[tracker] Mainnet + BenzoNet L1 — post-deploy hardening & production-readiness

[akash-mondal]

Context

Benzo's Avalanche C-Chain mainnet (43114) deploy went live on 2026-07-09: the full eERC converter stack (10 contracts) is deployed wrapping real Circle USDC (tokenId 1) / EURC (tokenId 2), the Groth16 phase-2 ceremony completed, the auditor key is set on-chain, all 10 contracts are Snowtrace-verified, and the CCTP onramp was proven end-to-end. That deploy workstream is done — see the now-closed #120 (network wiring + deploy:mainnet guardrails + initial auditor custody), #121 (production ceremony + regenerated verifiers), #122 (README + go/no-go), and master tracker #123.

Source of truth for the current state:

• docs/MAINNET_GO_NO_GO.md — GO recorded 2026-07-09, with the remaining post-deploy items.
• contracts/deployments/avalanche.json — live mainnet manifest (real tx hashes / block numbers / verifiedAt).
• contracts/deployments/benzonet.json — BenzoNet L1 (68420) manifest.
• README.md "What remains" + "Honest limitations".

This tracker collects the genuinely-open follow-up work those documents flag as not-yet-done: mainnet post-deploy hardening (admin custody, external audit, onramp, open ceremony) and BenzoNet L1 production-readiness (validators, read-privacy, gas runway), plus a license-compliance checklist. It is not a re-plan of the completed deploy — anything already shipped in #120–#123 is deliberately excluded.

These are planning issues only — filing or working them performs no deployment, no ceremony, and no key operations.

Children

Mainnet C-Chain (43114) hardening

• security(mainnet): transfer Ownable admin off the hot deploy key to a multisig / cold wallet #155 — security(mainnet): transfer Ownable admin off the hot deploy key to a multisig / cold wallet (top priority)
• security(mainnet): commission an independent security audit of the mainnet eERC deployment #156 — security(mainnet): commission an independent security audit of the mainnet eERC deployment
• security(mainnet): harden the CCTP onramp beyond the single 0.1 USDC test burn #157 — security(mainnet): harden the CCTP onramp beyond the single 0.1 USDC test burn
• ceremony: run an open multi-party Groth16 phase-2 ceremony with independent external participants #158 — ceremony: run an open multi-party Groth16 phase-2 ceremony with independent external participants
• security(mainnet): auditor key custody hardening + on-chain rotation runbook #159 — security(mainnet): auditor key custody hardening + on-chain rotation runbook

BenzoNet L1 (68420) production-readiness

• infra(l1): move BenzoNet off a single validator to a multi-validator PoA set #160 — infra(l1): move BenzoNet off a single validator to a multi-validator PoA set
• infra(l1): enable validatorOnly read-privacy for a production BenzoNet #161 — infra(l1): enable validatorOnly read-privacy for a production BenzoNet
• infra(l1): BenzoNet gas/fee sustainability + P-Chain runway guardrails #162 — infra(l1): BenzoNet gas/fee sustainability + P-Chain runway guardrails

Cross-cutting

• docs(compliance): eERC Ecosystem-License v1.1 compliance checklist for all mainnet/L1 deliverables #163 — docs(compliance): eERC Ecosystem-License v1.1 compliance checklist for all mainnet/L1 deliverables

Out of scope (already shipped — see closed issues)

• Mainnet network wiring + guard-railed deploy:mainnet + initial setAuditorPublicKey — [contracts] Avalanche C-Chain (43114) network wiring, guard-railed deploy:mainnet, and mainnet auditor custody #120.
• Production Groth16 phase-2 ceremony (single-coordinator 3-machine run) + regenerated verifiers — [zk] Production Groth16 trusted-setup ceremony + regenerated verifiers #121.
• Snowtrace source-verification of the 10 mainnet contracts — done (avalanche.json verifiedAt).
• BenzoNet eERC stack deploy + public RPC (rpc.benzo.space) + Blockscout explorer — Redeploy the identical eERC stack to BenzoNet and verify on its explorer #32 / Stand up a token-gated Blockscout explorer for BenzoNet #29.

Note

• BenzoNet manifest contracts are currently verified: false (not source-verified on the Blockscout explorer). This is folded into the multi-validator re-stand issue rather than filed standalone.