TokenOps
Resources

Addresses, audits, and the bounty timeline.

One page for every operational fact a builder or CFO might need to cite. No marketing copy.

Deployed addresses

Sepolia

The SDK's DEPLOYED_ADDRESSES export resolves these by chainId at runtime, never hand-paste them.

  • fhe-vesting · factory
    live · audited (OpenZeppelin)
    0xA877…3150
  • fhe-airdrop · factory
    live · audited (OpenZeppelin)
    0xbE6A…cd4c
  • fhe-disperse · singleton
    live · also live on mainnet
    0x710d…DBb4
Deployed addresses

Ethereum mainnet

  • fhe-disperse · singleton
    live · audited (OpenZeppelin)
    0x4fC0…cC70
  • fhe-vesting · factory
    audited · mainnet deploy + KMS pending
    Pending
  • fhe-airdrop · factory
    audited · mainnet deploy + KMS pending
    Pending
Audit posture

Where each product stands

Three FHE products, all audited by OpenZeppelin. One mainnet-live. Two pending mainnet deployment + Zama KMS readiness.

Mainnet live

fhe-disperse

Singleton + per-user OZ clones. Audited by OpenZeppelin (May 2026). Live on Sepolia and Ethereum mainnet.

Audited

fhe-vesting

LibClone factory with packed immutable args. Audited by OpenZeppelin (May 2026, same engagement as fhe-disperse). Sepolia live. Mainnet pending factory deployment + Zama KMS readiness.

Audited

fhe-airdrop

LibClone factory with EIP-712 gated claims. Audited by OpenZeppelin (Jan 2026). Sepolia live. Mainnet pending factory deployment + Zama KMS readiness.

Token Operations FHE Contracts Audit — fhe-disperse + fhe-vesting (OpenZeppelin, May 2026)
Confidential Airdrop Audit — fhe-airdrop (OpenZeppelin, Jan 2026)
Bounty timeline

Zama code-bounty cohort

External developers ship full apps against this published surface. Friction lands in a public feedback loop that drives CHANGELOG releases.

  1. Now

    Pre-launch hardening

    SDK surface freezing, docs site building, integrator dogfooding inside the monorepo.

  2. Week 1

    Bounty kick-off

    Zama announces; external developers begin submitting via the published @tokenops/sdk surface.

  3. Week 4

    Mid-cohort sync

    Aggregate friction goes into docs/feedback/triaged; a CHANGELOG release lands the addressed items.

Operational pages

Every resource the launch playbook references

The six leaves below carry the on-call playbook: how to report a vuln, where the changelog lives, what the SDK + docs collect, who answers what.

SecurityThreat model, audit posture, responsible disclosure.Mainnet readinessThe six gates before flipping a product to Ethereum mainnet.ChangelogPer-version highlights, what landed, what broke.Telemetry policyWhat the SDK collects via SdkTelemetry and what the docs site collects via its internal DocsTelemetry.ContributingFeedback inbox, PR workflow, contribution bar.SupportInbox + private vulnerability report + Discord + GitHub, with SLAs.
Security disclosure

Reach the maintainers

If you found a real vulnerability, report it privately through GitHub. Bounty-cohort friction lands in the docs/feedback/inbox/ on the repo.

For high-severity issues (privilege escalation, money loss, ACL bypass, signature forgery against the EIP-712 domain), don't file a public issue — use GitHub's private vulnerability reporting: the tokenops-sdk Security tab → “Report a vulnerability”. It opens a private advisory only the maintainers see, and we'll respond within 48 hours. See Resources › Security for the full disclosure policy.

For DX / type / docs issues: open a structured entry in docs/feedback/inbox/ on the SDK repo with the severity label (blocker / major / minor / nit). The feedback-triager runs every cycle.