Where trust actually lives.
The protocol layer of eDMT is trustless: mint and transfer are pure reads of public Ethereum data. The application layer is not. ERC wrappers, marketplace, and indexer all introduce custody or attestation. This page itemises every one of them.
Five layers, five trust profiles.
Reading bottom-up: nothing further down is more trusted than the layer above. The protocol layer is the only one Ethereum itself enforces. Everything else is a social or contractual promise — verifiable, but not automatic.
Protocol
Mint, transfer, batch-transfer, burn — all pure reads of EIP-1559 burn from finalised blocks. No custody. No keys.
Wrappers
ERC-721 / ERC-20 contracts that mirror protocol-layer holdings. Backed by a 5-of-7 multisig EOA escrow.
Marketplace
On-chain order book over wrapped ERC-721. Inherits wrapper trust + standard contract-risk surface.
Indexer
Off-chain replay of protocol calldata into the canonical state. Multiple operators run the same code; their state roots are compared in Plate IX.E.
Frontend
This site is one of many possible interfaces. It can mislead you, but cannot move funds — every action surfaces raw calldata first.
The escrow that guards every wrap.
All assets that pass through ERC-721 / ERC-20 wrappers are escrowed in a single 5-of-7 multisig EOA. If five of these seven keys are simultaneously compromised, every wrapped asset can be drained. The protocol-layer holdings are unaffected.
- 5-of-7
- Ethereum mainnet · chainId 1
Signers (mock)
- #010xa1b2…a9b0Founder · core dev
- #020xb2c3…b0a1Foundation · ops
- #030xc3d4…a1b2External · auditor
- #040xd4e5…b2c3External · ETH researcher
- #050xe5f6…c3d4Community elected · seat A
- #060xf6a7…d4e5Community elected · seat B
- #070xa7b8…e5f6Backup · cold storage
Mock seed addresses. The production multisig and signer set will be published before mainnet launch and pinned here.
Every wrap leaves a fingerprint.
Each wrap, unwrap, deposit, and withdraw is countersigned by the multisig and broadcast on Ethereum. The ledger below is verifiable against Etherscan — independent observers can replay it without any indexer at all.
- 0x5C5d…F1cC0.0070 #20,991,2820x784c2e82…22fee27/7
- 0x5C5d…F1cC0.0234 #23,514,1160xcd8cc446…d313327/7
- 0xCc9b…c1c50.0112 —0xa8a4432a…d3e6326/7
- 0x8b3F…9a7E0.0331 #20,873,3480x418e646a…4928ae7/7
- 0xa7E2…7c8B0.0086 —0x1cf57a7e…9f3a116/7
- 0x4Aa2…E2c10.0226 #21,012,9630x07b8f893…1dd33b7/7
- 0x7E2c…c8B30.0024 #20,320,9550xad4fd7cc…528ed15/7
- 0x2c1c…B3F10.0197 —0xe6d15053…df06c37/7
If you ever see this ledger lag for more than ~30 minutes, treat it as an operator outage and route around the wrappers — see /calldata for the protocol-layer escape path.
What the multisig agrees to remember.
Periodically the multisig signs a state root attesting to the canonical eNAT ledger at a given block. Apps that don't run their own indexer can fall back on these witnesses with explicit trust assumptions.
- #24,836,7100xdbd2257b…3d8c697/7
- #24,829,5100x25cd0320…37df425/7
- #24,822,3100x0a37c6b6…e7b3487/7
- #24,815,1100x071f219d…790b4f7/7
- #24,807,9100xa363e49a…73d8286/7
- #24,800,7100x6fd1d762…e3be9a7/7
Many indexers, one ledger.
Anyone can run an indexer by replaying eDMT calldata from block 12,965,000 forward. Below are known endpoints and how their current state root compares to the foundation reference. Disagreement isn't an error — it's the spec's defence in depth.
- indexer.edmt.orgFoundation reference#24,836,7100xdbd2257b…3d8c69
- indexer.snapshot.boxSnapshot Labs#24,836,7090xdbd2257b…3d8c69
- indexer.curve-research.ethCurve Research collective#24,836,7060xdbd2257b…3d8c69
- edmt-archive.envio.devEnvio (community fork)#24,836,6910x25d558d4…57a035
Disagreement on a recent block is usually a reorg lag and resolves within a few blocks. Sustained disagreement should be reported in the protocol forum and treated as a soft signal to verify off-line.
If anything here fails — bypass it.
Nothing on this page can prevent you from interacting with the protocol. Mint, transfer, batch-transfer and burn are five lines of calldata that any wallet can send.
If the wrappers are paused, if the multisig signers go quiet, if every indexer in the world stops responding — the protocol layer is still on Ethereum, still readable, still mintable.