ENNI Protocol

ENNI is a decentralized lending and stablecoin protocol on Ethereum. It’s best to clarify as an overcollateralized CDP project. It has no governance, no admin keys, and no upgradeability. Once deployed and ownership is renounced, the code is the final authority.

The protocol has two tokens:

• ENNI — fixed supply of 21,000,000. Distributed over 30 years through farming. Stakers earn protocol revenue and donations.
• enUSD — a USD-pegged stablecoin. Minted 1:1 against USDC/USDT, or borrowed against WETH at 0% interest.

How It Works

Deposit WETH into the CDP, borrow enUSD at 0% interest with no fees. Instead of forced redemptions that punish borrowers, ENNI uses a voluntary buyout system where arbitrageurs restore the peg by purchasing collateral at a premium. Borrowers are compensated, not penalized.

All protocol revenue like liquidation proceeds and redemption fees flows directly to ENNI stakers. No treasury, no team allocation, no governance fund.

While ENNI starts as a lending and stablecoin protocol, anyone can freely build on top of it. GameFi, NFTs, DeFi, or anything else. The ENNI Registry indexes community built projects that align with the core doctrine: immutable, governanceless, and autonomous.

How ENNI Compares

Feature	MakerDAO	Liquity v1	ENNI
🏦 Collateral	Multi-asset	ETH	ETH (Wrapped ETH)
💵 Stablecoin	DAI	LUSD	enUSD
💸 Interest / Fees	Variable interest	0.5% one-time fee	0% always
🗳️ Governance	MKR voting	None	None
🔑 Admin Keys	Yes (multisig)	None	None post-renouncement
🔄 Upgradeable	Yes	No	No
🔁 Redemption Model	N/A	Forced (borrowers penalized)	Voluntary buyout (borrowers compensated)
🛡️ Peg Defense	PSM + governance	Redemption + liquidation	DirectMint floor + buyout arb + liquidation
⚡ Liquidation Buffer	Auction system	Stability Pool	External liquidators (~10% profit)
💰 Staker Revenue	MKR buyback	LUSD + ETH fees	ENNI + WETH + enUSD donations
📜 Core Contracts	30+	12+	6

Principles

• Immutable contracts. No upgrades, no proxies.
• No admin keys after ownership renouncement.
• No governance votes. No DAO politics.
• All value flows back to token holders.
• Trust. But verify!

How enUSD Works

enUSD is the protocol’s USD-pegged stablecoin. It has 6 decimals and no supply cap. There are two ways to create it and three layers protecting its peg.

Minting

DirectMint — Deposit USDC or USDT, receive enUSD 1:1. No fees on minting. The deposited stables stay in the DirectMint contract and back future redemptions. This is the simplest path to enUSD.

CDP Borrowing — Deposit WETH as collateral, borrow enUSD against it at 0% interest. No borrowing fees. Maximum loan-to-value is 85%. Minimum debt is 200 enUSD. The enUSD is minted fresh when borrowed and burned when repaid.

Redeeming

Redeem enUSD back to USDC or USDT through DirectMint at a 1:1 rate minus a 0.5% fee. The fee is donated to the Rewards Vault as protocol revenue for ENNI stakers. Redemption is only available against the specific stablecoin that was deposited. If 1M USDC was minted through DirectMint but 0 USDT, you can only redeem to USDC.

Peg Defense

enUSD maintains its peg through three independent mechanisms. None of them require governance or admin intervention.

1. Hard Floor — DirectMint Redemption Anyone holding enUSD can redeem it for USDC or USDT at $0.995 (1:1 minus the 0.5% fee). This creates a hard price floor. If enUSD trades below $0.995 on the open market, arbitrageurs buy it cheap and redeem for a profit until the price recovers.

2. Market Recovery — Buyout Arbitrage If enUSD drops further, the buyout system kicks in. Arbitrageurs buy discounted enUSD on the market and use it to purchase borrowers’ WETH collateral at oracle price through the CDP. Even after paying a 4–9% premium to the borrower, buying $1 worth of ETH with $0.80 of enUSD is profitable. This creates sustained buy pressure on enUSD.

3. Liquidation Positions that reach 88% LTV are liquidated. Liquidators repay the debt in enUSD and receive collateral at a discount. This removes undercollateralized debt from the system and maintains the overall health of enUSD backing.

Supply and Backing

enUSD minted through DirectMint is fully backed 1:1 by USDC/USDT sitting in the contract. enUSD borrowed through the CDP is overcollateralized by WETH at a minimum of 117.6% collateral ratio (85% LTV). The protocol has no fractional reserve and no unbacked minting.

Buyout System

The buyout system is ENNI’s alternative to forced redemptions. In protocols like Liquity v1, anyone can redeem their stablecoin against the lowest collateral ratio position without the borrower’s consent. The borrower loses collateral and gets nothing extra. ENNI replaces this with a voluntary, market-driven mechanism that compensates borrowers.

How It Works

A buyer selects a borrower’s position and specifies how much debt they want to repay. The buyer pays the repay amount plus a premium in enUSD. In return, the buyer receives WETH collateral equal to the repay amount at oracle price. The borrower’s debt is reduced and they receive the premium as claimable enUSD credit.

Example: A borrower has 1 ETH collateral and 2,000 enUSD debt at 80% LTV. ETH price is $2,500. A buyer repays 1,000 enUSD of the debt.

• Premium tier at 80% LTV: 6%
• Premium: 1,000 × 6% = 60 enUSD
• Buyer pays: 1,060 enUSD total
• Buyer receives: 0.4 ETH (1,000 / 2,500)
• Borrower’s debt drops to 1,000 enUSD
• Borrower earns 60 enUSD premium credit

The borrower’s position is now healthier. The buyer got ETH. The premium compensates the borrower for the collateral reduction.

Premium Tiers

The premium scales inversely with risk. Riskier positions are cheaper to buy out because the protocol wants them cleared first.

LTV Range	Premium
85.00% – 87.99%	4%
60.00% – 84.99%	6%
Below 60.00%	9%

At 85%+ LTV the position is close to liquidation. A 4% premium makes buyout attractive so the market clears these positions before they become liquidatable. Healthy positions below 60% LTV cost 9% to buy out, discouraging unnecessary interference with safe borrowers.

Peg Recovery

The buyout system is the primary peg recovery mechanism. When enUSD trades below $1 on the open market the arbitrage works like this:

1. Buy enUSD at $0.85 on a DEX
2. Use it to buy out a borrower’s WETH collateral at oracle price ($1 per enUSD face value)
3. Pay the premium (4–9%) from the discount
4. Net profit: ~6–11% depending on depeg severity and premium tier

The worse the depeg, the more profitable the arbitrage, the stronger the buy pressure on enUSD. This is self-correcting without any governance action.

Rules

• If a position is liquidatable (88%+ LTV), buyout is blocked. Use liquidation instead.
• Remaining debt after partial buyout must be at least 200 enUSD or zero.
• Buyer cannot repay more than the total debt.
• Oracle must be fresh (within 2 hours).
• Premium credit is claimable anytime by the borrower via claimPremium() or returned on close().

Liquidation

Liquidation is the protocol’s last line of defense. When a position’s loan-to-value ratio reaches 88%, anyone can liquidate it. There are no fees for the liquidator. Profit comes from buying collateral at a discount.

How It Works

A liquidator selects an underwater position and specifies how much debt to repay. They pay that amount in enUSD. In return, they receive a proportional share of the borrower’s collateral minus a 3% donation to the Rewards Vault.

The collateral seized is calculated pro-rata based on debt repaid:

collateralSeized = (position.collateral × repayAmount) / position.debt

Example: A borrower has 1 ETH collateral and 2,200 enUSD debt. ETH price is $2,500. LTV is 88%. A liquidator repays the full 2,200 enUSD debt.

• Collateral seized: 1 ETH (full position)
• Collateral value: $2,500
• Cost to liquidator: 2,200 enUSD ($2,200 face value)
• Donation: 1 ETH × 3% = 0.03 ETH to Rewards Vault
• Liquidator receives: 0.97 ETH (~$2,425)
• Liquidator profit: ~$225 (~10.2%)

Profitability

At the 88% LTV liquidation threshold, the liquidator is paying 88 cents per dollar of collateral value. After the 3% donation, net profit is approximately 10%. This is intentionally generous to ensure positions are liquidated quickly even in volatile markets.

As LTV increases beyond 88% (if price drops fast between blocks), the profit margin shrinks. At 100% LTV the position is underwater and liquidation becomes unprofitable. The 3% gap between max borrow (85%) and liquidation (88%) gives borrowers a buffer to add collateral or repay before liquidation triggers.

Partial Liquidation

Liquidators can repay any portion of the debt, not just the full amount. The collateral seized is always proportional to the share of debt repaid. Remaining debt after partial liquidation must be at least 200 enUSD or zero.

Donation

3% of all seized collateral is donated to the Rewards Vault in WETH. This is the only fee in the liquidation process and it goes entirely to ENNI stakers. The donation is non-blocking. If the vault is unavailable, the liquidation still completes and the donation amount remains in the CDP contract.

Rules

• Position must be at 88%+ LTV to be liquidatable.
• Below 88% LTV, use the buyout system instead.
• Oracle must be fresh (within 2 hours).
• Liquidator cannot repay more than the total debt.
• Remaining debt after partial liquidation must be at least 200 enUSD or zero.

ENNI Token

ENNI is the protocol’s ecosystem token with a fixed supply of 21,000,000. No additional tokens can ever be minted beyond this cap. The supply model follows Bitcoin: scarce, predictable, and enforced by immutable code.

Supply Distribution

1,000,000 ENNI is allocated at deployment for contributors, early community members, and ecosystem bootstrapping. The remaining 20,000,000 is emitted over 30 years through the MasterChef farming contract.

Period	Annual Emission	Total
Year 1–2	2,000,000 ENNI	4,000,000
Year 3–10	1,000,000 ENNI	8,000,000
Year 11–30	400,000 ENNI	8,000,000

Total emitted by MasterChef: 20,000,000. Combined with the initial allocation: 21,000,000. The maxMintable cap is immutable and checked on every mint call.

Farming

ENNI is earned by staking LP tokens in the MasterChef. Up to 8 pools can exist, each with an allocation weight that determines its share of global emissions. Rewards are distributed per-second based on the emission schedule.

After ownership is renounced, no pools can be added or rebalanced. The allocation weights are locked permanently.

Staking

Stake ENNI in the Rewards Vault to earn protocol revenue. The vault auto-compounds farming rewards and distributes donations from the protocol:

• WETH from CDP liquidations (3% of seized collateral)
• enUSD from DirectMint redemptions (0.5% fee)
• ENNI from MasterChef farming (auto-compounded)

All protocol value flows to ENNI stakers. No treasury, no team cut, no governance fund.

Ownership and Immutability

At deployment, the token contract has an owner who can set two minter addresses and transfer or renounce ownership. This exists solely for initial configuration. Once the minters are set (MasterChef and DirectMint/CDP for enUSD) and ownership is renounced:

• No one can change minter addresses.
• No one can mint beyond the 21M cap.
• No one can pause, freeze, or modify the contract.

The token is a standard ERC20 with ERC20Permit for gasless approvals. Anyone can burn their own tokens.

Rewards Vault

The Rewards Vault is where ENNI stakers earn protocol revenue. Deposit ENNI, the vault stakes it in MasterChef on your behalf, auto-compounds farming rewards, and distributes all protocol donations directly to stakers.

What You Earn

Stakers earn three tokens simultaneously:

Token	Source
ENNI	MasterChef farming rewards, auto-compounded
WETH	CDP liquidation donations (3% of seized collateral)
enUSD	DirectMint redemption fees (0.5% of redeemed amount)

Rewards accumulate per-share. You can claim anytime. Depositing and withdrawing auto-claims pending rewards.

How It Works

When you deposit ENNI, the vault forwards it to MasterChef and stakes it in the designated pool. Your shares are 1:1 with the ENNI deposited. The vault is not an ERC4626 vault. Rewards are tracked separately through per-share accumulators, not baked into the share price.

When anyone interacts with the vault (deposit, withdraw, claim), it harvests pending ENNI rewards from MasterChef and distributes them across all stakers proportionally. WETH and enUSD donations from other protocol contracts are distributed the same way.

Donations

Other protocol contracts send revenue to the vault through donation functions:

• donateWETH() — called by EnniCDP during liquidation. 3% of seized collateral is sent as WETH.
• donateEnUSD() — called by EnniDirectMint during redemption. The 0.5% fee is sent as enUSD.

Both functions use transferFrom, so the calling contract must approve the vault beforehand. This is handled automatically in each contract’s constructor.

If donations arrive while no one is staked, they are queued and distributed to the first staker who deposits.

Withdrawing

Withdraw your ENNI anytime. The vault pulls your share from MasterChef and returns it along with any pending rewards. There are no lockups, no cooldowns, and no withdrawal fees.

DirectMint

DirectMint is the simplest way to get enUSD. Deposit USDC or USDT, receive enUSD 1:1. Redeem enUSD back for a flat 0.5% fee. No slippage, no bonding curves, no AMM mechanics.

Minting

Call mintWithUSDC() or mintWithUSDT() with the amount of stables you want to deposit. The contract takes your stables and mints an equal amount of enUSD directly to your wallet. No fees on minting.

1,000 USDC in → 1,000 enUSD out.

The deposited stables stay in the DirectMint contract and back future redemptions.

Redeeming

Call redeemToUSDC() or redeemToUSDT() with the amount of enUSD you want to redeem. The contract takes your enUSD, deducts a 0.5% fee, burns the rest, and sends you the corresponding stablecoin.

1,000 enUSD in → 5 enUSD fee → 995 USDC out.

The fee is donated to the Rewards Vault as enUSD for ENNI stakers. If the vault is temporarily unavailable, the redemption still completes. The fee stays in the contract.

Liquidity

Redemption is limited to what has been deposited for each stablecoin. If 10M USDC has been minted through DirectMint but 0 USDT, you can only redeem to USDC. The contract does not swap between stables internally.

Role in Peg Defense

DirectMint establishes the hard price floor for enUSD. If enUSD trades below $0.995 on any DEX, arbitrageurs can buy it cheap and redeem through DirectMint for a guaranteed profit. This creates a natural price floor at approximately $0.995.

Combined with the buyout system (which recovers the peg from below) and liquidation (which maintains system health), DirectMint is the first and simplest layer of peg protection.

Contract Details

• No admin, no owner, no proxy. Fully immutable.
• ReentrancyGuard on all functions.
• All three tokens (USDC, USDT, enUSD) verified as 6 decimals in constructor.
• ETH sent to the contract is rejected.

Oracle

The ENNI Oracle provides ETH/USD pricing to the CDP. It uses a dual-feed design with a cached fallback. No governance, no admin, no manual overrides.

Feed Priority

The oracle checks two price feeds in order and returns the first valid result:

1. Chainlink (primary) — ETH/USD aggregator. Trusted as the most widely used and battle-tested feed on Ethereum.
2. Chronicle (fallback) — ETH/USD feed. Used only if Chainlink is unavailable or stale.

If both feeds fail, the oracle falls back to the last known good price stored in the contract.

Staleness

A price is considered stale and rejected if it is older than 2 hours. This applies to both Chainlink and Chronicle. The CDP enforces this same 2-hour threshold independently, so even if the oracle returns a cached price, the CDP will reject it if the timestamp is too old.

Validation

Every price read goes through strict validation before being accepted:

• Price must be greater than zero.
• Timestamp must not be zero or in the future.
• Chainlink: roundId must be valid, answeredInRound must match, answer must be positive.
• Chronicle: value and age must pass the same sanity checks.
• All external calls are wrapped in try/catch. A reverting feed is treated as unavailable, not as an error.

Price Scaling

All prices are normalized to 18 decimals regardless of the source feed’s native precision. Chainlink ETH/USD uses 8 decimals, Chronicle uses 18. The oracle handles the conversion internally.

Cache

The oracle stores the last valid price and its timestamp. This cache serves as the final fallback when both live feeds are unavailable. The cache is updated through fetchPrice(), which is the only state-changing function. The CDP currently uses peekPriceWithTimestamp() which is read-only and does not update the cache.

For the cache to stay warm, an external caller (keeper or bot) should call fetchPrice() periodically. This is not strictly required for the protocol to function since the CDP validates freshness independently, but it provides an additional safety net.

No Deviation Check

The oracle does not compare prices between Chainlink and Chronicle. This is intentional. In volatile markets, one feed may update faster than the other. A deviation check could reject a valid Chainlink price because Chronicle hasn’t caught up yet, effectively bricking the oracle during the moments when accurate pricing matters most. In an immutable system, a bricked oracle means frozen liquidations and frozen withdrawals. The risk of a false rejection outweighs the risk of a single-feed price being slightly off.

Parameters

Every parameter in the protocol is hardcoded as a constant or immutable. Nothing can be changed after deployment.

CDP

Parameter	Value	Description
MAX_LTV_BPS	8,500 (85%)	Maximum loan-to-value for borrowing and withdrawing
LIQ_LTV_BPS	8,800 (88%)	LTV threshold that triggers liquidation
MIN_DEBT	200 enUSD	Minimum debt per position (prevents dust positions)
DONATION_BPS	300 (3%)	Percentage of seized collateral donated to vault during liquidation
ORACLE_MAX_AGE	2 hours	Maximum acceptable oracle price age

Buyout Premiums

LTV Range	Premium
85.00% – 87.99%	4%
60.00% – 84.99%	6%
Below 60.00%	9%

DirectMint

Parameter	Value	Description
REDEEM_FEE_BPS	50 (0.5%)	Fee on enUSD redemption, donated to vault
Mint Fee	0%	No fee on minting enUSD
Mint Ratio	1:1	enUSD minted equals stablecoin deposited

Oracle

Parameter	Value	Description
STALE_CHAINLINK	2 hours	Chainlink price rejected if older than this
STALE_CHRONICLE	2 hours	Chronicle price rejected if older than this
Price Scale	18 decimals	All prices normalized to 1e18

Token

Parameter	ENNI	enUSD
Decimals	18	6
Max Supply	21,000,000	Unlimited
Minter Slots	2	2

MasterChef

Parameter	Value	Description
MAX_POOLS	8	Maximum number of farming pools
MAX_CHEF_MINT	20,000,000 ENNI	Total mintable by MasterChef (excludes initial allocation)
ACC_PRECISION	1e12	Reward accumulator precision

Rewards Vault

Parameter	Value	Description
ACC_PRECISION	1e18	Per-share accumulator precision
Share Ratio	1:1	Shares equal ENNI deposited

Emission Schedule

ENNI has a fixed supply of 21,000,000 tokens distributed over 30 years. The emission rate decreases over time, front-loading rewards for early participants while maintaining long-term incentives.

Distribution

Allocation	Amount	Percentage
Initial Allocation	1,000,000 ENNI	4.76%
MasterChef Farming (30 years)	20,000,000 ENNI	95.24%
Total	21,000,000 ENNI	100%

Emission Phases

Phase	Period	Annual Rate	Duration	Phase Total
Phase 1	Year 1–2	2,000,000 ENNI	2 years	4,000,000
Phase 2	Year 3–10	1,000,000 ENNI	8 years	8,000,000
Phase 3	Year 11–30	400,000 ENNI	20 years	8,000,000
			Total	20,000,000

Cumulative Supply

Year	Emitted That Year	Total Circulating (incl. initial allocation)
1	2,000,000	3,000,000
2	2,000,000	5,000,000
3	1,000,000	6,000,000
5	1,000,000	8,000,000
10	1,000,000	13,000,000
15	400,000	15,000,000
20	400,000	17,000,000
25	400,000	19,000,000
30	400,000	21,000,000

After year 30, no more ENNI is emitted. The total supply is 21,000,000 forever.

Enforcement

The MasterChef contract has an immutable MAX_CHEF_MINT of 20,000,000 ENNI. Every mint call checks:

require(totalMinted + amount <= maxMintable)

This is enforced at both the MasterChef level and the EnniToken level. Even if a minter were compromised, the hard cap cannot be exceeded.

Design Rationale

The three-phase schedule balances early bootstrapping with long-term sustainability:

• Phase 1 (2M/year) — high emissions to attract initial liquidity and bootstrap the ecosystem.
• Phase 2 (1M/year) — steady emissions during growth. 8 years of predictable rewards.
• Phase 3 (400K/year) — low emissions for 20 years. Enough to maintain incentives without diluting existing holders. By this point, protocol revenue through the Rewards Vault should be the primary value driver for ENNI stakers.

Security

ENNI is designed to minimize trust assumptions. The security model is simple: immutable code, no admin keys, verify everything on-chain.

Immutability

Every contract is non-upgradeable. No proxy patterns, no delegatecall, no selfdestruct. Once deployed, the bytecode cannot change. There is no mechanism to pause, freeze, or modify any contract.

Ownership Renouncement

EnniToken and EnniMasterChef have owner roles at deployment for initial configuration only. The owner can set minter addresses on the token and add/rebalance farming pools on MasterChef. Once configuration is complete, ownership is renounced permanently by calling renounceOwnership(). This is a one-way action. After renouncement:

• Minter addresses on ENNI and enUSD are locked forever.
• Farming pools and allocation weights are locked forever.
• No admin function can ever be called again.

Verify renouncement on Etherscan by checking that owner() returns 0x0000000000000000000000000000000000000000.

Smart Contract Practices

All contracts follow established security patterns:

• ReentrancyGuard on every state-changing external function.
• SafeERC20 for all token transfers.
• Math.mulDiv for overflow-safe multiplication and division.
• Checks-Effects-Interactions pattern followed consistently. State is updated before external calls.
• Try/catch on all non-critical external calls (oracle reads, vault donations) to guarantee liveness.

Oracle Safety

The oracle wraps every external call in try/catch. A reverting Chainlink or Chronicle feed is treated as unavailable, not as a system error. The CDP independently validates price freshness with a 2-hour threshold. Stale prices are rejected.

No deviation check is used between feeds. This is intentional. In volatile markets a deviation check could falsely reject valid prices and freeze the system. For an immutable protocol, liveness is more important than theoretical manipulation resistance.

Known Dependencies

These are external factors outside the protocol’s control:

• Chainlink and Chronicle — if both feeds are down for over 2 hours simultaneously, borrowing, withdrawing, buyouts, and liquidations are paused. Deposits and repayments still work.
• USDC and USDT — if Circle or Tether blacklists the DirectMint contract address, stables held in that contract become inaccessible. enUSD minted through DirectMint would lose its hard peg floor. enUSD minted through the CDP remains fully functional.
• Ethereum — the protocol is deployed on Ethereum mainnet. It inherits all risks and guarantees of the base layer.

Audit Status

TBD — audit details will be published here when complete. In the meantime, all contract source code is verified on Etherscan and available on GitHub. Don’t trust. Verify.

Bug Reports

If you find a vulnerability, please report it responsibly. Contact details TBD.

Contract Addresses

All contracts are deployed on Ethereum mainnet. Source code is verified on Etherscan.

Core Contracts

Contract	Address	Etherscan
ENNI Token	TBD	View
enUSD Token	TBD	View
EnniCDP	TBD	View
EnniDirectMint	TBD	View
EnniOracle	TBD	View
EnniMasterChef	TBD	View
EnniRewardsVault	TBD	View

External Dependencies

Contract	Address	Etherscan
WETH	0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2	View
USDC	0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48	View
USDT	0xdAC17F958D2ee523a2206206994597C13D831ec7	View
Chainlink ETH/USD	0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419	View
Chronicle ETH/USD	TBD	View

Ownership Status

Contract	Owner	Status
ENNI Token	TBD	Pending renouncement
enUSD Token	TBD	Pending renouncement
EnniMasterChef	TBD	Pending renouncement

Verify ownership renouncement by checking that owner() returns 0x0000000000000000000000000000000000000000 on Etherscan.

Minter Configuration

ENNI Token

Slot	Address	Role
minter1	TBD	EnniMasterChef
minter2	TBD	EnniRewardsVault

enUSD Token

Slot	Address	Role
minter1	TBD	EnniCDP
minter2	TBD	EnniDirectMint