The core ERC-20 token of the Inferno protocol. Inherits from OpenZeppelin's
ERC20, ERC20Burnable, and Ownable.
Uses 9 decimals (not the standard 18) and a total supply of 1 billion IFR.
Implements a fee-on-transfer mechanism: every non-exempt transfer deducts a sender burn fee,
a recipient burn fee, and a pool fee. The combined fee rate is capped at 5%. Default rates
are 2.0% sender burn, 0.5% recipient burn, and 1.0% pool fee (3.5% total).
Note: Mint and burn operations (transfers from/to address(0)) bypass fee logic.
Addresses marked as feeExempt also bypass fees entirely.
Constructor
Parameter
Type
Description
_poolFeeReceiver
address
Address that receives the pool fee portion of each transfer. Cannot be address(0).
State Variables
Variable
Type
Default
Description
senderBurnBps
uint256
200 (2.0%)
Basis points burned from sender on each transfer
recipientBurnBps
uint256
50 (0.5%)
Basis points burned from recipient portion on each transfer
poolFeeBps
uint256
100 (1.0%)
Basis points sent to poolFeeReceiver on each transfer
poolFeeReceiver
address
--
Address receiving pool fees
feeExempt
mapping(address => bool)
--
Addresses exempt from transfer fees
Functions
Function
Parameters
Returns
Access
decimals()
--
uint8 (always 9)
Public
setFeeExempt(address, bool)
account, exempt
--
Owner
setPoolFeeReceiver(address)
receiver (non-zero)
--
Owner
setFeeRates(uint256, uint256, uint256)
_senderBurnBps, _recipientBurnBps, _poolFeeBps
--
Owner
burn(uint256)
amount
--
Public
Fee cap:setFeeRates enforces senderBurnBps + recipientBurnBps + poolFeeBps <= 500 (5% maximum total fee).
Internal Functions
Function
Description
_update(from, to, value)
Overrides ERC20._update to implement fee-on-transfer. On non-exempt transfers:
calculates burnSender, burnRecipient, and poolFee;
sends netAmount to recipient, poolFee to poolFeeReceiver,
and burns totalBurn (sender + recipient burn) via transfer to address(0).
Holds 200M IFR as a strategic liquidity reserve with a time-lock and staged withdrawal
mechanism. Tokens are locked for an initial lock period (6 months in production). After the lock expires,
withdrawals are rate-limited to a maximum amount per period (currently 50M IFR per 90 days) to prevent supply shocks.
The per-period maximum is owner-settable via setMaxWithdrawPerPeriod (owner: Governance, 48h timelock);
only the period length is immutable.
Includes a guardian role for emergency pause/unpause.
Constructor
Parameter
Type
Description
_token
address
Address of the IFR token contract
_lockDuration
uint256
Duration in seconds before first withdrawal is allowed
_maxWithdrawPerPeriod
uint256
Maximum tokens withdrawable per period (raw units, 9 decimals)
Linear vesting contract for 150M IFR team allocation. Implements a
12-month cliff followed by 36-month linear vesting.
No tokens are releasable before the cliff. After the cliff, tokens vest linearly based on
elapsed time. The beneficiary calls release() to claim vested tokens.
A guardian can pause releases for emergency situations.
Vesting formula:vestedAmount = totalAllocation * (elapsed - cliffDuration) / (duration - cliffDuration) Returns 0 before cliff, and totalAllocation after full duration.
Constructor
Parameter
Type
Description
_token
address
Address of the IFR token contract
_beneficiary
address
Address that can claim vested tokens
_cliffDuration
uint256
Cliff period in seconds (e.g. 365 days for 12 months)
_duration
uint256
Total vesting duration in seconds (must be >= cliffDuration)
Accepts ETH deposits and uses them to buy IFR tokens on Uniswap V2. Purchased tokens are
split 50/50 between the BurnReserve (permanent burn) and the treasury.
Features a configurable activation delay (60 days in production), a cooldown
between buybacks (default 1 hour), and slippage protection (default 5%) using
price quotes recorded at deposit time.
Permanent token burning contract with on-chain tracking. Tokens are deposited via
deposit() (requires prior approval) or sent directly from BuybackVault.
The owner or guardian can then call burn() or burnAll() to permanently
destroy the tokens, reducing the total supply. Tracks cumulative totalBurned for transparency.
Timelock-based governor for the Inferno protocol with a 48-hour delay.
All protocol contracts have their ownership transferred to this contract, ensuring that
parameter changes (fee rates, treasury address, etc.) go through the timelock.
The owner proposes parameter changes; after the delay passes, the owner can execute them.
The guardian (or owner) can cancel pending proposals for emergency response.
The delay itself can only be changed via a governance proposal (self-call).
Security: The setDelay function uses the onlySelf modifier,
meaning it can only be called by the Governance contract itself -- i.e., through a proposal that targets
this contract. Delay must be between MIN_DELAY (1 hour) and MAX_DELAY (30 days).
Constructor
Parameter
Type
Description
_delay
uint256
Timelock delay in seconds (must be between 1 hour and 30 days)
_guardian
address
Guardian address for proposal cancellation
Proposal Struct
Field
Type
Description
target
address
Contract address to call
data
bytes
Encoded function call data
eta
uint256
Earliest execution time (block.timestamp + delay)
executed
bool
Whether the proposal has been executed
cancelled
bool
Whether the proposal has been cancelled
Functions
Function
Parameters
Returns
Access
propose(address, bytes)
target, data
uint256 proposalId
Owner
execute(uint256)
proposalId
--
Owner
cancel(uint256)
proposalId
--
Owner | Guardian
setDelay(uint256)
_delay
--
Self Only
setGuardian(address)
_guardian
--
Owner
setOwner(address)
_owner
--
Owner
getProposal(uint256)
proposalId
(address, bytes, uint256, bool, bool)
Public
Events
Event
Parameters
ProposalCreated
uint256 indexed id, address target, bytes data, uint256 eta
Generic token lock contract designed for multi-application use. Users lock IFR tokens
(with an optional lockType tag) and external resolvers query isLocked()
to gate access to features (e.g. premium content, voting weight, staking tiers).
Inherits OpenZeppelin's ReentrancyGuard and Pausable.
No rewards or vesting -- purely a lock/unlock mechanism with on-chain queryability.
Important: This contract must be set as feeExempt
on InfernoToken to prevent fee deductions on lock/unlock transfers. Otherwise, users will lose
tokens to fees when locking and unlocking.
Constructor
Parameter
Type
Description
_token
address
Address of the IFR token contract
_guardian
address
Guardian address for pause/unpause and guardian updates
LockData Struct
Field
Type
Description
amount
uint256
Total IFR locked by the user
lockedAt
uint256
Timestamp of last lock/increase
Functions
Function
Parameters
Returns
Access
lock(uint256)
amount
--
Public
lockWithType(uint256, bytes32)
amount, lockType
--
Public
unlock()
--
--
Public
lockedBalance(address)
user
uint256
Public
isLocked(address, uint256)
user, minAmount
bool
Public
lockInfo(address)
user
(uint256 amount, uint256 lockedAt)
Public
pause()
--
--
Guardian
unpause()
--
--
Guardian
setGuardian(address)
_guardian
--
Guardian
Reentrancy protection: Both lock() / lockWithType() (via internal _lock)
and unlock() use OpenZeppelin's nonReentrant modifier. Locking is also gated by whenNotPaused,
but unlock() always remains available even when paused so users can recover their funds.
Manages the 40M IFR Builder Ecosystem Pool (4% of total supply). Two mechanisms:
milestone-based unlocking (governance records milestones that unlock IFR allocations) and
lock-triggered creator rewards (when a user locks IFR for a builder's product, the builder accrues
a reward of lockAmount × rewardBps / 10000 from the pool).
Rewards vest linearly over 6–12 months with optional cliff.
Project policy (2026-10-03): the lock-triggered path is not used and no reward is active; pilot partners will be paid only for verified checkout redemptions through capped recordMilestone settlements.
Record milestone completion, unlock IFR allocation
recordLockReward(partnerId, lockAmount, wallet)
Record a user lock → creator reward (lockAmount × effectiveBps / 10000). Anti-double-count per wallet.
setRewardBps(newBps)
Update reward rate (500–2500 bps)
setAnnualEmissionCap(newCap)
Update annual emission cap (1M–10M IFR)
setAuthorizedCaller(caller, status)
Whitelist an address (e.g. backend wallet) to call recordLockReward
setIFRLock(ifrLockAddress)
Set IFRLock reference for algorithmic emission throttle
setPartnerBeneficiary(partnerId, newBeneficiary)
Change builder payout address
setPartnerAllocation(partnerId, newMax)
Adjust builder allocation cap
finalizeMilestones(partnerId)
Lock milestones — no further milestone unlocks
Permissionless Functions
Function
Description
claim(partnerId)
Transfer vested IFR to builder beneficiary (ReentrancyGuard)
claimable(partnerId)
View: currently claimable amount
vestedAmount(partnerId)
View: total vested so far
partners(partnerId)
View: full builder data struct
pendingBalance()
View: IFR balance held by vault
walletRewardClaimed(wallet, partnerId)
View: whether a wallet has been rewarded for a builder
authorizedCaller(address)
View: whether an address is whitelisted for recordLockReward
Key Design
MUST be feeExempt on InfernoToken for correct claim transfers
Governance-controlled parameters with enforced min/max bounds
Annual emission cap resets every 365 days
Milestone replay protection via milestoneDone mapping
AuthorizedCaller whitelist:recordLockReward callable by admin OR whitelisted backend wallet
Anti-double-count: each (wallet, partnerId) pair can only be rewarded once
Algorithmic emission throttle (inactive on Mainnet): when setIFRLock is configured, reward rate scales from rewardBps down to MIN_REWARD_BPS (500) as global lock ratio rises from 1% to 50%; Mainnet ifrLock is unset (address(0)), so the flat rewardBps of 1500 is the configured contract parameter. Rewards are currently disabled (Lane 4 model B: pilot partners only, verified checkout redemptions, Governance-activated).
SafeERC20 for all token transfers
FeeRouterV1
165 LOC
contracts/FeeRouterV1.sol
Handles protocol-level fees on IFR swaps. Accepts optional EIP-712
discount vouchers issued by the Points Backend.
Adapter whitelist: only governance-approved adapters can receive swap calls
Pause: governance can halt all swaps in emergency
Owned by Governance timelock
LP Pair (IFR/WETH)
Uniswap V2
Created by Uniswap V2 Factory
The IFR/WETH liquidity pair on Uniswap V2. This is not a custom contract but a standard
UniswapV2Pair created by the factory during the LP pairing step. It holds
~195M IFR (from Treasury Safe + Community Safe, Plan B) paired with ETH, providing the primary
trading market for the token. ✅ BootstrapVaultV3 FINALIZED 05.06.2026 23:51 UTC — Bootstrap ENDED — 0.030 ETH raised — LP live on Uniswap V2.
Note: The LP Pair is a standard Uniswap V2 contract, not an Inferno-authored contract.
It is included here as the 10th on-chain component because it holds a significant portion of
the token supply and is critical infrastructure for the protocol.
On-chain registry for verified IFR builders and integration partners.
Registration and removal controlled exclusively by Governance (Timelock).
Used by the Telegram Bot for topic access control and for PartnerVault pilot-partner eligibility (rewards not active).
Key Functions
Function
Access
Description
registerBuilder(wallet, name, url, category)
Governance
Register a new builder with metadata
removeBuilder(wallet)
Governance
Deactivate a builder
updateBuilder(wallet, name, url, category)
Governance
Update builder metadata
isBuilder(wallet)
Public
Check if address is an active builder
getActiveBuilders()
Public
Get all active builder addresses
getBuilderInfo(wallet)
Public
Get full builder metadata
Categories
Each builder must be registered with one of 4 valid categories:
The Telegram Bot reads isBuilder(wallet) to determine
Builder tier access (Dev & Builder topic).
PartnerVault pilot partners are drawn from this registry (rewards not active).
CommitmentVault
feeExempt Active
contracts/vault/CommitmentVault.sol
Irrevocable token lock with 4 condition types (TIME_ONLY, PRICE_ONLY, TIME_OR_PRICE, TIME_AND_PRICE). Auto-unlock 30 days after condition met. P0 immutable after Bootstrap. Owner: Governance (TreasurySafe 3-of-5).
Native-ETH fee execution controller. FeeRouterV1 is configured to send the ETH fee from routed swaps to this contract. When the controller holds at least its configured trigger amount, permissionless execute() attempts a 50/50 ETH allocation: buy IFR to BurnReserve and add IFR+ETH liquidity. Without an IFR balance, the LP half falls back to another buyback. Since Proposal #21 (05.10.2026) the 1% IFR pool fee also goes to this contract; the IFR previously held by FeeRouterV1 was recovered to the Treasury Safe on 07.10.2026 (Proposals #22/#23).