# Interfold CRISP Markdown version of https://l2beat.com/privacy/projects/interfold-crisp ## Summary **Warning:** Early mainnet: Interfold runs with an initial set of ciphernode operators, and only a few votes have taken place. L2BEAT does not measure the anonymity set of past votes. The rating reflects the protocol design only. - Metrics: Not tracked. Data tracking is not available for this project. - Tracked on: Ethereum - Attributes: FHE, ZK ### Risks - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link at risk (sentiment: warning); Network observer: Link private (sentiment: good); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link at risk (sentiment: warning). - Trusted setup: 176 participants (sentiment: good). Aztec Ignition: Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation. - Exit window: None (sentiment: bad). A 1-of-1 multisig plugin can upgrade the escrow that holds locked FOLD instantly, and the Interfold multisigs can upgrade the bonding registry instantly. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. Every ballot needs a signature from Interfold's CRISP server, whose address is fixed in CRISPProgram. - Reproducibility: Partially reproducible (sentiment: warning). The contracts, ciphernode software, circuits, CRISP server and app are open source. The two contracts that verify ballot proofs are unverified. ### About A secret ballot on Interfold's encrypted-computation network: voters cast FHE-encrypted ballots, and a committee of ciphernodes decrypts only the totals. ### Links - Website: https://theinterfold.com, https://governance.theinterfold.com - Docs: https://docs.theinterfold.com - Repository: https://github.com/theinterfold/interfold, https://github.com/theinterfold/CRISP, https://github.com/theinterfold/the-interfold-governance - Contracts explorer (Disco): https://disco.l2beat.com/ui/p/interfold ## Protocol description CRISP (Coercion-Resistant Impartial Selection Protocol) is a secret ballot on Interfold, a network for encrypted computation. Anyone can open a CRISP vote, and Interfold's governance votes on its proposals with it. A voter picks an option, and only the totals per option are decrypted. Every address that receives a ballot, and its voting power, stays public. Voters trust the committee of 19 ciphernodes drawn for each vote, any 10 of whom can decrypt every ballot. They also trust Interfold, which hosts the app and runs the CRISP server that must sign every ballot. Two Interfold multisigs change the protocol instantly, see [upgrades and governance](https://l2beat.com/privacy/projects/interfold-crisp#upgrades-and-governance). ### Architecture Each vote is one E3 (encrypted execution environment), a computation over encrypted inputs that the Interfold contract coordinates. CiphernodeRegistry draws a committee of ciphernodes by a lottery weighted by their collateral. The committee generates a shared public key for BFV, a lattice-based fully homomorphic encryption scheme, and each member keeps a share of the secret key. An OpenVM program adds up the encrypted ballots, and the committee decrypts only the sum. ### Flow 1. **Request.** A requester, such as a governance proposal, opens a CRISP vote, picks a committee size at or above Interfold's minimum and pays for its E3. Voting power is fixed at that moment. 2. **Vote.** Your browser encrypts the ballot to the committee key and proves that it is well formed and signed by your wallet. The CRISP server stores the ciphertext on Avail, signs that it is available and submits it. 3. **Mask.** Anyone can add an encrypted zero to any eligible address, and it looks like a vote. The app sends masks only when the voter adds them. 4. **Re-vote.** A later ballot from your wallet replaces the earlier one. 5. **Tally.** The committee decrypts the sum and publishes the totals per option. ### Voting A CRISP vote sets who may vote in one of three ways. It reads voting power from a token at a snapshot, as Interfold governance votes do, or uses an address list built from token holders or supplied by the requester. Interfold's governance must post each list's Merkle root, so it controls these lists. Each voter counts with their token weight or with the same weight as everyone else. With equal weights, the totals leave nothing to match against. ### App The ratings assume Interfold governance votes through Interfold's [governance app](https://governance.theinterfold.com), which is [open source](https://github.com/theinterfold/the-interfold-governance) and hosted by Interfold. By default it counts a random 99 to 100% of the voter's power, so totals do not match balances exactly. A local build removes the trust in Interfold's hosted copy. The repository ships settings only for Sepolia, so a mainnet build needs to copy its settings from the hosted app's code. A voter can also send the ballot from their own wallet. ### Ciphernodes Operators register by bonding 32,000 FOLD and buying tickets with sUSDS. The lottery gives each bond-owner address at most one seat per committee, the only limit on one party filling a committee. Interfold does not name the operators and calls the current set an [initial one](https://blog.theinterfold.com/network-alpha-mainnet/). ## Privacy **What the protocol promises:** Hides which option each voter chose. Every address that receives a ballot, its voting power, the timing and the totals per option are public. Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. Ballots stay encrypted, and only the totals per option are decrypted. A mask looks like a vote, so an input to an address does not prove that its owner voted. **Sources** - [Inputs carry only a commitment to the ciphertext](https://l2beat.com/privacy/projects/interfold-crisp#CRISPProgram) - [Votes, updates and masks share one circuit](https://github.com/theinterfold/CRISP/blob/35dbda14c4026510ba91e15d700399df115900ab/circuits/bin/crisp_onchain/src/main.nr#L28-L58) ### Chain analyst Link at risk (sentiment: warning) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. Voting power is public, so the totals per option can reveal how a voter with outsized weight voted. A voter whose weight exceeds the totals of all but one option can only have chosen that one. The app's random weight blurs exact matches among smaller voters. **Advice:** Keep the random weight on. **Sources** - [Random weight against subset-sum matching](https://github.com/theinterfold/the-interfold-governance/blob/28b03a8b529dfa7491f01229724391665f06bd95/app/plugins/crispVoting/utils/ballotWeight.ts#L36-L55) - [Interfold: the public result can show how a voter voted](https://github.com/theinterfold/interfold/blob/c2a28ae6b277aa72a62c34c07142bfadf7c4b4e1/docs/pages/governance.mdx#L237-L270) ### Network observer Link private (sentiment: good) **Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Learns IP addresses, timing, fingerprints and ciphertext. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. The ballot leaves the browser only as ciphertext with its proof, traffic shows at most that the user sent a ballot. The app sends ballots to the CRISP server and reads the chain through it, falling back to an RPC proxy on Interfold's host. **Sources** - [Chain reads go to the CRISP server first](https://github.com/theinterfold/the-interfold-governance/blob/28b03a8b529dfa7491f01229724391665f06bd95/app/constants.ts#L70-L82) - [Ballots are sent to the CRISP server](https://github.com/theinterfold/the-interfold-governance/blob/28b03a8b529dfa7491f01229724391665f06bd95/app/plugins/crispVoting/hooks/useCrispServer.ts#L700-L712) ### Privileged insider Link exposed (sentiment: bad) **Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the client: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge. Any 10 of the 19 ciphernodes in a vote's committee can combine their key shares and decrypt every ballot of that vote. Operators are unnamed, and the lottery limits only each bond-owner address to one seat. The Interfold multisigs can instantly lower the minimum committee of future votes to 3 members, 2 of whom decrypt. **Sources** - [Interfold: T + 1 colluding members decrypt individual ballots](https://github.com/theinterfold/interfold/blob/c2a28ae6b277aa72a62c34c07142bfadf7c4b4e1/docs/pages/governance.mdx#L244-L245) - [Committee sizes and decryption thresholds (T + 1)](https://github.com/theinterfold/interfold/blob/c2a28ae6b277aa72a62c34c07142bfadf7c4b4e1/packages/interfold-contracts/contracts/lib/ActiveCryptoConfig.sol#L29-L42) - [One seat per bond owner](https://l2beat.com/privacy/projects/interfold-crisp#CiphernodeRegistry) - [Upgrades & Governance](https://l2beat.com/privacy/projects/interfold-crisp#upgrades-and-governance) ### Future adversary Link at risk (sentiment: warning) **Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public. The ballot verifiers are unverified, so whether archived ballot proofs hide the vote from a future break cannot be checked. The ballot ciphertexts rest on lattice assumptions with no known quantum attack. A recovered wallet key can replace a voter's ballot in an open vote but opens no past one. **Sources** - [Key shares are BFV-encrypted and never published](https://github.com/theinterfold/interfold/blob/c2a28ae6b277aa72a62c34c07142bfadf7c4b4e1/docs/pages/internals/dkg.mdx#L764-L772) - [Unverified ballot proof verifier](https://l2beat.com/privacy/projects/interfold-crisp#CrispOnchainBallotVerifier) ## Milestones & Incidents - 2026-10-10: [Protocol proposals move to secret ballots](https://blog.theinterfold.com/how-to-vote-on-interfold/). Interfold Protocol Proposals now pass a CRISP vote before InterfoldSafeB approves them. - 2026-10-02: [First CRISP vote backs the constitution](https://etherscan.io/tx/0x71b8f01267c7edaf4015a58407eef393418e3eb56feb66950bed04c4a96c0660). The third constitution vote is the first CRISP vote to be decrypted, with every vote on yes. - 2026-09-29 (incident): [New votes paused for two weeks](https://etherscan.io/tx/0x28446d923bd9a9b99b2881cbfdeac13a5ab0cc7f2449e2d074c820f806690e86). Interfold pauses new computation requests, and with them new votes, until an upgrade on October 12. - 2026-08-19: [Network Alpha live on Ethereum](https://blog.theinterfold.com/network-alpha-mainnet/). Interfold launches its mainnet and the FOLD token, with an initial set of ciphernode operators. ## Risk summary ### Funds can be stolen if 1. the VotingEscrowMultisig upgrades the escrow that holds locked FOLD, which takes effect instantly. 2. either Interfold multisig upgrades the bonding registry holding bonded FOLD, which takes effect instantly. ### Privacy can be lost if 1. 10 of the 19 ciphernodes in a vote's committee combine their key shares (see privileged insider). 2. one voter's power exceeds the totals of all but one option (see chain analyst). 3. the ballot proofs, whose verifiers are unverified, do not hide the vote, so archived ballots reveal choices to a future break (see future adversary). ## Upgrades & Governance InterfoldSafeA (3/5) and InterfoldSafeB (3/5) have the same signers. Through the Admin plugin, either can execute any InterfoldGovCore action instantly and without a vote. InterfoldGovCore owns the coordinator, the ciphernode and bonding registries and their proxy admins. The multisigs can therefore upgrade these contracts and change the committee size of future votes. CRISPProgram cannot be upgraded. Governance proposals pass a CRISP vote of 5 days, then need InterfoldSafeB's approval within 5 days. VotingEscrowGovCore can upgrade the escrow that holds locked FOLD. It executes whatever its 1-of-1 multisig plugin approves. InterfoldGovCore can also execute through it. ## Trusted setup Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup. ### Aztec Ignition - Risk: green (lowest risk) - Proof systems: UltraHonk (Plonk) Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation. - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification). - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup). - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition). ## Updates Each date links the update on the HTML page, which also shows its contract diffs. ### [2026-10-19 13:02 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=bb1702a3) (2 changes) Config: discover the two unverified CRISP ballot verifiers from CRISPProgram's constructor arguments and track the committee size of each committee preset on Interfold. Model ciphernode operators as registry participants instead of multisig members, and resolve the VotingEscrowMultisig plugin's members. ### [2026-10-16 09:52 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=022c6b27) (high severity, 159 changes) Interfold v0.19.0 upgrade. L2BEAT reproduced and verified it on Sourcify and Etherscan, with the OpenVM Halo2 verifier from the OpenVM v2.0.2 artifacts. New requests are **unpaused**, and the crypto config id changed to the new BFV parameter set (`0xa174862e…`). - coordinator: https://disco.l2beat.com/diff/eth:0xad5C8CA4bd0d086272039400Fa532019A920dD43/eth:0xA1FAB087d7315d2220910C6e0dEcaf659F3f4d2d - pk router: https://disco.l2beat.com/diff/eth:0x7CD10057c25674bd5666A9deEE3193f1b29563d1/eth:0x3E9614e711ee301DAC3FeF7D86031ED015bc406b - decryption router: https://disco.l2beat.com/diff/eth:0xA66CAb7AE230698b2a9ee1E0E967BaD4651FeEa7/eth:0xbbFF7101A3Be43e06b64B00e2e656529E6aDf2eE The ciphertext output is now proven with OpenVM instead of RISC Zero. The OpenVmBfvCiphertextVerifier pins one image ID. The OpenVmReceiptVerifier binds it to fixed app executable and VM commitments, checked by an immutable OpenVM Halo2 verifier. - ciphertext verifier: https://disco.l2beat.com/diff/eth:0x80D217d3b2e16fF2ecc178cC75655C773895c549/eth:0x6cD258E0a893612Aea41c42dC47450ac1A6E2dD1 The DKG and decryption routes point to new secure-8192 wrappers and Honk aggregation verifiers. A new CRISPProgram (eth:0x1EA4dBdec0F2F1E9235915847fc59EF4045EEe28) with OpenVM tally proofs is registered as an E3 program. Its owner, the DAO, can replace its OpenVM verifier immediately. The DAO replaced its Interfold Protocol Proposal pipeline. A new StagedProposalProcessor holds EXECUTE on the DAO. It comes with a new proposal condition and a new CRISP voting plugin. The plugin reads voting power from a new BondedVotes, which gives treasury Safes no voting power. The old processor and CRISP plugin are detached. - CRISP voting: https://disco.l2beat.com/diff/eth:0xb3d51BDe9cB8401cE9C630448Da2619279eF97DA/eth:0x8153c6dce903b3a4a886399d310668fb8c97cec6 ### [2026-10-12 07:18 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=9821718a) (8 changes) Three operator keys joined the registries. The valid active-operator count rose from 70 to 74. ### [2026-10-01 10:27 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=7e4e9584) (high severity, 44 changes) BondingRegistry and CiphernodeRegistry upgraded. The same tx enabled a 3-day admission cooldown. - BondingRegistry: checkpoints bond-owner history and counts distinct active bond owners. New owner-set admission policy: a cooldown for newly registered or re-owned keys, and an admission pause. New E3 requests are blocked until all operators have refreshed after an eligibility bump. [diff](https://disco.l2beat.com/diff/eth:0x290d5156AAa23cbEb458751A73688d2375220Ad2/eth:0x3Bb4420311fe1AD580a6971B0731Cf1825b914db) - CiphernodeRegistry: sortition admits at most one key per bond owner, and new requests need at least N distinct active bond owners. [diff](https://disco.l2beat.com/diff/eth:0xD9A3224D829a4ac8b55A75C539fD447AC4B05Bf2/eth:0x8354E51d14C118f6386C3F6F73E79190D71FFA3A) - 12 new ciphernode operators (72 registered). - The protocol was unpaused by InterfoldSafeB (via AdminPlugin, no delay) on 2026-09-25 right after the upgrade and paused again on 2026-09-29, after one new E3 was requested (earlier window 2026-09-19 to 09-22). Requests are currently paused. ### [2026-09-22 15:12 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=97731afc) (high severity, 305 changes) Upgraded all Interfold contracts across the board to unverified implementations. We went ahead and verified them for you on etherscan. The protocol was shortly unpaused to test it and then re-paused. Changes look like incremental small in-prod development of their protocol. Read on for detailed AI change descriptions and diff links. - https://disco.l2beat.com/diff/eth:0xA7e1f2693b3b5038e505396Dbd21d6c26ECa8aA2/eth:0xad5C8CA4bd0d086272039400Fa532019A920dD43 Interfold: the BFV parameter set, committee sizes and thresholds become compiled-in constants of the ActiveCryptoConfig library (removing the owner-settable committee thresholds and param-set registry), with the lifecycle and pricing logic in external libraries. - https://disco.l2beat.com/diff/eth:0xFff476751949a7e1B784b5c88648833c1e8dD69c/eth:0xD9A3224D829a4ac8b55A75C539fD447AC4B05Bf2 CiphernodeRegistry: exposes the randomness circuit-breaker state (randomnessDegraded) and relinks the sortition library. - https://disco.l2beat.com/diff/eth:0xd89D3fE1b53eF95111c0E68A8CeFDfd20EcCA53a/eth:0x290d5156AAa23cbEb458751A73688d2375220Ad2 BondingRegistry: identical source redeployed against freshly deployed bonding libraries. - https://disco.l2beat.com/diff/eth:0xE506249Ba5ede04A68b702b92704a0b88054f86A/eth:0x7C85D6C39EdAfCE6398fF1299b2a1eaBa0645870 E3RefundManager: drops the MAX_PROTOCOL_BPS constant and relinks the refund-claim library. - https://disco.l2beat.com/diff/eth:0x974E865B1BB24AF2a9ef8204AdEA9251Cc7C5FD9/eth:0x753109Ee36Dc65cC178875AddA30C6433e5bEEe4 SlashingManager: new deployment authorized in the BondingRegistry in place of the old manager, which was deauthorized; the DAO holds its default-admin and governance roles. - https://disco.l2beat.com/diff/eth:0xa0273f884816dfF0BE9B5ED50aB3AA29D6AaA712/eth:0xC60919F8Bd128B76E11F4B071C8c38e1391a3e00 RandomnessProvider: new Chainlink VRF v2.5 consumer on a new subscription, with the CiphernodeRegistry as its only requester and the DAO as owner. - https://disco.l2beat.com/diff/eth:0xBA1854fDA7A5c127606572e43Dc7B37b7A15bdFf/eth:0x7CD10057c25674bd5666A9deEE3193f1b29563d1 BFV public-key verifier: single-committee wrapper replaced by a router over three per-committee-size verifiers with new Honk circuit verifiers and verification keys. - https://disco.l2beat.com/diff/eth:0xf143b969ea481Ccf251194D15F82007C67AABc53/eth:0xA66CAb7AE230698b2a9ee1E0E967BaD4651FeEa7 BFV decryption verifier: single-committee wrapper replaced by a router over three per-committee-size verifiers with new Honk circuit verifiers and verification keys. - https://disco.l2beat.com/diff/eth:0x40a18Fc27ac4a4d86fA70385c6814e453b6BFF2c/eth:0x80D217d3b2e16fF2ecc178cC75655C773895c549 Ciphertext verifier: same RISC Zero wrapper redeployed with a new guest image ID against a new RISC Zero verifier. ### [2026-09-15 11:32 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=c44692d1) (9 changes) Three new ciphernodes registered and four operators activated in the bonding registry, each new operator posting the standard 32k FOLD bond. numActiveOperators 14 -> 19 out of 21 registered. ### [2026-09-07 14:01 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=b85919fb) (11 changes) Operator changes only. The protocol is still paused, while ciphernodes are bonding and registering. No request has been processed yet. ### [2026-09-01 14:38 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=03c16e87) (high severity, 59 changes) 2026-08-28 upgrade of the Interfold, CiphernodeRegistry and BondingRegistry proxies, now fully reviewed from verified source. Discovery is back on templates: new shapes for the three upgraded implementations and new ChainlinkVrfRandomnessProvider and NodeReleaseRegistry templates replace the interim explicit-handler overrides in config.jsonc. - Sortition entropy now comes from a Chainlink VRF v2.5 subscription consumer (RandomnessProvider) instead of EIP-2935 blockhashes. All its VRF parameters are immutable (native-ETH-paid subscription, 1 ETH minimum balance, 64 confirmations); the DAO owner can only replace the coordinator. The registry accepts a response only within a 1h timeout window bound to the request, and a timed-out request permissionlessly trips a circuit breaker that zeroes the provider, disabling new E3 requests until governance re-sets it (only possible while requests are paused and no committees are outstanding). - The formerly unknown 16th pricing parameter is randomnessFlatFee (5 USDS): a non-refundable request-time fee credited to the protocol treasury to reimburse the VRF subscription, exempt from the margin markup and required to be nonzero. - NodeReleaseRegistry (DAO-owned, Ownable2Step, renounce disabled) gates operator eligibility on self-attested software releases: operators must attest the exact required protocol version (currently 1) and at least the required node generation (currently 1). The DAO can only raise the requirement, only while paused and drained, and each raise (like the wiring-in itself, which bumped the eligibility-configuration version 4 -> 5) instantly invalidates every operator's cached active status. - Requester cancellation was narrowed: an E3 can now only be cancelled after its randomness request times out without a result (classified as CommitteeFormationTimeout); mid-flight cancellation of active E3s was removed. - BondingRegistry's external interface is unchanged (internal refactor into libraries plus the node-release eligibility hook); requestsPaused remains true. ### [2026-08-27 12:17 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=15d44004) (17 changes) Operators added, still paused. ### [2026-08-25 10:30 UTC](https://l2beat.com/privacy/projects/interfold-crisp?update=87791bda) (46 changes) Interfold coordinates ephemeral encrypted computations on Ethereum using allowlisted application contracts and a ticket-selected committee of bonded ciphernodes (who do offchain execution). Users publish encrypted inputs, an offchain compute provider produces a proof-backed encrypted result, and a 2-of-3 committee of cyphernodes threshold-decrypts it into a publicly posted plaintext output. RISC Zero verifies the application-specific encrypted computation, while Honk proofs bind distributed key generation and threshold decryption to the selected committee and E3. New programs, verifiers and core configuration are DAO-controlled, and confidentiality depends on fewer than two selected committee members colluding. Protocol is paused atm. ## Permissions Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/interfold ### Ethereum #### Actors ##### InterfoldSafeA Addresses: [0x5429D8c7fD14023f3c414126F94BbE25A05fC018](https://etherscan.io/address/0x5429D8c7fD14023f3c414126F94BbE25A05fC018) A Multisig with 3/5 threshold. - Can upgrade **with no delay** - BondingRegistry [via: InterfoldGovCore → ProxyAdmin] - E3RefundManager [via: InterfoldGovCore → ProxyAdmin] - Interfold [via: InterfoldGovCore → ProxyAdmin] - InterfoldGovCore [via: InterfoldGovCore] - VotingEscrowGovCore [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - CiphernodeRegistry [via: InterfoldGovCore → ProxyAdmin] - Can interact with BondingRegistry - replace collateral assets and protocol dependencies; change bond, ticket, eligibility and exit parameters; set the committee-admission cooldown or pause admissions to future committees; authorize slashing managers and reward distributors; clear bans from old managers; withdraw slashed funds; and replace the slashed-funds treasury [via: InterfoldGovCore] - Can interact with E3RefundManager - change the work-allocation split, coordinator and treasury without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application OpenVM receipt verifier, and with it the image ID, immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with Interfold - pause or unpause new requests; replace the registry, bonding, slashing, refund and node-release dependencies; allow fee assets and E3 programs; replace proof verifiers; and change pricing (including the flat randomness fee), timeouts, parameter sets and committee thresholds without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgramV2 - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with InterfoldGovCore - change multisig plugin target execution configuration [via: InterfoldGovCore] - change support, participation, duration, proposer-power and minimum-approval requirements for future votes [via: InterfoldGovCore] - change the settings of the CRISP token-voting plugin used as the IPP voting stage, including the committee size of future votes [via: InterfoldGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore] - redirect calls made by the Admin plugin to another executor or target [via: InterfoldGovCore] - redirect passed CRISP vote actions to another executor or target [via: InterfoldGovCore] - redirect passed Interfold Protocol Proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed vote actions to another executor or target [via: InterfoldGovCore] - replace the address trusted to append the effective caller to IPP proposal transactions [via: InterfoldGovCore] - replace the address trusted to append the effective caller to proposal transactions [via: InterfoldGovCore] - replace the rules that gate creation of Interfold Protocol Proposals [via: InterfoldGovCore] - replace the rules that gate public creation of staged proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future Interfold Protocol Proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future public proposals [via: InterfoldGovCore] - Can interact with SlashingManager - create or disable slash policies, grant or revoke evidence slashers, resolve appeals, close E3 assignments and propose, confirm or remove operator bans [via: InterfoldGovCore] - replace the coordinator, bonding registry, ciphernode registry and refund manager, and grant or revoke governance membership. A transfer of the default-admin role itself has the configured delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with NodeReleaseRegistry - raise the required ciphernode protocol version and node generation, which instantly invalidates every operator's cached eligibility until they attest the new release. The requirement can only increase, and only while new E3 requests are paused and no E3s or committees are active [via: InterfoldGovCore] - Can interact with VotingEscrowGovCore - change cooldowns and exit fees and upgrade the voting-escrow exit queue [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin settings [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin target execution configuration [via: InterfoldGovCore → VotingEscrowGovCore] - change transfer whitelist settings and upgrade the voting-lock NFT [via: InterfoldGovCore → VotingEscrowGovCore] - change voting epochs and upgrade the voting-escrow Clock [via: InterfoldGovCore → VotingEscrowGovCore] - change voting-power curve parameters and upgrade the Curve implementation [via: InterfoldGovCore → VotingEscrowGovCore] - complete queued voting-escrow withdrawals [via: InterfoldGovCore → VotingEscrowGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - manage gauge metadata and the voting-power update hook [via: InterfoldGovCore → VotingEscrowGovCore] - pause and unpause voting-escrow operations [via: InterfoldGovCore → VotingEscrowGovCore] - pause the escrow voting-power adapter, manage delegation settings and upgrade its implementation [via: InterfoldGovCore → VotingEscrowGovCore] - replace voting-power dependencies, change minimum deposits and split rules, and upgrade VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - sweep unaccounted tokens and NFTs from VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - update delegated voting power through the escrow voting adapter [via: InterfoldGovCore → VotingEscrowGovCore] - Can interact with InterfoldTicketToken - schedule and activate a registry replacement after one day when all ticket liabilities are zero, and rescue ERC-20s other than the underlying sUSDS [via: InterfoldGovCore] - Can interact with RandomnessProvider - replace the Chainlink VRF coordinator that delivers the sortition entropy [via: InterfoldGovCore] - Can interact with CiphernodeRegistry - replace the coordinator, bonding, slashing and randomness-provider dependencies; add or remove ciphernodes; change the sortition window and randomness timeout; and update the DKG verifier and accusation-vote validity parameters. DKG-verifier replacement and risk-reducing accusation-window changes use a two-day propose/commit delay, while other changes are immediate. Randomness settings can only change while new requests are paused and no committees are outstanding [via: InterfoldGovCore] - Can interact with FOLD - create immutable vesting policies, link claimed balances to policies and exempt accounts from automatic claim locks until the immutable lock cutoff - grant and revoke FOLD roles. The role's direct mint function permanently reverts after TGE Participants (5): [0xCb83ef506989534463a0E3F6E5526a8FE26897B3](https://etherscan.io/address/0xCb83ef506989534463a0E3F6E5526a8FE26897B3), [0xA8C3c4B6aE7f31193057A6d8833980853Ef71f85](https://etherscan.io/address/0xA8C3c4B6aE7f31193057A6d8833980853Ef71f85), [0xC3F8EBC47A4C47D91b643a4C64d34eA7B2584260](https://etherscan.io/address/0xC3F8EBC47A4C47D91b643a4C64d34eA7B2584260), [0x26f8034baBfbcA2233350a0Dca1CCcE3d01Fa41F](https://etherscan.io/address/0x26f8034baBfbcA2233350a0Dca1CCcE3d01Fa41F), [0x7b4273f9291aEAC9ea85f44093Aca5fC873A7Cf5](https://etherscan.io/address/0x7b4273f9291aEAC9ea85f44093Aca5fC873A7Cf5) ##### PublicStagedProposalProcessor Addresses: [0x9c0Ff283399Bd1D3111E6c9C689066759b7AccDb](https://etherscan.io/address/0x9c0Ff283399Bd1D3111E6c9C689066759b7AccDb) Upgradeable Aragon staged-proposal plugin that executes governance actions after proposals pass its configured sequence of voting or manual bodies, thresholds and timing windows. - Can upgrade **with no delay** - BondingRegistry [via: InterfoldGovCore → ProxyAdmin] - E3RefundManager [via: InterfoldGovCore → ProxyAdmin] - Interfold [via: InterfoldGovCore → ProxyAdmin] - InterfoldGovCore [via: InterfoldGovCore] - VotingEscrowGovCore [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - CiphernodeRegistry [via: InterfoldGovCore → ProxyAdmin] - Can interact with BondingRegistry - replace collateral assets and protocol dependencies; change bond, ticket, eligibility and exit parameters; set the committee-admission cooldown or pause admissions to future committees; authorize slashing managers and reward distributors; clear bans from old managers; withdraw slashed funds; and replace the slashed-funds treasury [via: InterfoldGovCore] - Can interact with E3RefundManager - change the work-allocation split, coordinator and treasury without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application OpenVM receipt verifier, and with it the image ID, immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with Interfold - pause or unpause new requests; replace the registry, bonding, slashing, refund and node-release dependencies; allow fee assets and E3 programs; replace proof verifiers; and change pricing (including the flat randomness fee), timeouts, parameter sets and committee thresholds without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgramV2 - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with InterfoldGovCore - change multisig plugin target execution configuration [via: InterfoldGovCore - or - acting directly] - change support, participation, duration, proposer-power and minimum-approval requirements for future votes [via: InterfoldGovCore] - change the settings of the CRISP token-voting plugin used as the IPP voting stage, including the committee size of future votes [via: InterfoldGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore] - open a token vote using the caller-supplied proposal payload - redirect calls made by the Admin plugin to another executor or target [via: InterfoldGovCore] - redirect passed CRISP vote actions to another executor or target [via: InterfoldGovCore] - redirect passed Interfold Protocol Proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed vote actions to another executor or target [via: InterfoldGovCore] - replace the address trusted to append the effective caller to IPP proposal transactions [via: InterfoldGovCore] - replace the address trusted to append the effective caller to proposal transactions [via: InterfoldGovCore] - replace the rules that gate creation of Interfold Protocol Proposals [via: InterfoldGovCore] - replace the rules that gate public creation of staged proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future Interfold Protocol Proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future public proposals [via: InterfoldGovCore] - Can interact with SlashingManager - create or disable slash policies, grant or revoke evidence slashers, resolve appeals, close E3 assignments and propose, confirm or remove operator bans [via: InterfoldGovCore] - replace the coordinator, bonding registry, ciphernode registry and refund manager, and grant or revoke governance membership. A transfer of the default-admin role itself has the configured delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with NodeReleaseRegistry - raise the required ciphernode protocol version and node generation, which instantly invalidates every operator's cached eligibility until they attest the new release. The requirement can only increase, and only while new E3 requests are paused and no E3s or committees are active [via: InterfoldGovCore] - Can interact with VotingEscrowGovCore - change cooldowns and exit fees and upgrade the voting-escrow exit queue [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin settings [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin target execution configuration [via: InterfoldGovCore → VotingEscrowGovCore] - change transfer whitelist settings and upgrade the voting-lock NFT [via: InterfoldGovCore → VotingEscrowGovCore] - change voting epochs and upgrade the voting-escrow Clock [via: InterfoldGovCore → VotingEscrowGovCore] - change voting-power curve parameters and upgrade the Curve implementation [via: InterfoldGovCore → VotingEscrowGovCore] - complete queued voting-escrow withdrawals [via: InterfoldGovCore → VotingEscrowGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - manage gauge metadata and the voting-power update hook [via: InterfoldGovCore → VotingEscrowGovCore] - pause and unpause voting-escrow operations [via: InterfoldGovCore → VotingEscrowGovCore] - pause the escrow voting-power adapter, manage delegation settings and upgrade its implementation [via: InterfoldGovCore → VotingEscrowGovCore] - replace voting-power dependencies, change minimum deposits and split rules, and upgrade VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - sweep unaccounted tokens and NFTs from VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - update delegated voting power through the escrow voting adapter [via: InterfoldGovCore → VotingEscrowGovCore] - Can interact with InterfoldTicketToken - schedule and activate a registry replacement after one day when all ticket liabilities are zero, and rescue ERC-20s other than the underlying sUSDS [via: InterfoldGovCore] - Can interact with RandomnessProvider - replace the Chainlink VRF coordinator that delivers the sortition entropy [via: InterfoldGovCore] - Can interact with CiphernodeRegistry - replace the coordinator, bonding, slashing and randomness-provider dependencies; add or remove ciphernodes; change the sortition window and randomness timeout; and update the DKG verifier and accusation-vote validity parameters. DKG-verifier replacement and risk-reducing accusation-window changes use a two-day propose/commit delay, while other changes are immediate. Randomness settings can only change while new requests are paused and no committees are outstanding [via: InterfoldGovCore] ##### ProtocolProposalProcessor Addresses: [0xc19635aD8De0a0D6430025fC5ed212CA8216bab3](https://etherscan.io/address/0xc19635aD8De0a0D6430025fC5ed212CA8216bab3) Upgradeable Aragon staged-proposal plugin that executes governance actions after proposals pass its configured sequence of voting or manual bodies, thresholds and timing windows. - Can upgrade **with no delay** - BondingRegistry [via: InterfoldGovCore → ProxyAdmin] - E3RefundManager [via: InterfoldGovCore → ProxyAdmin] - Interfold [via: InterfoldGovCore → ProxyAdmin] - InterfoldGovCore [via: InterfoldGovCore] - VotingEscrowGovCore [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - CiphernodeRegistry [via: InterfoldGovCore → ProxyAdmin] - Can interact with BondingRegistry - replace collateral assets and protocol dependencies; change bond, ticket, eligibility and exit parameters; set the committee-admission cooldown or pause admissions to future committees; authorize slashing managers and reward distributors; clear bans from old managers; withdraw slashed funds; and replace the slashed-funds treasury [via: InterfoldGovCore] - Can interact with E3RefundManager - change the work-allocation split, coordinator and treasury without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application OpenVM receipt verifier, and with it the image ID, immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with Interfold - pause or unpause new requests; replace the registry, bonding, slashing, refund and node-release dependencies; allow fee assets and E3 programs; replace proof verifiers; and change pricing (including the flat randomness fee), timeouts, parameter sets and committee thresholds without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgramV2 - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with InterfoldGovCore - change multisig plugin target execution configuration [via: InterfoldGovCore - or - acting directly] - change support, participation, duration, proposer-power and minimum-approval requirements for future votes [via: InterfoldGovCore] - change the settings of the CRISP token-voting plugin used as the IPP voting stage, including the committee size of future votes [via: InterfoldGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore] - open a CRISP token vote using the caller-supplied proposal payload - redirect calls made by the Admin plugin to another executor or target [via: InterfoldGovCore] - redirect passed CRISP vote actions to another executor or target [via: InterfoldGovCore] - redirect passed Interfold Protocol Proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed vote actions to another executor or target [via: InterfoldGovCore] - replace the address trusted to append the effective caller to IPP proposal transactions [via: InterfoldGovCore] - replace the address trusted to append the effective caller to proposal transactions [via: InterfoldGovCore] - replace the rules that gate creation of Interfold Protocol Proposals [via: InterfoldGovCore] - replace the rules that gate public creation of staged proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future Interfold Protocol Proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future public proposals [via: InterfoldGovCore] - Can interact with SlashingManager - create or disable slash policies, grant or revoke evidence slashers, resolve appeals, close E3 assignments and propose, confirm or remove operator bans [via: InterfoldGovCore] - replace the coordinator, bonding registry, ciphernode registry and refund manager, and grant or revoke governance membership. A transfer of the default-admin role itself has the configured delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with NodeReleaseRegistry - raise the required ciphernode protocol version and node generation, which instantly invalidates every operator's cached eligibility until they attest the new release. The requirement can only increase, and only while new E3 requests are paused and no E3s or committees are active [via: InterfoldGovCore] - Can interact with VotingEscrowGovCore - change cooldowns and exit fees and upgrade the voting-escrow exit queue [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin settings [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin target execution configuration [via: InterfoldGovCore → VotingEscrowGovCore] - change transfer whitelist settings and upgrade the voting-lock NFT [via: InterfoldGovCore → VotingEscrowGovCore] - change voting epochs and upgrade the voting-escrow Clock [via: InterfoldGovCore → VotingEscrowGovCore] - change voting-power curve parameters and upgrade the Curve implementation [via: InterfoldGovCore → VotingEscrowGovCore] - complete queued voting-escrow withdrawals [via: InterfoldGovCore → VotingEscrowGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - manage gauge metadata and the voting-power update hook [via: InterfoldGovCore → VotingEscrowGovCore] - pause and unpause voting-escrow operations [via: InterfoldGovCore → VotingEscrowGovCore] - pause the escrow voting-power adapter, manage delegation settings and upgrade its implementation [via: InterfoldGovCore → VotingEscrowGovCore] - replace voting-power dependencies, change minimum deposits and split rules, and upgrade VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - sweep unaccounted tokens and NFTs from VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - update delegated voting power through the escrow voting adapter [via: InterfoldGovCore → VotingEscrowGovCore] - Can interact with InterfoldTicketToken - schedule and activate a registry replacement after one day when all ticket liabilities are zero, and rescue ERC-20s other than the underlying sUSDS [via: InterfoldGovCore] - Can interact with RandomnessProvider - replace the Chainlink VRF coordinator that delivers the sortition entropy [via: InterfoldGovCore] - Can interact with CiphernodeRegistry - replace the coordinator, bonding, slashing and randomness-provider dependencies; add or remove ciphernodes; change the sortition window and randomness timeout; and update the DKG verifier and accusation-vote validity parameters. DKG-verifier replacement and risk-reducing accusation-window changes use a two-day propose/commit delay, while other changes are immediate. Randomness settings can only change while new requests are paused and no committees are outstanding [via: InterfoldGovCore] ##### AdminPlugin Addresses: [0xF21e25455988887EE797050080141eba67B33920](https://etherscan.io/address/0xF21e25455988887EE797050080141eba67B33920) Non-upgradeable Aragon Admin plugin. Holders of the EXECUTE_PROPOSAL permission its governance contract grants can submit actions that the plugin forwards immediately, without a vote or onchain delay. - Can upgrade **with no delay** - BondingRegistry [via: InterfoldGovCore → ProxyAdmin] - E3RefundManager [via: InterfoldGovCore → ProxyAdmin] - Interfold [via: InterfoldGovCore → ProxyAdmin] - InterfoldGovCore [via: InterfoldGovCore] - VotingEscrowGovCore [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - CiphernodeRegistry [via: InterfoldGovCore → ProxyAdmin] - Can interact with BondingRegistry - replace collateral assets and protocol dependencies; change bond, ticket, eligibility and exit parameters; set the committee-admission cooldown or pause admissions to future committees; authorize slashing managers and reward distributors; clear bans from old managers; withdraw slashed funds; and replace the slashed-funds treasury [via: InterfoldGovCore] - Can interact with E3RefundManager - change the work-allocation split, coordinator and treasury without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application OpenVM receipt verifier, and with it the image ID, immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with Interfold - pause or unpause new requests; replace the registry, bonding, slashing, refund and node-release dependencies; allow fee assets and E3 programs; replace proof verifiers; and change pricing (including the flat randomness fee), timeouts, parameter sets and committee thresholds without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgramV2 - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with InterfoldGovCore - change multisig plugin target execution configuration [via: InterfoldGovCore - or - acting directly] - change support, participation, duration, proposer-power and minimum-approval requirements for future votes [via: InterfoldGovCore] - change the settings of the CRISP token-voting plugin used as the IPP voting stage, including the committee size of future votes [via: InterfoldGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore] - redirect calls made by the Admin plugin to another executor or target [via: InterfoldGovCore] - redirect passed CRISP vote actions to another executor or target [via: InterfoldGovCore] - redirect passed Interfold Protocol Proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed vote actions to another executor or target [via: InterfoldGovCore] - replace the address trusted to append the effective caller to IPP proposal transactions [via: InterfoldGovCore] - replace the address trusted to append the effective caller to proposal transactions [via: InterfoldGovCore] - replace the rules that gate creation of Interfold Protocol Proposals [via: InterfoldGovCore] - replace the rules that gate public creation of staged proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future Interfold Protocol Proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future public proposals [via: InterfoldGovCore] - Can interact with SlashingManager - create or disable slash policies, grant or revoke evidence slashers, resolve appeals, close E3 assignments and propose, confirm or remove operator bans [via: InterfoldGovCore] - replace the coordinator, bonding registry, ciphernode registry and refund manager, and grant or revoke governance membership. A transfer of the default-admin role itself has the configured delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with NodeReleaseRegistry - raise the required ciphernode protocol version and node generation, which instantly invalidates every operator's cached eligibility until they attest the new release. The requirement can only increase, and only while new E3 requests are paused and no E3s or committees are active [via: InterfoldGovCore] - Can interact with VotingEscrowGovCore - change cooldowns and exit fees and upgrade the voting-escrow exit queue [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin settings [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin target execution configuration [via: InterfoldGovCore → VotingEscrowGovCore] - change transfer whitelist settings and upgrade the voting-lock NFT [via: InterfoldGovCore → VotingEscrowGovCore] - change voting epochs and upgrade the voting-escrow Clock [via: InterfoldGovCore → VotingEscrowGovCore] - change voting-power curve parameters and upgrade the Curve implementation [via: InterfoldGovCore → VotingEscrowGovCore] - complete queued voting-escrow withdrawals [via: InterfoldGovCore → VotingEscrowGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - manage gauge metadata and the voting-power update hook [via: InterfoldGovCore → VotingEscrowGovCore] - pause and unpause voting-escrow operations [via: InterfoldGovCore → VotingEscrowGovCore] - pause the escrow voting-power adapter, manage delegation settings and upgrade its implementation [via: InterfoldGovCore → VotingEscrowGovCore] - replace voting-power dependencies, change minimum deposits and split rules, and upgrade VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - sweep unaccounted tokens and NFTs from VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - update delegated voting power through the escrow voting adapter [via: InterfoldGovCore → VotingEscrowGovCore] - Can interact with InterfoldTicketToken - schedule and activate a registry replacement after one day when all ticket liabilities are zero, and rescue ERC-20s other than the underlying sUSDS [via: InterfoldGovCore] - Can interact with RandomnessProvider - replace the Chainlink VRF coordinator that delivers the sortition entropy [via: InterfoldGovCore] - Can interact with CiphernodeRegistry - replace the coordinator, bonding, slashing and randomness-provider dependencies; add or remove ciphernodes; change the sortition window and randomness timeout; and update the DKG verifier and accusation-vote validity parameters. DKG-verifier replacement and risk-reducing accusation-window changes use a two-day propose/commit delay, while other changes are immediate. Randomness settings can only change while new requests are paused and no committees are outstanding [via: InterfoldGovCore] ##### InterfoldSafeB Addresses: [0x8B43b2852fc5031D01DDfCDF702973D93A2FF593](https://etherscan.io/address/0x8B43b2852fc5031D01DDfCDF702973D93A2FF593) A Multisig with 3/5 threshold. - Can upgrade **with no delay** - BondingRegistry [via: InterfoldGovCore → ProxyAdmin] - E3RefundManager [via: InterfoldGovCore → ProxyAdmin] - Interfold [via: InterfoldGovCore → ProxyAdmin] - InterfoldGovCore [via: InterfoldGovCore] - VotingEscrowGovCore [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - CiphernodeRegistry [via: InterfoldGovCore → ProxyAdmin] - Can interact with BondingRegistry - replace collateral assets and protocol dependencies; change bond, ticket, eligibility and exit parameters; set the committee-admission cooldown or pause admissions to future committees; authorize slashing managers and reward distributors; clear bans from old managers; withdraw slashed funds; and replace the slashed-funds treasury [via: InterfoldGovCore] - Can interact with E3RefundManager - change the work-allocation split, coordinator and treasury without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application OpenVM receipt verifier, and with it the image ID, immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with Interfold - pause or unpause new requests; replace the registry, bonding, slashing, refund and node-release dependencies; allow fee assets and E3 programs; replace proof verifiers; and change pricing (including the flat randomness fee), timeouts, parameter sets and committee thresholds without an onchain delay [via: InterfoldGovCore] - Can interact with CRISPProgramV2 - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with InterfoldGovCore - change multisig plugin target execution configuration [via: InterfoldGovCore] - change support, participation, duration, proposer-power and minimum-approval requirements for future votes [via: InterfoldGovCore] - change the settings of the CRISP token-voting plugin used as the IPP voting stage, including the committee size of future votes [via: InterfoldGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore] - redirect calls made by the Admin plugin to another executor or target [via: InterfoldGovCore] - redirect passed CRISP vote actions to another executor or target [via: InterfoldGovCore] - redirect passed Interfold Protocol Proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed proposal actions to another executor or target [via: InterfoldGovCore] - redirect passed vote actions to another executor or target [via: InterfoldGovCore] - replace the address trusted to append the effective caller to IPP proposal transactions [via: InterfoldGovCore] - replace the address trusted to append the effective caller to proposal transactions [via: InterfoldGovCore] - replace the rules that gate creation of Interfold Protocol Proposals [via: InterfoldGovCore] - replace the rules that gate public creation of staged proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future Interfold Protocol Proposals [via: InterfoldGovCore] - replace the stages, bodies, thresholds and timing rules for future public proposals [via: InterfoldGovCore] - Can interact with SlashingManager - create or disable slash policies, grant or revoke evidence slashers, resolve appeals, close E3 assignments and propose, confirm or remove operator bans [via: InterfoldGovCore] - replace the coordinator, bonding registry, ciphernode registry and refund manager, and grant or revoke governance membership. A transfer of the default-admin role itself has the configured delay [via: InterfoldGovCore] - Can interact with CRISPProgram - set census roots and replace the application RISC Zero verifier or guest image ID immediately. Such replacement cannot change the verifier snapshotted by Interfold, but can make an in-flight round fail [via: InterfoldGovCore] - Can interact with NodeReleaseRegistry - raise the required ciphernode protocol version and node generation, which instantly invalidates every operator's cached eligibility until they attest the new release. The requirement can only increase, and only while new E3 requests are paused and no E3s or committees are active [via: InterfoldGovCore] - Can interact with VotingEscrowGovCore - change cooldowns and exit fees and upgrade the voting-escrow exit queue [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin settings [via: InterfoldGovCore → VotingEscrowGovCore] - change multisig plugin target execution configuration [via: InterfoldGovCore → VotingEscrowGovCore] - change transfer whitelist settings and upgrade the voting-lock NFT [via: InterfoldGovCore → VotingEscrowGovCore] - change voting epochs and upgrade the voting-escrow Clock [via: InterfoldGovCore → VotingEscrowGovCore] - change voting-power curve parameters and upgrade the Curve implementation [via: InterfoldGovCore → VotingEscrowGovCore] - complete queued voting-escrow withdrawals [via: InterfoldGovCore → VotingEscrowGovCore] - grant and revoke permissions in this contract [via: InterfoldGovCore → VotingEscrowGovCore - or InterfoldGovCore → VotingEscrowGovCore] - manage gauge metadata and the voting-power update hook [via: InterfoldGovCore → VotingEscrowGovCore] - pause and unpause voting-escrow operations [via: InterfoldGovCore → VotingEscrowGovCore] - pause the escrow voting-power adapter, manage delegation settings and upgrade its implementation [via: InterfoldGovCore → VotingEscrowGovCore] - replace voting-power dependencies, change minimum deposits and split rules, and upgrade VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - sweep unaccounted tokens and NFTs from VotingEscrow [via: InterfoldGovCore → VotingEscrowGovCore] - update delegated voting power through the escrow voting adapter [via: InterfoldGovCore → VotingEscrowGovCore] - Can interact with InterfoldTicketToken - schedule and activate a registry replacement after one day when all ticket liabilities are zero, and rescue ERC-20s other than the underlying sUSDS [via: InterfoldGovCore] - Can interact with RandomnessProvider - replace the Chainlink VRF coordinator that delivers the sortition entropy [via: InterfoldGovCore] - Can interact with CiphernodeRegistry - replace the coordinator, bonding, slashing and randomness-provider dependencies; add or remove ciphernodes; change the sortition window and randomness timeout; and update the DKG verifier and accusation-vote validity parameters. DKG-verifier replacement and risk-reducing accusation-window changes use a two-day propose/commit delay, while other changes are immediate. Randomness settings can only change while new requests are paused and no committees are outstanding [via: InterfoldGovCore] Participants (5): [0xCb83ef506989534463a0E3F6E5526a8FE26897B3](https://etherscan.io/address/0xCb83ef506989534463a0E3F6E5526a8FE26897B3), [0xA8C3c4B6aE7f31193057A6d8833980853Ef71f85](https://etherscan.io/address/0xA8C3c4B6aE7f31193057A6d8833980853Ef71f85), [0xC3F8EBC47A4C47D91b643a4C64d34eA7B2584260](https://etherscan.io/address/0xC3F8EBC47A4C47D91b643a4C64d34eA7B2584260), [0x26f8034baBfbcA2233350a0Dca1CCcE3d01Fa41F](https://etherscan.io/address/0x26f8034baBfbcA2233350a0Dca1CCcE3d01Fa41F), [0x7b4273f9291aEAC9ea85f44093Aca5fC873A7Cf5](https://etherscan.io/address/0x7b4273f9291aEAC9ea85f44093Aca5fC873A7Cf5) ##### BondingRegistry Addresses: [0x0ec90465095C21830BEcED07e032809A2Bd2915F](https://etherscan.io/address/0x0ec90465095C21830BEcED07e032809A2Bd2915F) Collateral registry for ciphernode operators. Operators become eligible by depositing ticket collateral backed by sUSDS and a FOLD bond, and by attesting a current software release in the NodeReleaseRegistry; the contract also enforces exits, committee obligations, bans and slashing debits. It checkpoints bond ownership so that committee sortition admits at most one operator key per bond owner, and applies an owner-set admission policy (cooldown and pause) to future committees. - Can interact with InterfoldTicketToken - deposit and withdraw underlying sUSDS, mint and burn ticket tokens, and pay out underlying reserved by ticket slashing - Can interact with CiphernodeRegistry - add and remove ciphernode operator keys as collateral positions are registered and exited - Can interact with BondedCheckpoints - write bonded-FOLD voting-power checkpoints ##### Interfold Addresses: [0x28cF63B459e6218C69EA97ea7D90541cf648c715](https://etherscan.io/address/0x28cF63B459e6218C69EA97ea7D90541cf648c715) Coordinator for Encrypted Execution Environments (E3s). It accepts requests for allowlisted programs, selects a ciphernode committee, snapshots the configured proof system, and verifies the encrypted result and threshold decryption before publishing plaintext output. - Can interact with BondingRegistry - deposit and credit ticket collateral for an operator - Can interact with E3RefundManager - snapshot E3 refund policy and credit protocol payments - Can interact with CiphernodeRegistry - request and release E3 committees ##### SlashingManager Addresses: [0x753109Ee36Dc65cC178875AddA30C6433e5bEEe4](https://etherscan.io/address/0x753109Ee36Dc65cC178875AddA30C6433e5bEEe4) Policy and evidence router for ciphernode penalties, appeals and bans. Slashing is effective only for reasons with an enabled policy and through a manager authorized by the BondingRegistry. - Can interact with BondingRegistry - slash operator ticket collateral and FOLD bonds, ban operators and manage slash-routing state - Can interact with CiphernodeRegistry - expel selected members from active committees ##### E3RefundManager Addresses: [0x1940eF168f4E0B3dA24BEca539856684793B0F6e](https://etherscan.io/address/0x1940eF168f4E0B3dA24BEca539856684793B0F6e) Upgradeable accounting contract that snapshots the refund policy for each E3 and distributes request fees and routed slashed funds between the requester, honest committee members, protocol treasury and reserve. - Can interact with BondingRegistry - deposit and credit ticket collateral for an operator ##### RandomnessProvider Addresses: [0xC60919F8Bd128B76E11F4B071C8c38e1391a3e00](https://etherscan.io/address/0xC60919F8Bd128B76E11F4B071C8c38e1391a3e00) Supplies committee-sortition entropy as a Chainlink VRF v2.5 subscription consumer. Only its fixed requester (the CiphernodeRegistry) can request randomness, each E3 can be served exactly once, and requests revert while the funding subscription balance is below the configured minimum. All VRF parameters are immutable. - Can interact with CiphernodeRegistry - deliver the entropy used to select ciphernode committees for each E3 ##### CrispTokenVoting Addresses: [0xf101fB197E38f6b3Ca110D619D845634CD88098c](https://etherscan.io/address/0xf101fB197E38f6b3Ca110D619D845634CD88098c) Upgradeable Aragon voting plugin from the interfold-crisp plugin repo. Votes are cast as encrypted CRISP ballots and tallied through an Interfold E3, so individual votes stay confidential to the ciphernode committee threshold. Used as the token-holder voting stage of the Interfold Protocol Proposal path. - Can interact with InterfoldGovCore - change multisig plugin target execution configuration ##### PublicTokenVoting Addresses: [0xfb4e1e518E5F7F8903233e639662110F31Db0BDC](https://etherscan.io/address/0xfb4e1e518E5F7F8903233e639662110F31Db0BDC) Upgradeable Aragon majority-voting plugin used as the voting body in Interfold's public staged proposal path. Voting power comes from the immutable BondedVotes adapter. - Can interact with InterfoldGovCore - change multisig plugin target execution configuration ##### VotingEscrowMultisig Addresses: [0xDE2C723Ada1363575c716aFB9477A777B2a2bd7C](https://etherscan.io/address/0xDE2C723Ada1363575c716aFB9477A777B2a2bd7C) A Multisig with 1/1 threshold. Aragon multisig plugin for creating proposals and collecting approvals against a configurable threshold. Participants (1): [0x455e3DEFBC6b48D9127CF6acC609F5cEa87cA759](https://l2beat.com/privacy/projects/interfold-crisp#EOA-1) (EOA 1) ##### EOA 1 Addresses: [0x455e3DEFBC6b48D9127CF6acC609F5cEa87cA759](https://etherscan.io/address/0x455e3DEFBC6b48D9127CF6acC609F5cEa87cA759) Member of VotingEscrowMultisig. - Can upgrade **with no delay** - VotingEscrowGovCore [via: VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore] - Can interact with VotingEscrowGovCore - change cooldowns and exit fees and upgrade the voting-escrow exit queue [via: VotingEscrowMultisig → VotingEscrowGovCore] - change multisig plugin settings [via: VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig] - change multisig plugin target execution configuration [via: VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig] - change transfer whitelist settings and upgrade the voting-lock NFT [via: VotingEscrowMultisig → VotingEscrowGovCore] - change voting epochs and upgrade the voting-escrow Clock [via: VotingEscrowMultisig → VotingEscrowGovCore] - change voting-power curve parameters and upgrade the Curve implementation [via: VotingEscrowMultisig → VotingEscrowGovCore] - complete queued voting-escrow withdrawals [via: VotingEscrowMultisig → VotingEscrowGovCore] - grant and revoke permissions in this contract [via: VotingEscrowMultisig → VotingEscrowGovCore - or VotingEscrowMultisig → VotingEscrowGovCore] - manage gauge metadata and the voting-power update hook [via: VotingEscrowMultisig → VotingEscrowGovCore] - pause and unpause voting-escrow operations [via: VotingEscrowMultisig → VotingEscrowGovCore] - pause the escrow voting-power adapter, manage delegation settings and upgrade its implementation [via: VotingEscrowMultisig → VotingEscrowGovCore] - replace voting-power dependencies, change minimum deposits and split rules, and upgrade VotingEscrow [via: VotingEscrowMultisig → VotingEscrowGovCore] - sweep unaccounted tokens and NFTs from VotingEscrow [via: VotingEscrowMultisig → VotingEscrowGovCore] - update delegated voting power through the escrow voting adapter [via: VotingEscrowMultisig → VotingEscrowGovCore] ##### EOA 2 Addresses: [0x34655732dB9BBfA627021D18d786EfF7Bde211F7](https://etherscan.io/address/0x34655732dB9BBfA627021D18d786EfF7Bde211F7) - Can interact with CRISPProgram - attest that ballot inputs are available so a CRISP round can proceed - Can interact with CRISPProgramV2 - attest that ballot inputs are available so a CRISP round can proceed ##### 45 EOAs Addresses: [0x0a3E22cb9778A10b188eC2BF149D628ab91A76a9](https://etherscan.io/address/0x0a3E22cb9778A10b188eC2BF149D628ab91A76a9) (EOA 3), [0x12c75ce176D5a58d2a72e85Af158Cbd8749fE1D8](https://etherscan.io/address/0x12c75ce176D5a58d2a72e85Af158Cbd8749fE1D8) (EOA 4), [0x15de07b6280ae5F5D37F6d77dF88c37875ef2877](https://etherscan.io/address/0x15de07b6280ae5F5D37F6d77dF88c37875ef2877) (EOA 5), [0x18ddBf8Aa6F72FC4D9E1911527d0CE1E9f3597d8](https://etherscan.io/address/0x18ddBf8Aa6F72FC4D9E1911527d0CE1E9f3597d8) (EOA 6), [0x18F98f8F44a37d4179888f286191f4F856CB4663](https://etherscan.io/address/0x18F98f8F44a37d4179888f286191f4F856CB4663) (EOA 7), [0x1d4205bc727E4f3799B25d0FEAe8e45d365858b1](https://etherscan.io/address/0x1d4205bc727E4f3799B25d0FEAe8e45d365858b1) (EOA 8), [0x1dF428833f2C9FB1eF098754e5D710432450d706](https://etherscan.io/address/0x1dF428833f2C9FB1eF098754e5D710432450d706) (EOA 9), [0x1fD2b3d4a9f4Aeb62877cab9dF70A5a6e976b118](https://etherscan.io/address/0x1fD2b3d4a9f4Aeb62877cab9dF70A5a6e976b118) (EOA 10), [0x222D696D0242194457eD491b0c52aBbF9250342F](https://etherscan.io/address/0x222D696D0242194457eD491b0c52aBbF9250342F) (EOA 11), [0x252a6c33C87C0b439671b983C3f730D2C46a5F1d](https://etherscan.io/address/0x252a6c33C87C0b439671b983C3f730D2C46a5F1d) (EOA 12), [0x291bD021638B9aef86c6d47e29CdA1cF3804bafb](https://etherscan.io/address/0x291bD021638B9aef86c6d47e29CdA1cF3804bafb) (EOA 13), [0x29a540E858500fd6ee2B68EE63769b0bB0A05CF4](https://etherscan.io/address/0x29a540E858500fd6ee2B68EE63769b0bB0A05CF4) (EOA 14), [0x3b62d921EFdbc295B017fAb9Ba8a521457F037d3](https://etherscan.io/address/0x3b62d921EFdbc295B017fAb9Ba8a521457F037d3) (EOA 15), [0x3Dedb602A8997B89685803Dff207566C9883FE0F](https://etherscan.io/address/0x3Dedb602A8997B89685803Dff207566C9883FE0F) (EOA 16), [0x516C12B6D622A62166bDe3580628d6d23ae5b310](https://etherscan.io/address/0x516C12B6D622A62166bDe3580628d6d23ae5b310) (EOA 17), [0x59461947EC279863138fae477C35B0c551A5c3a6](https://etherscan.io/address/0x59461947EC279863138fae477C35B0c551A5c3a6) (EOA 18), [0x5Fb0854aB8fb2810b80d3DE276b3107a9e5281b1](https://etherscan.io/address/0x5Fb0854aB8fb2810b80d3DE276b3107a9e5281b1) (EOA 19), [0x60cd23981430e4909957EA1fB214E9A21468175A](https://etherscan.io/address/0x60cd23981430e4909957EA1fB214E9A21468175A) (EOA 20), [0x630B9c418aCb02829E34F2E0B7948b4A9c92e05F](https://etherscan.io/address/0x630B9c418aCb02829E34F2E0B7948b4A9c92e05F) (EOA 21), [0x73F8511492fE99B1d3b230B1015e22db53DaA9a1](https://etherscan.io/address/0x73F8511492fE99B1d3b230B1015e22db53DaA9a1) (EOA 22), [0x856F8E59dEd8386C57f48a55b007F21F89724CFC](https://etherscan.io/address/0x856F8E59dEd8386C57f48a55b007F21F89724CFC) (EOA 23), [0x86Ab0b3C4A36cAB3037d750C850D660cE710e2a1](https://etherscan.io/address/0x86Ab0b3C4A36cAB3037d750C850D660cE710e2a1) (EOA 24), [0x88ED57A03E98931a81dBa7A9Bc2dc95B48929E45](https://etherscan.io/address/0x88ED57A03E98931a81dBa7A9Bc2dc95B48929E45) (EOA 25), [0x980AaA907E51a4e3cc89b8FF8e37Aa0D55D46597](https://etherscan.io/address/0x980AaA907E51a4e3cc89b8FF8e37Aa0D55D46597) (EOA 26), [0x9E2558B76c7D7CF169556A1a729C2CB0324f0E61](https://etherscan.io/address/0x9E2558B76c7D7CF169556A1a729C2CB0324f0E61) (EOA 27), [0x9EC16384b956D7B2A71284711FD32d156e6b33c6](https://etherscan.io/address/0x9EC16384b956D7B2A71284711FD32d156e6b33c6) (EOA 28), [0xA2bA6A63335cdB2789b0e636987Ce12C3D44662a](https://etherscan.io/address/0xA2bA6A63335cdB2789b0e636987Ce12C3D44662a) (EOA 29), [0xA303d8Cb0CE470F772A459b4a87AcB11b2978DB8](https://etherscan.io/address/0xA303d8Cb0CE470F772A459b4a87AcB11b2978DB8) (EOA 30), [0xAF062fC363c3AE910ec76676346f798792bEB851](https://etherscan.io/address/0xAF062fC363c3AE910ec76676346f798792bEB851) (EOA 31), [0xB6Bb517ca0bD9a8b0eD2817e604b327d31626190](https://etherscan.io/address/0xB6Bb517ca0bD9a8b0eD2817e604b327d31626190) (EOA 32), [0xb8d9Bf1b6C283D29dC3dC5711C9036F6896a963A](https://etherscan.io/address/0xb8d9Bf1b6C283D29dC3dC5711C9036F6896a963A) (EOA 33), [0xba7254CC6c70AE1D99aEa3ecA705E81635aaA988](https://etherscan.io/address/0xba7254CC6c70AE1D99aEa3ecA705E81635aaA988) (EOA 34), [0xBB3f49DED0EdE92ba3C9247A93E925770ac68671](https://etherscan.io/address/0xBB3f49DED0EdE92ba3C9247A93E925770ac68671) (EOA 35), [0xc6E48712E56F6E9548c54a0A983eBe992eFA26Bd](https://etherscan.io/address/0xc6E48712E56F6E9548c54a0A983eBe992eFA26Bd) (EOA 36), [0xc798b5f60150FbB2Db9b061817831DF62D2b269C](https://etherscan.io/address/0xc798b5f60150FbB2Db9b061817831DF62D2b269C) (EOA 37), [0xcb6ce8C3a16DeF797167e8A2aED7998A065f2513](https://etherscan.io/address/0xcb6ce8C3a16DeF797167e8A2aED7998A065f2513) (EOA 38), [0xCdc8B4379dDF736f8e34B0A65585E07dE7060A84](https://etherscan.io/address/0xCdc8B4379dDF736f8e34B0A65585E07dE7060A84) (EOA 39), [0xd2b46ceC7b4d8046eF2D7bCb32aF3220Ef7bc1dd](https://etherscan.io/address/0xd2b46ceC7b4d8046eF2D7bCb32aF3220Ef7bc1dd) (EOA 40), [0xd333232f08d6a8A4f7Cee8327476DbeDDDF20554](https://etherscan.io/address/0xd333232f08d6a8A4f7Cee8327476DbeDDDF20554) (EOA 41), [0xd3336047DCf4d7C7393b3BF5Fa47A31478C22d47](https://etherscan.io/address/0xd3336047DCf4d7C7393b3BF5Fa47A31478C22d47) (EOA 42), [0xd698bC33a4A98a019881c6e2664f1dAc62c4B3B5](https://etherscan.io/address/0xd698bC33a4A98a019881c6e2664f1dAc62c4B3B5) (EOA 43), [0xD81f88b9Ae6261d684f8BfEb6a642692213dAe86](https://etherscan.io/address/0xD81f88b9Ae6261d684f8BfEb6a642692213dAe86) (EOA 44), [0xDb78ebaB8597AF977B686E540DCe734E613Eba88](https://etherscan.io/address/0xDb78ebaB8597AF977B686E540DCe734E613Eba88) (EOA 45), [0xdBEd503093A01EA08f21144114542E53594536D6](https://etherscan.io/address/0xdBEd503093A01EA08f21144114542E53594536D6) (EOA 46), [0xe603c63ee0e97DA5a833B7498C366E88B9a5EBFe](https://etherscan.io/address/0xe603c63ee0e97DA5a833B7498C366E88B9a5EBFe) (EOA 47) - Can interact with CiphernodeRegistry - be selected by ticket-weighted sortition into E3 committees, whose members create key shares and threshold-decrypt E3 outputs. Enough colluding members of one committee can decrypt every input of that E3 ## Smart contracts Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/interfold ### Ethereum #### DkgAggregatorVerifier (3 instances) Addresses: [0x0a4D70bBD4e71b9e515Efc417F423c64D85197cb](https://etherscan.io/address/0x0a4D70bBD4e71b9e515Efc417F423c64D85197cb#code), [0x7987EF7cd79478Ee1ed51A279eEF46D2996a793c](https://etherscan.io/address/0x7987EF7cd79478Ee1ed51A279eEF46D2996a793c#code), [0xBb643dC305794364E435C883B6DC1E7666dA4fEc](https://etherscan.io/address/0xBb643dC305794364E435C883B6DC1E7666dA4fEc#code) Immutable generated Honk verifier for the BFV distributed-key-generation aggregation circuit. #### OpenVmReceiptVerifier Addresses: [0x0dd5E45414629F0f7D757cbb0310A9cfdc5B400b](https://etherscan.io/address/0x0dd5E45414629F0f7D757cbb0310A9cfdc5B400b#code) Immutable OpenVM receipt verifier. It checks a Halo2 proof whose only public value is the journal digest, bound to one OpenVM executable and VM commitment. #### BfvDecryptionVerifier (3 instances) Addresses: [0x194A489c918b74F11C6b03e12Ea26F198110f9A5](https://etherscan.io/address/0x194A489c918b74F11C6b03e12Ea26F198110f9A5#code), [0x31715a243b80484629040592Eaff619729E98B39](https://etherscan.io/address/0x31715a243b80484629040592Eaff619729E98B39#code), [0x43c65d641A693962c942407A2834A7d923cEE1d8](https://etherscan.io/address/0x43c65d641A693962c942407A2834A7d923cEE1d8#code) Threshold-decryption proof wrapper. It checks the generated circuit proof and binds its parties and public-key context to the committee recorded by CiphernodeRegistry. #### CRISPProgram (0x1EA4…Ee28) Addresses: [0x1EA4dBdec0F2F1E9235915847fc59EF4045EEe28](https://etherscan.io/address/0x1EA4dBdec0F2F1E9235915847fc59EF4045EEe28#code) CRISP encrypted-ballot E3 application. It verifies ballot eligibility and encryption proofs, commits ciphertext inputs, checks that an OpenVM tally proof is bound to its input root and parameters, and decodes the threshold-decrypted tally. - Roles: - **inputAvailabilitySigner**: EOA 2 - **owner**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor #### BfvPkVerifierRouter Addresses: [0x3E9614e711ee301DAC3FeF7D86031ED015bc406b](https://etherscan.io/address/0x3E9614e711ee301DAC3FeF7D86031ED015bc406b#code) Immutable router for BFV distributed-key-generation proofs. It forwards each proof to the per-committee-size BfvPkVerifier whose public-input length and circuit verification-key hashes match, so committees of every supported size share one verifier entry point. #### MockE3Program Addresses: [0x4976E5E47852eFCe6851d35B95A1A2E19456F3D7](https://etherscan.io/address/0x4976E5E47852eFCe6851d35B95A1A2E19456F3D7#code) Permanently allowlisted test E3 application. It accepts arbitrary input and returns successful validation and output verification, so requests using it exercise the protocol proof pipeline without application-level correctness checks. #### CRISPProgramV2 Addresses: [0x53FCdb21E73A461CfE6c64B19855204384B91BA3](https://etherscan.io/address/0x53FCdb21E73A461CfE6c64B19855204384B91BA3#code) CRISP encrypted-ballot E3 application. It verifies ballot eligibility and encryption proofs, commits ciphertext inputs, checks that a RISC Zero tally is bound to its input root and parameters, and decodes the threshold-decrypted tally. - Roles: - **inputAvailabilitySigner**: EOA 2 - **owner**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor #### BfvPkVerifier (3 instances) Addresses: [0x5b93A3D59f8D65548748fc303f75a21b082EB2f4](https://etherscan.io/address/0x5b93A3D59f8D65548748fc303f75a21b082EB2f4#code), [0x5CcE227e613A41239b7E07764ad8b5a1cCA0a2CE](https://etherscan.io/address/0x5CcE227e613A41239b7E07764ad8b5a1cCA0a2CE#code), [0x8d4c0bd5c796a5FEd7C419deA56f6A88EdB51023](https://etherscan.io/address/0x8d4c0bd5c796a5FEd7C419deA56f6A88EdB51023#code) BFV public-key proof wrapper. It binds the generated circuit verifier to the expected DKG-fold and C5 verification-key hashes. #### OpenVmBfvCiphertextVerifier Addresses: [0x6cD258E0a893612Aea41c42dC47450ac1A6E2dD1](https://etherscan.io/address/0x6cD258E0a893612Aea41c42dC47450ac1A6E2dD1#code) Ciphertext-output verifier for BFV E3s. It accepts an OpenVM proof for the immutable guest image ID against the E3-specific journal constructed by Interfold. #### OpenVmHalo2Verifier Addresses: [0x75cECF62f1ADe2C7b95d5a93460f450c6885F904](https://etherscan.io/address/0x75cECF62f1ADe2C7b95d5a93460f450c6885F904#code) Immutable Halo2 verifier generated by the OpenVM 2.0 SDK. It checks the final proof of an OpenVM execution against the app executable and VM commitments passed by the caller. #### DecryptionAggregatorVerifier (3 instances) Addresses: [0x769C243b712aD4D844bCbAed3981F7C24fA64Ada](https://etherscan.io/address/0x769C243b712aD4D844bCbAed3981F7C24fA64Ada#code), [0xbe012465a45179170cFb863405427f8ecAcb5C80](https://etherscan.io/address/0xbe012465a45179170cFb863405427f8ecAcb5C80#code), [0xC590b979c9BDA89f87443EBE134321272a5dD013](https://etherscan.io/address/0xC590b979c9BDA89f87443EBE134321272a5dD013#code) Immutable generated Honk verifier for the BFV threshold-decryption aggregation circuit. #### CRISPProgram (0x847A…169f) Addresses: [0x847A22303639017bcDB7F7E49EEa4a4629c1169f](https://etherscan.io/address/0x847A22303639017bcDB7F7E49EEa4a4629c1169f#code) CRISP encrypted-ballot E3 application. It verifies ballot eligibility and encryption proofs, commits ciphertext inputs, checks that a RISC Zero tally is bound to its input root and parameters, and decodes the threshold-decrypted tally. - Roles: - **owner**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor #### AvailVectorXDataAvailabilityVerifier (2 instances) Addresses: [0x9B5088112Ae1D682782236486290120E27Eb32e3](https://etherscan.io/address/0x9B5088112Ae1D682782236486290120E27Eb32e3#code), [0xC038C7ba5717bDa886115e5d954085bce069069E](https://etherscan.io/address/0xC038C7ba5717bDa886115e5d954085bce069069E#code) Immutable verifier of Avail blob inclusion used by the CRISP program to attest that encrypted ballot inputs were published. It checks inclusion proofs against the Avail bridge and VectorX light-client contracts fixed at deployment. #### NodeReleaseRegistry Addresses: [0x9E1C6B433CFbC8f28d80EAB583C428B01d083b0A](https://etherscan.io/address/0x9E1C6B433CFbC8f28d80EAB583C428B01d083b0A#code) Registry of ciphernode software releases. Operators self-attest the release they run; staying eligible for new E3 committees requires an attestation matching the exact governance-set protocol version and at least the required node generation. Raising the requirement instantly invalidates every operator's cached eligibility until they re-attest. - Roles: - **owner**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor #### BfvDecryptionVerifierRouter Addresses: [0xbbFF7101A3Be43e06b64B00e2e656529E6aDf2eE](https://etherscan.io/address/0xbbFF7101A3Be43e06b64B00e2e656529E6aDf2eE#code) Immutable router for BFV threshold-decryption proofs. It forwards each proof to the per-committee-size BfvDecryptionVerifier whose public-input length and circuit verification-key hashes match, so committees of every supported size share one verifier entry point. #### InterfoldTicketToken Addresses: [0xC0B5b49a3949eC4B520eF21BaCFE16e3695F3B5D](https://etherscan.io/address/0xC0B5b49a3949eC4B520eF21BaCFE16e3695F3B5D#code) Non-transferable ERC-20 Votes wrapper for sUSDS used as ciphernode ticket collateral. Only the configured BondingRegistry can deposit, mint, burn, withdraw or pay out the underlying asset. - Roles: - **owner**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **registry**: BondingRegistry #### CiphernodeRegistry Addresses: [0xC927A5B2d8F68697bC28C0670df05178c93df2d7](https://etherscan.io/address/0xC927A5B2d8F68697bC28C0670df05178c93df2d7#code), [0x8354E51d14C118f6386C3F6F73E79190D71FFA3A](https://etherscan.io/address/0x8354E51d14C118f6386C3F6F73E79190D71FFA3A#code) (Implementation (Upgradable)), [0x2DFb93A8C3cE68Be3d8129479d7870646d89aDa7](https://etherscan.io/address/0x2DFb93A8C3cE68Be3d8129479d7870646d89aDa7#code) (Admin) **Past upgrades** (Count of upgrades: 3, Last upgrade: 29d 16h ago, Avg upgrade interval: 16d 14h) - 2026-09-24 18:43 UTC, upgrade of [CiphernodeRegistry](https://etherscan.io/address/0xC927A5B2d8F68697bC28C0670df05178c93df2d7#code): transaction [0x8e6d53a9137ad0cb441aef11b4752abfa936258661668d1b2692bf6c2678b4a2](https://etherscan.io/tx/0x8e6d53a9137ad0cb441aef11b4752abfa936258661668d1b2692bf6c2678b4a2), implementations: [0x8354E51d14C118f6386C3F6F73E79190D71FFA3A](https://etherscan.io/address/0x8354E51d14C118f6386C3F6F73E79190D71FFA3A#code) ([diff](https://disco.l2beat.com/diff/eth:0xD9A3224D829a4ac8b55A75C539fD447AC4B05Bf2/eth:0x8354E51d14C118f6386C3F6F73E79190D71FFA3A)) - 2026-09-18 13:15 UTC, upgrade of [CiphernodeRegistry](https://etherscan.io/address/0xC927A5B2d8F68697bC28C0670df05178c93df2d7#code): transaction [0x975b5104729480bdf914304ce81726041e27450580fab4cd2f2750b7f0848047](https://etherscan.io/tx/0x975b5104729480bdf914304ce81726041e27450580fab4cd2f2750b7f0848047), implementations: [0xD9A3224D829a4ac8b55A75C539fD447AC4B05Bf2](https://etherscan.io/address/0xD9A3224D829a4ac8b55A75C539fD447AC4B05Bf2#code) ([diff](https://disco.l2beat.com/diff/eth:0xFff476751949a7e1B784b5c88648833c1e8dD69c/eth:0xD9A3224D829a4ac8b55A75C539fD447AC4B05Bf2)) - 2026-08-28 00:23 UTC, upgrade of [CiphernodeRegistry](https://etherscan.io/address/0xC927A5B2d8F68697bC28C0670df05178c93df2d7#code): transaction [0xb72b8bc214a3416a90f0d84cf34dc833251a669b1e0201f70924805f7fa18b58](https://etherscan.io/tx/0xb72b8bc214a3416a90f0d84cf34dc833251a669b1e0201f70924805f7fa18b58), implementations: [0xFff476751949a7e1B784b5c88648833c1e8dD69c](https://etherscan.io/address/0xFff476751949a7e1B784b5c88648833c1e8dD69c#code) ([diff](https://disco.l2beat.com/diff/eth:0xB06Aaf9EF87984192490E947078D2f3563399b7B/eth:0xFff476751949a7e1B784b5c88648833c1e8dD69c)) - 2026-08-19 03:10 UTC, deployment of [CiphernodeRegistry](https://etherscan.io/address/0xC927A5B2d8F68697bC28C0670df05178c93df2d7#code): transaction [0xc17b85549e721c943dd5667c8ad8a3857c7897b9cc0add6e834539bdd4e7d0d6](https://etherscan.io/tx/0xc17b85549e721c943dd5667c8ad8a3857c7897b9cc0add6e834539bdd4e7d0d6), implementations: [0xB06Aaf9EF87984192490E947078D2f3563399b7B](https://etherscan.io/address/0xB06Aaf9EF87984192490E947078D2f3563399b7B#code) Registry of ciphernodes and E3 committees. It performs ticket-weighted committee selection (admitting at most one operator key per bond owner, and only when the BondingRegistry counts at least as many distinct active bond owners as the committee size), records DKG (distributed key generation) proof anchors and the committee public key (to which cyphertexts can be encrypted), and tracks committee viability. Sortition entropy is supplied asynchronously by a governance-set randomness provider. - Roles: - **admin**: ProxyAdmin; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **bondingRegistry**: BondingRegistry - **interfold**: Interfold - **owner**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **randomnessProvider**: RandomnessProvider - **registeredCiphernodes**: EOA 10, EOA 11, EOA 12, EOA 13, EOA 14, EOA 15, EOA 16, EOA 17, EOA 18, EOA 19, EOA 20, EOA 21, EOA 22, EOA 23, EOA 24, EOA 25, EOA 26, EOA 27, EOA 28, EOA 29, EOA 3, EOA 30, EOA 31, EOA 32, EOA 33, EOA 34, EOA 35, EOA 36, EOA 37, EOA 38, EOA 39, EOA 4, EOA 40, EOA 41, EOA 42, EOA 43, EOA 44, EOA 45, EOA 46, EOA 47, EOA 5, EOA 6, EOA 7, EOA 8, EOA 9 - **slashingManager**: SlashingManager Can be upgraded by: InterfoldSafeA with no delay, InterfoldSafeB with no delay, PublicStagedProposalProcessor with no delay, ProtocolProposalProcessor with no delay, AdminPlugin with no delay #### BondedCheckpoints Addresses: [0xDbCaeec5B040A134314FfD43aA2ca0D16006f963](https://etherscan.io/address/0xDbCaeec5B040A134314FfD43aA2ca0D16006f963#code) Voting-power checkpoint store updated exclusively by the BondingRegistry so FOLD bonded to ciphernode operators remains visible to governance snapshots. - Roles: - **registry**: BondingRegistry #### FOLD Addresses: [0xE172e9B6cfBeeB5593bDcE3f077356FDb33af904](https://etherscan.io/address/0xE172e9B6cfBeeB5593bDcE3f077356FDb33af904#code) Fixed-cap FOLD governance and ciphernode-bond token. Minting and pre-TGE transfer controls are disabled after the one-way TGE transition, while lock-policy administration can continue until the immutable lock cutoff. - Roles: - **defaultAdmins**: InterfoldSafeA - **lockManagers**: InterfoldSafeA #### DkgFoldAttestationVerifier Addresses: [0xE5657c0756B772B600D6c73eDbF046f32129c770](https://etherscan.io/address/0xE5657c0756B772B600D6c73eDbF046f32129c770#code) Immutable verifier for EIP-712 attestations that bind selected ciphernode operator keys to the party commitments folded into an E3 distributed-key-generation proof. #### BondedVotes (2 instances) Addresses: [0x028deEA644258c78b1B5B2eacF469F5D781Fb43E](https://etherscan.io/address/0x028deEA644258c78b1B5B2eacF469F5D781Fb43E#code), [0x6Cd2976AD3d908E503c6D93A5E010392E25DcFB6](https://etherscan.io/address/0x6Cd2976AD3d908E503c6D93A5E010392E25DcFB6#code) Voting-power adapter used by PublicTokenVoting. It counts voting-escrow power, FOLD bonded to ciphernode operators, and eligible vesting-locked wallet FOLD while using FOLD total supply as the quorum denominator. #### VotingEscrowGaugeVoter Addresses: [0x0A32454FC578e3CAFeE86F6E03f267b25ad0bAf0](https://etherscan.io/address/0x0A32454FC578e3CAFeE86F6E03f267b25ad0bAf0#code), [0x41d565fcC636805E3addDa99714067cB020F09Aa](https://etherscan.io/address/0x41d565fcC636805E3addDa99714067cB020F09Aa#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingEscrowGaugeVoter](https://etherscan.io/address/0x0A32454FC578e3CAFeE86F6E03f267b25ad0bAf0#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0x41d565fcC636805E3addDa99714067cB020F09Aa](https://etherscan.io/address/0x41d565fcC636805E3addDa99714067cB020F09Aa#code) Upgradeable, currently paused gauge-voting plugin connected to VotingEscrow. It can update voting state used by escrow lock operations but is not the Interfold governance proposal-voting plugin. #### ProtocolProposalCondition Addresses: [0x4c9D0A2B8E5917c480bdF3E42F1b1c9365EF2115](https://etherscan.io/address/0x4c9D0A2B8E5917c480bdF3E42F1b1c9365EF2115#code), [0xE437E5c7EeB0D49F97CfD040fb8a02A60a61c0f0](https://etherscan.io/address/0xE437E5c7EeB0D49F97CfD040fb8a02A60a61c0f0#code) (Implementation (Upgradable)) Aragon condition attached to the public CREATE_PROPOSAL permission. Its mutable rule program determines which callers and proposal calls qualify for the otherwise-public grant. #### AragonExecutor Addresses: [0x56ce4D8006292Abf418291FaE813C1E3769240A4](https://etherscan.io/address/0x56ce4D8006292Abf418291FaE813C1E3769240A4#code) Immutable Aragon action executor used as a delegatecall target by PublicTokenVoting. It executes proposal action batches in the calling plugin's context. #### InterfoldGovCore Addresses: [0x652a31c669f9AB37f6040f279139a75D04F2679e](https://etherscan.io/address/0x652a31c669f9AB37f6040f279139a75D04F2679e#code), [0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29](https://etherscan.io/address/0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-17 01:52 UTC, deployment of [InterfoldGovCore](https://etherscan.io/address/0x652a31c669f9AB37f6040f279139a75D04F2679e#code): transaction [0x462d1f6a604859fe289698f04dac0bce77cb22bfad707580e5f2ea333a948a82](https://etherscan.io/tx/0x462d1f6a604859fe289698f04dac0bce77cb22bfad707580e5f2ea333a948a82), implementations: [0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29](https://etherscan.io/address/0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29#code) Aragon governance contract that stores permissions and executes action batches for whoever holds its execute permission. - Roles: - **adminPluginExecutors**: InterfoldSafeA, InterfoldSafeB - **adminTargetManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **conditionRuleManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **crispVotingProposalCreators**: ProtocolProposalProcessor - **crispVotingSettingsManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **crispVotingTargetManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **daoExecutors**: AdminPlugin, ProtocolProposalProcessor, PublicStagedProposalProcessor - **daoRootHolders**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **daoUpgraders**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **ippConditionRuleManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **ippStageManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **ippTargetManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **ippTrustedForwarderManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **multisigTargetConfigAdmins**: AdminPlugin, CrispTokenVoting, InterfoldGovCore, ProtocolProposalProcessor, PublicStagedProposalProcessor, PublicTokenVoting; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **sppStageManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **sppTargetManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **sppTrustedForwarderManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **tokenVotingProposalCreators**: PublicStagedProposalProcessor - **tokenVotingSettingsManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **tokenVotingTargetManagers**: InterfoldGovCore; ultimately AdminPlugin, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor Can be upgraded by: InterfoldSafeA with no delay, InterfoldSafeB with no delay, PublicStagedProposalProcessor with no delay, ProtocolProposalProcessor with no delay, AdminPlugin with no delay Implementation used in: [Zama Confidential Tokens](https://l2beat.com/privacy/projects/zama-confidential-tokens#ZamaDeFiGovCore) #### VotingEscrow Addresses: [0x71360F335e4Ec9c010e29bA7171bc62c9B4c1F12](https://etherscan.io/address/0x71360F335e4Ec9c010e29bA7171bc62c9B4c1F12#code), [0x201d4c1cd48F2fC1297eEa56B14A29a039164a91](https://etherscan.io/address/0x201d4c1cd48F2fC1297eEa56B14A29a039164a91#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingEscrow](https://etherscan.io/address/0x71360F335e4Ec9c010e29bA7171bc62c9B4c1F12#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0x201d4c1cd48F2fC1297eEa56B14A29a039164a91](https://etherscan.io/address/0x201d4c1cd48F2fC1297eEa56B14A29a039164a91#code) veFOLD escrow that custodies locked FOLD, issues lock NFTs and calculates the voting power consumed by BondedVotes through EscrowVotesAdapter. #### VotingEscrowExitQueue Addresses: [0x8095C0B90Be4abCBF5CA7371f588fe1637E02b7f](https://etherscan.io/address/0x8095C0B90Be4abCBF5CA7371f588fe1637E02b7f#code), [0x037c00ba58D4d2A4870017aeaD7f79A0D23A294f](https://etherscan.io/address/0x037c00ba58D4d2A4870017aeaD7f79A0D23A294f#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingEscrowExitQueue](https://etherscan.io/address/0x8095C0B90Be4abCBF5CA7371f588fe1637E02b7f#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0x037c00ba58D4d2A4870017aeaD7f79A0D23A294f](https://etherscan.io/address/0x037c00ba58D4d2A4870017aeaD7f79A0D23A294f#code) Queue applying cooldowns and optional fees to withdrawals from VotingEscrow. #### EscrowVotesAdapter Addresses: [0x8f141B4D294d39e7D1530916A3eD65B3970C6FEc](https://etherscan.io/address/0x8f141B4D294d39e7D1530916A3eD65B3970C6FEc#code), [0xB67C1ABaC78686c67b91bBd1032813D86047104B](https://etherscan.io/address/0xB67C1ABaC78686c67b91bBd1032813D86047104B#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [EscrowVotesAdapter](https://etherscan.io/address/0x8f141B4D294d39e7D1530916A3eD65B3970C6FEc#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0xB67C1ABaC78686c67b91bBd1032813D86047104B](https://etherscan.io/address/0xB67C1ABaC78686c67b91bBd1032813D86047104B#code) Upgradeable IVotes adapter that exposes voting power from veFOLD locks. BondedVotes uses it as its primary voting-power source. #### VotingEscrowGovCore Addresses: [0x9e9617418DFb9E4daD00E2D1e8f21e214901989B](https://etherscan.io/address/0x9e9617418DFb9E4daD00E2D1e8f21e214901989B#code), [0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29](https://etherscan.io/address/0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingEscrowGovCore](https://etherscan.io/address/0x9e9617418DFb9E4daD00E2D1e8f21e214901989B#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29](https://etherscan.io/address/0x58C1F7Bc62Bb63fb137bc8F6d8ea6321a0501d29#code) Aragon governance contract that stores permissions and executes action batches for whoever holds its execute permission. - Roles: - **clockAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **curveAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **daoExecutors**: InterfoldGovCore, VotingEscrowMultisig - **daoRootHolders**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **daoUpgraders**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **delegationTokenManagers**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **exitQueueAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **exitQueueWithdrawers**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **gaugeAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **gaugeUpgraders**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **lockAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **multisigSettingsAdmins**: VotingEscrowGovCore, VotingEscrowMultisig; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **multisigTargetConfigAdmins**: VotingEscrowGovCore, VotingEscrowMultisig; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **veDaoExecutors**: InterfoldGovCore, VotingEscrowMultisig - **veDaoRootHolders**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **veDaoUpgraders**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **votesAdapterAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **votingEscrowAdmins**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **votingEscrowPausers**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor - **votingEscrowSweepers**: VotingEscrowGovCore; ultimately AdminPlugin, EOA 1, InterfoldSafeA, InterfoldSafeB, ProtocolProposalProcessor, PublicStagedProposalProcessor Can be upgraded by: EOA 1 with no delay, InterfoldSafeA with no delay, InterfoldSafeB with no delay, PublicStagedProposalProcessor with no delay, ProtocolProposalProcessor with no delay, AdminPlugin with no delay Implementation used in: [Zama Confidential Tokens](https://l2beat.com/privacy/projects/zama-confidential-tokens#ZamaDeFiGovCore) #### VotingEscrowClock Addresses: [0xc9707d36C07c3E0C4215a4574DB760b4e0E79166](https://etherscan.io/address/0xc9707d36C07c3E0C4215a4574DB760b4e0E79166#code), [0xEC0162045B44C5506954E3A04dbbcdfe39f64f21](https://etherscan.io/address/0xEC0162045B44C5506954E3A04dbbcdfe39f64f21#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingEscrowClock](https://etherscan.io/address/0xc9707d36C07c3E0C4215a4574DB760b4e0E79166#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0xEC0162045B44C5506954E3A04dbbcdfe39f64f21](https://etherscan.io/address/0xEC0162045B44C5506954E3A04dbbcdfe39f64f21#code) Timestamp clock defining veFOLD epochs, checkpoint cadence and gauge-voting windows. #### PublicProposalCondition Addresses: [0xD0C2A1f94f7c584f0BF5588a519E82AD71dC1EC2](https://etherscan.io/address/0xD0C2A1f94f7c584f0BF5588a519E82AD71dC1EC2#code), [0xE437E5c7EeB0D49F97CfD040fb8a02A60a61c0f0](https://etherscan.io/address/0xE437E5c7EeB0D49F97CfD040fb8a02A60a61c0f0#code) (Implementation (Upgradable)) Aragon condition attached to the public CREATE_PROPOSAL permission. Its mutable rule program determines which callers and proposal calls qualify for the otherwise-public grant. #### VotingEscrowMemberCondition Addresses: [0xde423A95f7955CcA8848e0eDCA773F6A2FBA2d76](https://etherscan.io/address/0xde423A95f7955CcA8848e0eDCA773F6A2FBA2d76#code) Immutable Aragon condition on the voting-escrow multisig's public proposal grant. When the multisig is configured as only-listed, it restricts proposal creators to current listed members. The associated Multisig address is embedded immutably in bytecode. #### VotingPowerCurve Addresses: [0xf023390C78CF95a77A8910187d5B09BBC05F37e9](https://etherscan.io/address/0xf023390C78CF95a77A8910187d5B09BBC05F37e9#code), [0x59417A78C133a6Fddf8a3b5e751378aF8d42e249](https://etherscan.io/address/0x59417A78C133a6Fddf8a3b5e751378aF8d42e249#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingPowerCurve](https://etherscan.io/address/0xf023390C78CF95a77A8910187d5B09BBC05F37e9#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0x59417A78C133a6Fddf8a3b5e751378aF8d42e249](https://etherscan.io/address/0x59417A78C133a6Fddf8a3b5e751378aF8d42e249#code) Curve that converts veFOLD lock amount and duration into voting power. #### VotingEscrowLockNFT Addresses: [0xF3eeE0f5E721b8c0073C8d85bf26A3d6EC293A0E](https://etherscan.io/address/0xF3eeE0f5E721b8c0073C8d85bf26A3d6EC293A0E#code), [0x5F8a4394415a7630e715B8eb6F84b73c6172881a](https://etherscan.io/address/0x5F8a4394415a7630e715B8eb6F84b73c6172881a#code) (Implementation (Upgradable)), [0x0000000000000000000000000000000000000000](https://etherscan.io/address/0x0000000000000000000000000000000000000000#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-08-18 04:56 UTC, deployment of [VotingEscrowLockNFT](https://etherscan.io/address/0xF3eeE0f5E721b8c0073C8d85bf26A3d6EC293A0E#code): transaction [0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e](https://etherscan.io/tx/0xd83f0141bd15b5bdc5c5c531218d3bbe1523ae0c80ea16e3d493259017e17e6e), implementations: [0x5F8a4394415a7630e715B8eb6F84b73c6172881a](https://etherscan.io/address/0x5F8a4394415a7630e715B8eb6F84b73c6172881a#code) ERC-721 whose tokens represent individual veFOLD lock positions. #### ProxyAdmin (4 instances) Addresses: [0x2DFb93A8C3cE68Be3d8129479d7870646d89aDa7](https://etherscan.io/address/0x2DFb93A8C3cE68Be3d8129479d7870646d89aDa7#code), [0x9393573a9EF85c9A37d91E32702a340084A48b6E](https://etherscan.io/address/0x9393573a9EF85c9A37d91E32702a340084A48b6E#code), [0xB3985D7fF844FA0F5E0aaC5feb5DD8BE15e88580](https://etherscan.io/address/0xB3985D7fF844FA0F5E0aaC5feb5DD8BE15e88580#code), [0xf1511Fc32abf7Bd3a3213ddCF08C07259b53972b](https://etherscan.io/address/0xf1511Fc32abf7Bd3a3213ddCF08C07259b53972b#code) - Roles: - **owner**: InterfoldGovCore #### CrispBallotVerifier Addresses: [0x6E1eC1e74162D9c141e12B593Cad390aEfFb6bD0](https://etherscan.io/address/0x6E1eC1e74162D9c141e12B593Cad390aEfFb6bD0#code) (unverified) Unverified Honk verifier that CRISPProgram uses for ballot proofs in rounds whose voters are listed in a Merkle tree. The source code of this contract is not verified on Etherscan. #### CrispOnchainBallotVerifier Addresses: [0xC496A7ee730590D5A7669E251cbE54F5Fc339Ea8](https://etherscan.io/address/0xC496A7ee730590D5A7669E251cbE54F5Fc339Ea8#code) (unverified) Unverified Honk verifier that CRISPProgram uses for ballot proofs in rounds that read voting power from the token, which includes every governance vote. The source code of this contract is not verified on Etherscan. The current deployment carries some associated risks: - Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).