Two contracts. Separated concerns.
The RWA contract enforces ownership and compliance for a specific real-world asset (ERC-20 + ERC-3643). ENCL is a separate, plain ERC-20 utility token that Enclave Operators bond against their conduct — it has no claim on any asset and cannot move asset ownership.
The RWA contract
Every asset issued under ENCLAVES is its own contract instance — an ERC-20 with full ERC-3643 (T-REX) semantics, cloned by the platform's token factory as an EIP-1167 minimal proxy. The contract is the enforcement layer for a trusted platform: the platform decides; the contract records and enforces.
One contract per asset. Per-asset state machine, per-asset supply, per-asset compliance rules, per-asset maturity. The Enclave Operator — acting on behalf of the bankruptcy-remote SPV that holds title — is the only party authorised to flip the contract’s mint switch, and even then only when every Mint Authorization flag has been independently set by Verification Events and the operator’s ENCL bond is live.
Compliance-checked transfers
Every transfer is routed through the configured Identity Registry and Compliance module before it can execute. Unverified addresses cannot receive; jurisdictional rules, Enclave approval, and freeze lists are evaluated atomically on each move.
Gated mint
Mint is conditional on a set of Mint Authorization flags (verification events, Enclave Operator approval, custody confirmation, no encumbrances) AND a live ENCL staking bond. The contract reads these flags on every mint — there is no override path for the issuer or the platform.
Supply discipline
maxSupply is set at initialisation and never raised. mintFinalized is a one-way switch; once flipped, no further mint is possible from any address, in any role, ever. Asset owners cannot be diluted by governance.
Lifecycle state machine
Each asset progresses through an explicit on-chain state: Registered → Issued → Active → Mature → Retired. Transitions are role-gated and emit events; downstream systems (Trust Score, asset registries, audit log) read the on-chain state as source of truth.
Snapshot capability
The contract inherits ERC20Snapshot semantics. A platform-driven snapshot captures every holder’s balance at a block, enabling income distributions, voting, and audit reconstruction without iterating storage at distribution time.
Maturity & buyback
Optional one-shot maturity terms (buyback token, price per share, maturity date) are configured once and locked. After maturity, holders trigger a permissionless burn-to-claim against a pre-funded escrow — the contract returns proceeds without needing platform action.
Forced-transfer recovery
Sanctions, legal orders, and fraud recovery use a platform-driven forced transfer that records an explicit on-chain reason code. The path exists, is auditable, and is bounded — a transfer the SPV does not recognize is not a transfer of ownership at all.
Holder + investor tracking
The contract maintains both per-wallet and per-ONCHAINID enumerable holder sets — distribution targets, regulatory reporting, and holder caps are derivable on-chain without off-chain reconciliation.
No single party can issue.
Roles on the contract follow ERC-3643's agent model, refined for ENCLAVES' four-way split — issuer, platform, Enclave Operator, and Enclave SPV. Every privileged action requires at least two independent parties.
Issuer (ERC-173 owner)
Owns the contract instance. Cannot mint, cannot move assets — owner role is structural, not operational.
Platform agent
Toggles Mint Authorization flags as Verification Events arrive, drives lifecycle transitions, triggers snapshots, and invokes forced transfers with explicit reason codes.
Enclave Operator
Authorises minting from the Enclave side, on behalf of the SPV that holds legal title. Mint requires both platform flags AND Enclave Operator approval — no single role can issue alone. The operator’s bonded ENCL is the slashable stake.
Every condition checked on every mint
There is no path to mint that skips one of these. ThemintReady()check is consulted inside the contract on each call.
- All verification flags setLegal, custody, operational, and class-specific Verification Events have all been recorded by independent parties.
- Enclave Operator approval liveThe Enclave Operator has authorised mint, acting on behalf of the SPV that holds legal title. The approval is revocable.
- ENCL staking bond postedThe contract consults the issuer’s StakingBond on every mint. No bond → no mint, even with full verification.
- Cooling period elapsedTime-based safety window between the last condition flip and the earliest possible mint.
ENCL
A plain ERC-20 with EIP-2612 permit, fixed supply minted in full at deployment to the treasury. No pause, no freeze, no blacklist, no upgrade path, no mint capability beyond initial issuance. ENCL is intentionally not ERC-3643.
Freely transferable utility token
ENCL is the platform’s bonding and service token. It lives in its own repository so it can be governed, audited, and rotated independently of the RWA contracts.
- · Standard ERC-20 with EIP-2612 permit (gasless approvals)
- · Fixed supply, minted in full to treasury at deployment
- · No pause, no freeze, no blacklist, no upgrade path
- · No mint capability beyond the deployment-time supply
- · Circulating supply can only shrink — through StakingBond.slash()
Composability is the point
ENCL needs to flow through staking contracts, DeFi rails, and exchange listings without permissioning friction. The discipline lives in the RWA contract, not the utility token.
- · Freely transferable — composable with DeFi and CEXs
- · No platform discretion over balances
- · Slashing is a transfer to slash receivers, not a balance edit
- · Governance touches protocol parameters, not balances
The two contracts read each other.
Five jobs, all tied to actual network usage.
ENCL underwrites the trust layer. Every major function of the network requires it, creating demand tied to real usage rather than speculation.
Issuer bonding
Operators stake ENCL through the StakingBond contract before any RWA token under their Enclave can mint. The bond is proportional to risk profile and Trust Class. Misrepresentation is slashable.
Issuance capacity
The on-chain bond ceiling sets how much asset value an operator can issue. Scale follows responsibility — capacity is not granted, it is earned by staking.
Service payments
Registration, verification coordination, attestation handling, and lifecycle event processing are paid in ENCL. Demand is tied to actual network activity.
Verifier incentives
Custodians, registrars, and legal counsel are rewarded for accurate, timely attestations. Incentives reward correctness; bonds penalise behaviour that introduces risk.
Protocol-only governance
ENCL governs protocol parameters — bonding requirements, attestation standards, lifecycle rule templates. It cannot intervene in individual Enclave operations or change the status of an issued asset.
Principles, not pie charts.
The protocol's economic posture is durable. Detailed allocation, emission schedule, and circulating-supply mechanics are finalised at Phase 3 (Tranche 1) and published with simulation analysis before activation.
Value from use, not speculation
Demand is driven by staking, capacity allocation, service payments, and verifier rewards — all tied to real economic activity.
Economic accountability
Staking and slashing produce direct economic consequences for misconduct. Operators carry real skin in the game; the RWA contract reads the bond on every mint.
Supply discipline
Fixed total supply, minted in full at deployment, no further mint capability. ENCL circulating supply can only shrink — through slashing transfers from StakingBond.
Long-term alignment
Team, advisor, and early-backer allocations are subject to multi-year vesting with cliff periods. No early sell pressure.
Token allocation breakdowns and emission curves will be published alongside the security review in Phase 3. We do not commit to specific percentages on the marketing site ahead of governance and legal sign-off — see the roadmap for sequencing.
Stay close to the build
Monthly engineering, legal, and roadmap updates. No marketing filler.