minted in full at deployment, no further mint capability. ENCL circulating supply can only shrink — through slashing transfers from StakingBond.
Long-term alignment
Team, advisor, and early-backer allocations are subject to multi-year vesting with cliff periods. No early sell pressure.
Token allocation breakdowns and emission curves will be published alongside the security review in Phase 3. We do not commit to specific percentages on the marketing site ahead of governance and legal sign-off — see the roadmap for sequencing.
Stay close to the build
Monthly engineering, legal, and roadmap updates. No marketing filler.