Anoma (XAN) Token

The Anoma token (XAN) is an upgradeable ERC-20 token.

This repository contains both implementations and the upgrade from V1 to V2. V1 gates upgrades with an in-token meta-governance mechanism based on quorum approval voting and a fast-track council. V2 removes the in-token governance in favor of a single owner, vests the formerly locked balances linearly, and adds ERC20Votes vote delegation on a timestamp clock. The V2 owner is an external governance stack — the XanGovernor DAO, its TimelockController, and the XanUpgradeCouncilModule backup upgrade path.

Conceptual orientation lives in CONTEXT.md. The audit-facing specifications are docs/01-XanV2-upgrade.md (token) and docs/02-XanV2-governance.md (governance layer); design decisions are recorded in docs/adr/.

The council multisig is V1's governanceCouncil, which schedules V1 upgrades and will also front the XanUpgradeCouncilModule after the upgrade. Both networks share the same addresses.

Anoma smart contracts undergo regular audits:

1. Zellic Audit

   • Company Website: https://www.zellic.io
   • Commit ID: 856c38dd77d777783c4b0f7010419ef1b99a0daa
   • Started: 2025-07-10
   • Finished: 2025-07-14

   📄 Audit Report (pdf)

2. Informal Systems Audit

   • Company Website: https://informal.systems/
   • Commit ID: e4b0034454612c0ff018f239d841fc3024d62151
   • Started: 2025-08-18
   • Finished: 2025-08-27
   • Updated: 2025-09-18

   📄 Initial Audit Report (pdf) 📄 Updated Audit Report (pdf)

1. Nethermind Audit

   • Company Website: https://www.nethermind.io
   • Commit ID: a580fdb7ec2fd26a480bd0d22982b8aebd503df8
   • Started: 2026-07-29
   • Finished: 2026-08-06

   📄 Audit Report (pdf)

If you believe you've found a security issue, we encourage you to notify us via Email at security@anoma.foundation. Please do not use the issue tracker for security issues. We welcome working with you to resolve the issue promptly.

1. Get an up-to-date version of Foundry with

   curl -L https://foundry.paradigm.xyz | bash
   foundryup

2. Clone this repo and run

   forge install

forge test --force

forge coverage

As a prerequisite, install the

• solhint linter (see https://github.com/protofire/solhint)
• slither static analyzer (see https://github.com/crytic/slither)

bunx --bun solhint --config .solhint.json 'src/**/*.sol' && \
bunx --bun solhint --config .solhint.other.json 'script/**/*.sol' 'test/**/*.sol' && \
slither .