TokenOps
Recipe · Operations · Mainnet

Mainnet readiness checklist

Six gates. When all six close for a product, it ships on Ethereum mainnet. fhe-disperse is already there. fhe-vesting and fhe-airdrop are OpenZeppelin-audited; their remaining open gates are KMS mainnet readiness (2) and CREATE3 deployment (4).

The six gates#

  1. 1

    Audit publication

    OpenZeppelin audited all three products (0 critical, 0 high across both audits); reports linked from /resources. This gate is cleared.

  2. 2

    Zama mainnet KMS

    Zama operates KMS against Ethereum mainnet with the same threshold posture as Sepolia. fhe-disperse already passed this.

  3. 3

    Design-partner pilots

    Three pilots running on Sepolia for a full quarter against production-like volume. Telemetry surfaces in the SDK adapter.

  4. 4

    CREATE3 deployment

    Deploy from the audited deployer so the mainnet address matches every other chain the deployer publishes from.

  5. 5

    Telemetry sink wired

    Pass an SdkTelemetry adapter in the SDK client constructor's telemetry option to feed your operations dashboard. Don't go mainnet blind.

  6. 6

    DEPLOYED_ADDRESSES update

    After (1)–(5), the mainnet address lands in DEPLOYED_ADDRESSES in a minor SDK release. The docs site auto-picks it up.

Per-product status#

fhe-disperse · live on mainnet · audited by OpenZeppelin (May 2026).

fhe-vesting · Sepolia only · audited; mainnet deploy + KMS readiness pending.

fhe-airdrop · Sepolia only · audited; same remaining gates as vesting.

For the full risk model + relayer dependency + HCU envelope, see Resources › Mainnet readiness. This recipe is the actionable checklist; that page is the deep rationale.

See also