# CEN OPEN-TOOLS MANUAL *The Crypto Endowment Network (CEN), on the Base chain. This is the list of every tool you can fire **without asking anyone** — the permissionless and self-serve surfaces, with addresses, the exact functions anyone may call, what they cost, and the honest limits of each.* *Last reviewed 2026-10-27. Experimental software — nothing here is guaranteed, nothing here is an investment or an income promise. Where a key is still held or a thing is still being proven, it says so in plain words. We never call anything "trustless" while a key still exists.* --- ## 1. How to read this manual **"Permissionless" means:** the function is open to anyone. You need only a wallet and the gas to send the transaction. No allow-list, no sign-up, no one's approval — the contract does not check who you are. These are the **public cranks** of the network: cranking them moves the machines along for everybody, and the person who pays the gas gets nothing special for it (no fee, no reward) beyond knowing the thing advanced. **"Self-serve" means:** the function is gated to *you* — your own wallet signs for your own position (your stake, your markers, your seat). Nobody else can do it for you and you don't need anyone's permission to do it for yourself. **What a crank does:** most CEN machines sit idle until someone pokes them. A crank (`harvest`, `scrape`, `accrue`, `distribute`, `sync`, `digest`) is that poke. It reads the live chain, moves money along the one path the contract was built for, and stops. A crank can never choose a *new* destination — the path is fixed in the code. **The one honest limit that is true of nearly everything here:** you can crank these machines, but you **cannot withdraw from them, cannot redirect them, and cannot touch the principal (the corpus).** The endowment corpus is one-way by design. These tools let you *help run* the network; they do not let anyone *drain* it. **Addresses are on the Base chain (chainId 8453).** Every address below is BaseScan-linkable at `https://basescan.org/address/
`. The shared retirement registry — where retired impact tokens are held forever — is the real one: `0xfd780B0aE569e15e514B819ecFDF46f804953a4B`. (Beware any lookalike; the real one is the only one used.) --- ## 2. Voting & membership tools ### The vote page — move your own weight - **What it is:** members place kernel-weighted markers on "jars" (beneficiary cards); at each yield harvest the drips read the live weights and split that harvest accordingly. Moving your marker reroutes your weight immediately — live steering, no epochs. - **Where:** cryptoendowmentnetwork.org/vote/ - **Governance manager (V5):** `0xE8023a58a10fA4c248e4Ff8ae4EbB7BCA3DD40C0` (BaseScan-verified) - **Self-serve function anyone-who-holds-kernels may call:** - `moveMarkers(...)` (selector `0x08420150`) — moves YOUR kernel weight onto the jars you choose. Only your own wallet can move your own markers. - **Cost:** just gas. - **Can NEVER:** move anyone else's weight; take custody of any money; change where a jar's money ultimately goes (the jar's destination is fixed in the card). Your vote steers *proportions of yield*, it never hands you funds. - **Status:** LIVE. (Note: the V5 governance manager is in a 14-day soak ending ~2026-11-02; admin keys are still held during the soak so defects can be fixed — see Section 8.) ### Make any registered card votable — JarOpener (permissionless) - **What it is:** the satellite that turns a registered card into a votable jar, open to everyone. - **Address:** `0x93cfDF9bb276719a92569A81854f4FFf26731A7e` (BaseScan-verified; code confirmed live on Base this review) - **Permissionless function anyone may call:** - `openJar(card)` — makes a registered card votable on-chain. Anyone can call it for any registered card. - **Cost:** just gas. - **Can NEVER:** create funds, route funds, or make a card the website chooses to feature. It only flips the on-chain "votable" flag. Our website curates which cards it *lists*; the on-chain tool is open to all. - **Status:** LIVE. ### Register a card — the Env factory (permissionless) - **What it is:** the factory that registers a new beneficiary card on-chain. Anyone can register a card to fund anything. - **Address:** `0x9D914FE8387e82391cF4f29a400F34A7701CB341` - **Permissionless function anyone may call:** - `registerJar(...)` — registers a new card on-chain. - **Cost:** just gas. - **Can NEVER:** force CEN's website to display or feature your card (UI curation is editorial — "This page is curated. The chain is open."); take anyone's money. Registering a card does not fund it — only members voting their kernels onto it routes yield to it. - **Status:** LIVE. ### Join — the seat claim lane (self-serve, two-human gated) - **What it is:** the on-chain path by which a new member is seated. An inviter spends a scarce invite and a distinct second member adds a free co-vouch; the gate then completes the seat atomically. - **Where:** cryptoendowmentnetwork.org/join/ and /seat-claim/ - **SeatClaim satellite:** `0x1b1e8d1934D2DDcf0AeB224EC04DBbc37AC19E86` (code confirmed live on Base) - **Membership Gate:** `0xC37226904B09a345f29cf0bfD528291Cdf776ccd` (code confirmed live on Base) - **Vouch registry (one-human freshness check):** `0xc094225b253b52F1aEB21e5c13c956c86AE4F6a3` - **Self-serve shape:** the invite + the distinct second co-vouch complete the seat; two humans with wallets are the authority, on-chain. No founder in the loop for the seating itself. - **Cost:** just gas (and a scarce invite spent by the inviter). - **Can NEVER:** let one wallet self-seat (a distinct second member is required); take custody of funds. A kernel, once held, is a non-transferable voting voice (`anchorOf`, not a balance) — it cannot be bought, sold, or transferred. - **Status:** LIVE. Founding-seat cap is 100 and is immutable. After 100, growth is one invite per member per year. --- ## 3. Endowment & deposit doors — READ THE THREE CLASSES **This is the part we never blur. There are three different kinds of "put money in" door in CEN, and they behave completely differently. Know which one you are touching before you send anything.** ### CLASS A — Redeemable wrappers (you can get it back) Some tokens are 1:1 redeemable wrappers — you deposit and you can redeem back out. *If a door is redeemable, it says so and the `redeem` succeeds.* Treat a door as redeemable ONLY if its own page/contract states it and the `redeem` path is live. Do not assume any CEN endowment door is redeemable — most are not (see Class B). ### CLASS B — No-withdraw endowments (one-way, the corpus only grows) - **What they are:** the per-lane cen-endow receipt tokens (cenART / cenENV / cenEDU / cenHUM / cenOVERHEAD, each in USDC / ETH / BTC variants). You deposit, funds are routed into Aave, a receipt is minted to you 1:1 — and **there is no withdraw, ever.** `withdraw`/`redeem` revert. The corpus is permanent; only the *yield* leaves. - **Yield split:** every harvest splits in exact thirds — 1/3 liquidity deepening, 1/3 reactor sink, 1/3 community drip (vote-routed). - **Example address:** cenOVERHEAD-USDC endowment token `0xcafF24c5a345E05D4F43877D1Fce804dc32B8D1c`. - **Lane vaults (where deposits land):** Art `0x74D0D4E631Ae72cE4c06249cBdD3D3689504174c` · Environment `0x97581e68dB25705b56b8458390CcEe186914A174` · Education `0x21281dEBd9A3B73D7C46791CC59bD2859B46d3F4` · Humanitarian `0x60b0f6c2F86303f1b66303fcc8C27d8CF5560Cc6` · Overhead `0xE267Fe276F9A7b38D8c0c0b58E41653050223224`. - **The honest line:** a deposit into a Class B endowment is a one-way contribution. You get a receipt and a say (if you hold kernels), not your money back. Deposit knowingly. ### CLASS C — Locked contributions (CBI / MSV — building toward a thing, no yield to the buyer) - **CBI (Community Basic Income):** token `0xC55b9482812DC4DF9c2112683487b7cBe887049D`; vault `0x8e1CaB4479E3b20CB0afca0C20Bc3C4093ED74af`. An equal-split basic income across living, active members. **Ratchet law:** the corpus floor only rises (one-way deposits). **Honest line:** CBI is not paying meaningful income today — it is building toward that. CBI-token buyers receive no yield. - **MSV (Master Staff Vault):** `0x71025e7e98dac4d1190A98fd053056416652Dbd8` (code confirmed live on Base), over OverheadEndowUSDC `0xcafF24c5a345E05D4F43877D1Fce804dc32B8D1c`. Pays staff from vault *yield only*; corpus never touched. Honest line: building toward real paychecks, not at that scale yet. **The three classes, in one breath:** redeemable wrappers you can get back; no-withdraw endowments are one-way and only the yield leaves; locked contributions (CBI/MSV) grow a base that will one day pay members/staff from yield but pays nothing to the *buyer* of the token. We never let these blur together. --- ## 4. The impact machines & their public cranks **What a burn-boost machine is (one sentence):** a small set of born-locked LP cards that turns a trickle of USDC yield into permanent, visible support for a cause — USDC deepens a cause-token's liquidity pool, the pool's trading fees are swept up to an engine, and the engine either retires the cause token forever into the public MfT registry or burns it through the cause's own official burn. **The permissionless cranks anyone may call on these machines** (the keeper does this daily, but it is open to everyone): - `scrape()` — on a feeder/booster card: folds any loose USDC/token sitting on the card into its born-locked LP (deepening the market). - `harvest()` — on an engine: sweeps the LP's accrued trading fees and disposes of them the one honest way the engine was built for — **registry-retire** (cause token sent forever to `0xfd780B0aE569e15e514B819ecFDF46f804953a4B`) or, for ART, **Juicebox-burn** (Artizen's official burn; proof is the `ArtBurned` event). - **Cost:** just gas. If there is nothing to scrape/harvest, the call simply does nothing (no gas wasted beyond the call). - **What these cranks can NEVER do:** pull liquidity (the LP cards are born-locked — liquidity can never be removed), withdraw/rescue anything (the engines have no withdraw or rescue door — admin burned to `0x0` at birth), or redirect the cause token anywhere but its fixed sink. It is a one-way machine: support goes in, depth + a permanent retirement record come out. - **Bare-send note:** these are LP machines, **not deposit endpoints.** Do not bare-send tokens to a feeder/engine expecting a receipt — a bare send just sits until a `scrape()` folds it in. (The cen*-USDC endowment doors in Section 3 are the deposit doors; these are not.) - **MEV posture (honest):** every family pool and every crank hop uses a single 1% fee tier, and the engine's immutable per-hop slippage cap is 300 bps (≤3%). A sandwicher pays the 1% twice (~2% round-trip plus gas), so net extractable shrinks to roughly ≤1% minus gas — and the residue accrues to the machine's own born-locked LP. Bounded and taxed, not eliminated. **The 16 families (token · engine — all registry-retire to `0xfd780B0a…` unless noted):** | Family (cause) | Cause token | Engine | |---|---|---| | PR24 — Education (Polyraiders schools) | `0x546145Ff40DD6D0BD001aE290306d05BCf574dD7` | `0xd92B05877a5E65D692d0d351F743f9df50103f4b` | | PR25 — Humanitarian (Polyraiders schools) | `0xE6B95cc9307BEB5d37fe2e0891d680cb9C9aac6b` | `0x2FDb2A9b764682f8D70A36939fa2831706EDf037` | | ART — Art (Artizen; **Juicebox-burn**, not registry) | ART (Artizen) | `0xD890f2877Fe8cc2BD484c1A4E27A88762769eAa1` | | MGRO — Environment (Treegens; 1 MGRO = one tree, 3-yr proof of life) | `0x46e564D039d0d7Ec4C88d517fD32a03d15e88568` | `0x4FbAf0f4E059f3EF9FFDb39C163ab79A4a722e0F` | | CBI — Overhead (Community Basic Income) | `0xC55b9482812DC4DF9c2112683487b7cBe887049D` | `0x1269ceFB2436a9b0553b8ff4695bD14D8A4d95C4` | | MSV — Overhead (Master Staff Vault) | `0x51bA3aa3a3fA59E38206FA08894849D15cF54918` | `0x4D6a8bc5E9b0475526CE38053fF987017A5F22eC` | | CHAR — Environment (Biochar) | (family v3) | `0xdA453c227a4dFd525812d11989EB5D696525F381` | | CCC — Environment (Carbon Counting Coin; 1 token = 1 lb CO2e) | `0xd0581088eAaA4bF9A948B15a057b809c2b0CD61c` | `0x7389395788CF1777DEbdE8B5Ec4Ed56bEB52536c` | | MCO2 — Environment (Moss Carbon Credit) | `0x3eeD40Fc168024C7CE50f2Cd5EE2D92df298F5a1` | `0x450e2774d901dc08Fba4B1fF63ABB40c3155B362` | | NCT — Environment (Nature Carbon Tonne) | `0x85529937ae4819B53107089aaf076A6Dc16858B2` | `0x9E2D99231bdBD854b41c232EC8c6F7FaCAf58EbF` | | BCT — Environment (Base Carbon Tonne) | `0x58f2C6bfB1200f674Bbd0F6c9a245a463b9d3726` | `0x9C6739481156310f79ECfA8EA389592DB035d5Be` | | TB01 — Environment (Touch Butts; 1 token = 1 cigarette butt cleaned up) | `0xeB3D7481f9b73c8c08aD64372C81C90A299F4D79` | `0x94E230A05cCE123B8D85003C513f9e58CBA7968a` | | JCGWR — Environment (Jimi Cohen Guinness World Record trees) | `0x17d650519A4B69C2D5d292Bb56C2B393E59ba992` | `0x1F4474078a76b74CC2b05B26DFCf19FC13cEEd97` | | JLT-B23 — Environment (Jasmine Energy REC, back-half 2023) | `0xaa87600b74d20373B1Ae03a9112d8B713b9dc0AF` | `0x24fB91755c8245C14299725C328aAaDC73DDD51b` | | fJLT-F24 — Environment (Jasmine Energy FORWARD REC, front-half 2024) | `0xe3Cca1BfE6004959D3694C762e885c47A9319a54` | `0xeBbc26E897d3D65D163Ff147B2495c5ED9cE26D1` | | REGEN — Environment (progenitor family; gen-2 production engine) | (proof-trail family) | `0xc990DE9Ef36f349Fd82031571Ef5E37990EC1f92` | (Full feeder/booster USDC/ETH/BTC card addresses per family: `BURN-BOOSTER-MACHINES.md`.) **Retired / burned to date** (flywheel snapshot 2026-10-05): ART **345.97** (burned via Juicebox) · PR24 **40.70** · PR25 **14.81** · MGRO **0.0683** · CHAR **0.00493** · MSV **0.000185** · CBI **0.00013** · JLT-B23 first-ever retirement landed (0.000112) · remaining families seeded, not yet harvested-to-registry. **Retirement is not destruction and not certification.** Retired tokens are held forever at the registry as a permanent, public record of support. It does not destroy or certify anything. --- ## 5. Staking — stake CEN, help fund it permissionlessly - **What it is (one sentence):** stake CEN; any CEN sent into this contract by anyone splits pro-rata among whoever has staked. - **CENStakingSimple address:** `0x64d5078E4cDBD13AEb140dcf8d4cDA0FdC98Afd8` (BaseScan-verified; code confirmed live on Base this review — `CEN()` returns the real CEN `0xCfE6235D98B99204eD4611297Af45CAa0871cAD3`, `owner()` reverts = no owner, `totalStaked` nonzero = live and in use). - **Permissionless / self-serve functions — exactly five, nothing else:** - `stake(amount)` — self-serve: stake your CEN into the pool. (You approve CEN to the contract first.) - `unstake(amount)` — self-serve: take your principal back, any time. Always open — no lock, no pause, nothing can block you leaving. - `claim()` — self-serve: pull your accrued reward share. - `exit()` — self-serve: principal + all rewards, in one call. - `sync()` — **permissionless crank**: anyone can call it; folds any CEN that has landed in the contract into the pro-rata accumulator so it is credited to stakers. It also runs automatically on claim/unstake/exit. - **Funding the reward pot is permissionless:** anyone or anything funds rewards simply by transferring CEN to the contract address — no special caller, no feeder weld. A later `sync()` divides it among stakers in proportion to their stake. - **Cost:** just gas. - **Can NEVER:** there is **no owner, no admin, no pause, no lock, no withdraw, no rescue, no setter, no feeder key** — confirmed in source, in the ABI surface, and in a runtime-bytecode selector scan (all 11 dangerous selectors absent). The only value-out paths are `unstake`/`claim`/`exit`, each paying **only the caller** their own tracked stake/earned amount. No path pays an arbitrary address. Deposited principal can never be mistaken for or paid out as a reward. It pays no promised return. - **Status:** LIVE and keyless. (This is the one surface in this manual that is honestly *keyless* — it was born with no key of any kind.) --- ## 6. Staff self-serve — the I-quit tool - **What it is:** a staff member can resign their own chair, self-serve, signed by their own wallet. Earned pay to date is claimed out to them, the seat vacates, no questions owed. - **Where:** cryptoendowmentnetwork.org/staffing/ - **The vacancy benefit:** a vacant chair is never destroyed — its principal is the system's and it keeps earning while empty, so an empty seat saves its pay for whoever takes the job next (a month empty is a month's pay as their sign-on bonus). - **Cost:** just gas. - **Can NEVER:** let one person claim another's chair pay, or touch the corpus (pay is vault *yield only*, the corpus is never touched). - **Status:** LIVE as the worker-signed self-serve path. (Hiring and firing are founder-signed / seat-voted orders, not self-serve — see Section 8. Source of record: `DUTIES-AND-EXPECTATIONS.md`.) --- ## 7. The agent bus — how partners message us - **What it is:** the message bus by which partners and their agents talk to the CEN coordinator and to each other. Each partner has a named lane. - **Read your files:** `GET /bus/files/` with your token. (File names are prefixed with your lane name so you can see them — e.g. `jimmi-…` on the Jimmi lane, `zao-…` on the ZAO lane.) - **Send a message:** `POST /bus/send` with `from` / `to` / message fields. - **Cost:** no gas — this is an off-chain message bus, not a chain tool. - **Can NEVER:** move money, touch any contract, or seat/vote/grant anything. The bus carries words, not funds or transactions. Anything money- or chain-related still runs through the on-chain tools in the other sections (with the founder's per-action clearance where a key is involved). - **Status:** LIVE. (Partners: ask on your lane for your token and the host if you don't have them — tokens and server paths are never printed in documents.) --- ## 8. What is keyed, and why (the honest list) These are the surfaces where a key of ours still exists. We list each with its money-safety reason. **None of these keys can touch, dilute, or strand a member's funds or the corpus** — they are operational conveniences, peg-makers, and game-item presses, not withdraw doors. We never call a keyed thing "trustless." - **V5 governance manager keys (held, in soak):** `adoptMember` and the keyed seat/jar/roster powers on the V5 manager `0xE8023a58a10fA4c248e4Ff8ae4EbB7BCA3DD40C0` remain live through a **14-day soak ending ~2026-11-02**, so any migration defect can be fixed without a redeploy. **V5 holds no funds, so no funds are at risk during the soak.** Because keys are un-hardened and migration is not renounced, kernels could be migrated again to a fixed successor if a defect surfaces — the soak keeps that door open. Sinks are tunable (`sinksLocked = false`) during the soak. The arc is keyed → vote-governed → renounced; renounce comes later, on the founder's explicit word, only after the soak proves V5 is behaving. - **`grantKernel` (staff-chair power, V5):** a staff chair can mint a free voting kernel to a seated member, but **only co-signed by a second distinct staff chair** (two distinct humans, EIP-712), with a per-chair budget of 3 grants per 30 days. It mints *voice* (a non-transferable kernel), never money. This is deliberately not a single-key power. - **Keeper convenience (the daily crank runner):** a keeper wallet runs `scrape()`/`harvest()`/`sync()`/`distribute()` on a schedule so the machines advance even when no one else cranks them. **The keeper has no special power** — every function it calls is the same permissionless crank anyone can call (Sections 4 and 5). It is a convenience, not an authority; it cannot withdraw or redirect anything. - **Peg-makers / liquidity-manager keys:** the shared lane liquidity manager and similar operational keys deepen pools and manage one-sided peg pools. They move operational liquidity along fixed paths; they are not withdraw doors over member deposits, and the endowment corpus (in Aave) is one-way regardless. - **Game-item mint keys (adjacent ecosystem):** some game-item tokens keep their minter keyed forever — the game mints items as gameplay happens. These are game-layer presses, not CEN endowment money, and are called out here only so the list is complete and honest. **The one question we answer about every keyed thing:** *"Can any key of ours touch, block, dilute, or strand someone's funds or the corpus?"* For everything above the answer is **NO** — the keys are operational, and the corpus / member stakes are structurally out of their reach. What is *already* keyless or sealed and may honestly be called so: the born-locked LP cards (liquidity can never be pulled), the admin=`0x0` engines (no withdraw/rescue), and CENStakingSimple (born with no key). --- ## 9. Standing policies, in plain words - **Experimental — nothing guaranteed.** CEN is proving itself. Nothing here is a promise of value, income, or safety beyond what the chain itself enforces. - **No income promises.** Not an investment, not a security offering. Purchases are content and support, never investments. CBI-token buyers receive no yield. - **Retirement ≠ destruction.** Retired impact tokens are held forever at the registry `0xfd780B0aE569e15e514B819ecFDF46f804953a4B` as a public record of support. It does not destroy or certify anything. - **We never custody other people's funds.** This is a hard law, not a preference. Other people's money moves only by code they control (permissionless claims). Members' deposits into no-withdraw endowments are contributions they chose knowingly. CEN never routes, holds, or exercises discretion over non-member third-party funds. - **Tools open, UI curated.** The on-chain tools — create a card, register it, open it to vote, stake, crank — are permissionless and open to everyone. What CEN's *website* chooses to list is editorial, at our discretion. If we don't list something you want to fund or build, the on-chain tools still work for you directly, and building your own page or ballot on them is encouraged. "This page is curated. The chain is open." - **Live-price law.** Any public value figure CEN shows is read live from the market on-chain, never a hand-set or projected number. Legitimacy is an honest, growing, on-chain trend — not a claim. - **"Trustless" is never used for anything still keyed.** During the V5 soak and wherever a key is held, we say "keyed" or "trust-minimized," never "trustless." The honest arc is keyed → vote-governed → renounced. --- *Where to verify everything yourself:* live dashboard cryptoendowmentnetwork.org/flywheel/ · locked-liquidity proof cryptoendowmentnetwork.org/trust/ · voting cryptoendowmentnetwork.org/vote/ · retirement registry on BaseScan `0xfd780B0aE569e15e514B819ecFDF46f804953a4B` · CEN token `0xCfE6235D98B99204eD4611297Af45CAa0871cAD3` · governance manager (V5) `0xE8023a58a10fA4c248e4Ff8ae4EbB7BCA3DD40C0` · X @_C_E_Network. *Experimental software. Nothing here is an investment, a security, or an income promise. CEN never custodies non-member third-party funds.*