MintCan authorize
suggestMinter(address,uint256,uint256,string) requires an application period >=1209600 seconds, fee >=1000e18 ZCHF and an unregistered address, collects the fee, records timestamp+period and emits MinterApplied. isMinter activates at timestamp equality unless denyMinter deletes registration. mint, mintWithReserve and coverLoss impose only minterOnly (direct registration or a registered position whose parent is active), not economic collateral or a durable aggregate cap; registerPosition has no position-code check or independent veto. Existing native caller restrictions are separately certified. The bootstrap initialize requires both ZCHF and FPS supply zero; pinned supplies are nonzero, but there is no one-time latch, so this is disabled-reactivatable after complete wind-down, not disabled-final. CCIP-only machinery is inventoried in the research note and stays in the separate Bridge Risk lane.
MintParameter-only
Verified QUORUM=200 (private constant; not the stale NatSpec 3% or newer-module documentation). checkQualified requires votesDelegated*10000 >=200*totalVotes. votes=balanceOf*(anchorTime-voteAnchor), where anchorTime=timestamp<<20. Transfers adjust recipient anchor to preserve existing votes and remove transferred age from total votes; received and flash-borrowed shares add zero votes. denyMinter checks qualification through this immutable reserve. kamikaze destroys caller budget and target votes at caller cost. restructureCapTable is additionally reachable only when zchf.equity()<1000e18: it burns arbitrary FPS balances without caller sacrifice, including a complete FPS wipe. At the pin equity()=3621269413393034879313612 wei ZCHF, so restructuring currently reverts; future distress is not permanently excluded. invest/redeem only exchange existing ZCHF and FPS, not new ZCHF. The SavingsReferral rate can be replaced by any qualified holder, resetting a seven-day clock, which meets the D30-S monetary-policy delay floor and is not counted toward the fourteen-day admission window.
MintCan authorize
eth_getLogs replay identifies 56 PositionOpened registrations; pinned getPositionParent matches this hub for every one. 15 original Position runtimes match their verified deployed bytecode; clone runtime points to a verified original. Immutable PositionFactory 0x0cde500e6940931ed190ded77bb48640c9486392 creates only the reviewed Position code or EIP-1167 clones. The only registerPosition calls are these factory-created outputs, never caller-supplied arbitrary addresses. Position mint checks minted+amount<=limit, with clones consuming original available limit, owner/authorized roller, expiry, cooldown/challenges, and collateral balance*price>=minted*1e18. There is no protocol-wide aggregate ceiling; new collateral positions and prices are user-authored and have only a minimum three-day position challenge window. This is collateral-gated, not an independent claim that collateral is economically sound. mintWithReserve is called only after these checks; liquidation coverLoss is debt-shortfall limited and immediately followed by burning the corresponding debt. V2 forceSale likewise burns its minted-debt loss coverage.
MintCan authorize
eth_getLogs replay identifies 186 PositionOpened registrations; pinned getPositionParent matches this hub for every one. 39 original Position runtimes match their verified deployed bytecode; clone runtime points to a verified original. Immutable PositionFactory 0x728310feaca72dc46cd5bf7d739556d5668472ba creates only the reviewed Position code or EIP-1167 clones. The only registerPosition calls are these factory-created outputs, never caller-supplied arbitrary addresses. Position mint checks availableForMinting/availableForClones with original-family totalMinted and immutable limit, owner/authorized roller, expiry, cooldown/challenges, and collateral balance*price>=minted*1e18. There is no protocol-wide aggregate ceiling; new collateral positions and prices are user-authored and have only a minimum three-day position challenge window. This is collateral-gated, not an independent claim that collateral is economically sound. mintWithReserve is called only after these checks; liquidation coverLoss is debt-shortfall limited and immediately followed by burning the corresponding debt. V2 forceSale likewise burns its minted-debt loss coverage.
MintCap-limited
Pinned eth_call limit=10000000000000000000000000, minted=17000094858261410, horizon=1729980479. mint/mintTo transfers the source CHF token, then _mint checks horizon and minted+amount<=immutable limit; CHF token risk does not remove that hard outstanding ZCHF ceiling. Burns reduce minted. No admin, cap setter, arbitrary call forwarding, registerPosition, mintWithReserve or coverLoss path exists. This instance is expired and cannot mint again; burns remain available.
MintCap-limited
Pinned eth_call limit=2000000000000000000000000, minted=0, horizon=1776276731. mint/mintTo transfers the source CHF token, then _mint checks horizon and minted+amount<=immutable limit; CHF token risk does not remove that hard outstanding ZCHF ceiling. Burns reduce minted. No admin, cap setter, arbitrary call forwarding, registerPosition, mintWithReserve or coverLoss path exists. This instance is expired and cannot mint again; burns remain available.
MintCap-limited
Pinned eth_call limit=10000000000000000000000000, minted=771313820778000000000000, horizon=1807188455. mint/mintTo transfers the source CHF token, then _mint checks horizon and minted+amount<=immutable limit; CHF token risk does not remove that hard outstanding ZCHF ceiling. Burns reduce minted. No admin, cap setter, arbitrary call forwarding, registerPosition, mintWithReserve or coverLoss path exists. This instance can still mint up to its remaining hard ceiling.
MintCap-limited
Pinned currentRatePPM=10000; nextRatePPM=10000. calculateInterest returns min(linear accrued interest, zchf.equity()), unlike SavingsReferral. Positive equity never exceeds the reserve ZCHF balance, so its coverLoss payment transfers existing reserves without a supply shortfall. Accrued interest is credited to savings and can compound on later refreshes, but each claim is reserve-capped. proposeChange can be overwritten by any qualified FPS holder and resets nextChange=timestamp+604800; applyChange rejects equal rates or a not-yet-mature proposal. save actually transfers principal; this version enforces the three-day weighted interest/withdrawal lock. No registerPosition or arbitrary ZCHF mint call exists.
MintDirect
Pinned currentRatePPM=nextRatePPM=35000 (3.5% APR), nextChange=1774551239. Bytecode-matched AbstractSavings.calculateInterest computes uint192((ticks-account.ticks)*account.saved/1000000/365 days) without the legacy equity cap. AbstractLeadrate ticks accrue linearly at uint24 currentRatePPM (max16777215, 1677.7215% APR); refresh credits interest to principal so repeated refreshes compound. refresh calls Frankencoin.coverLoss; when reserve funds are exhausted its shortfall is newly minted ZCHF, with no durable economic supply cap. The three-day INTEREST_DELAY delays new-deposit interest, not seasoned-account claims or governance; this version withdraw has no FundsLocked check. Leadrate.proposeChange requires checkQualified, can be replaced/reset by another qualified holder and always imposes only604800 seconds before applyChange, not1209600. A qualified max-rate proposal and coverLoss(reserveBalance+1) from this minter both succeeded in pinned read-only eth_call; neither was sent as a transaction. D30-S expressly admits this formula-bound, uint24-capped, minority-replaceable seven-day monetary-policy path as raiseable with bounded impairment; it remains economically capable of minting reserve shortfalls, not collateral-capped.
MintCap-limited
roll checks both getPositionParent!=zero and source owner==caller. It mints repay ZCHF to itself, repays the source, moves collateral, optionally mints from the separately collateral-gated target position, and unconditionally burns repay ZCHF from the caller before success. Any failure reverts the entire temporary mint. No durable net issuance arises from the flash principal; new net debt is subject to the target Position cap/collateral checks. No registerPosition, arbitrary target mint forwarding or coverLoss call exists.
MintNone
Verified TransferReference and inherited CCIPSender expose reference transfers and CCIP fee/message sending, but never ZCHF mint, mintWithReserve, coverLoss or registerPosition and contain no arbitrary user-selected native call forwarding. The contract being isMinter=true grants the Frankencoin implicit allowance but its actual entrypoints only transfer existing tokens. Cross-chain validation remains a separate Bridge Risk lane.
MintCap-limited
Pinned LIMIT=2500000000000000000000000 (2500000 ZCHF), totalBorrowed=2370882558074509465955890, EXPIRATION=1806537599. borrowIntoPool requires a positionCreationDate set by this factory, unexpired state and the minimum paired USD, transfers that collateral and mints ZCHF into the fixed pool, then atomically enforces totalBorrowed<=LIMIT. Repay burns proportional debt and reduces the outstanding counter. Clone initialization is one-shot and amplifier-bound; callbacks authenticate the immutable Uniswap pool. No arbitrary Frankencoin registration or loss-coverage call exists. Hard outstanding cap is real even though paired-token price/market risk can impair backing.
