UNPT is a fixed-supply, observe-only ERC-20.

The contract enforces a fixed supply.

The token implements the standard ERC-20 transfer, approve and transferFrom methods, plus EIP-2612 permit for signature-based approvals, and nothing else. There is no function that can mint, burn, rebase, pause, charge a fee or blocklist an address, and there is no owner, role or upgrade path, so no party can change the rules after deployment. An absent function is an unexploitable function.

The full allocation table is asserted on-chain.

A one-shot distributor receives the entire mint and routes it in a single transaction. It refuses to run unless the amounts sum exactly to the fixed supply, every destination is unique and non-zero, and nothing remains behind; it then disables itself permanently. The table below is the release framework's published sub-allocation of the 12bn tradable and ecosystem supply alongside the 18bn reserve; it is a blueprint value pending final governance ratification.

The reserve lock is a property of code.

The 18bn reserve sits in a non-upgradeable vault. No withdrawal can execute before a hard timestamp 24 months after launch, written into the bytecode. After that, each withdrawal requires a governance proposal behind a 7-day timelock, a 30-day on-chain announcement, and an in-contract cap of 1 percent of the initial reserve per quarter. Balance, caps and pending actions are verifiable by anyone at the address level.

Treasury and market policy is bounded and funded on both sides: the operating treasury's UNPT can lean against upward divergence by selling into strength, and a separate stablecoin sleeve, capitalised from sale proceeds at launch, funds downward support through buybacks. Bought-back UNPT parks at a published holding address, because burning sits outside v1. The intervention controller remains a documented manual policy in v1; an automated controller is deferred research.

The CSI never moves balances.

In v1 the CSI is observe-only. The certified-release oracle accepts a reading only with two-of-three independent attestor signatures over identical content hashes, which turns the off-chain reproducibility gate into an on-chain invariant; uncertified or provisional readings are rejected at the contract level.

The reference value derived from the CSI is a published model output, not a market price, redemption value or hard peg. The oracle computes it in fixed point from the certified reading with bounded, timelocked parameters, and flags itself stale if no certified release arrives within 400 days. It is a transparency signal and does not move user balances.

Deployment status: live on the Sepolia testnet, mainnet gated.

The release framework is deployed to the Sepolia public testnet, and an on-chain rehearsal has verified the full launch ceremony: the fixed supply minted once, the allocation table routed to the wei, the reserve locked in code, governance wired to the timelock, and a two-of-three attested CSI release posted with the on-chain reference value matching an independent off-chain recomputation. Testnet tokens carry no value and the deployment is disposable.

Nothing has been deployed to a production network. Mainnet stays closed behind seven gates: code freeze with green invariants, two independent audits plus a public contest with zero open critical or high findings, a live bug bounty, two consecutive certified CSI releases with the parity gate passing, counsel sign-off, a completed incident-response drill, and a byte-identical dress rehearsal on a mainnet fork. Until every gate reads green, every figure and address here is for review only and is not an offer, a solicitation or investment advice.