USDC-funded ENS renewals from universal deposit wallets.
How it works · Contracts and trust · Pricing · Deployment evidence
Warning
Namepass is deployed on testnets only. Its contracts have not had an external audit. Do not send mainnet funds to a testnet deposit address.
Namepass lets anyone fund an ENS name without owning it. Each normalized .eth label maps to a
universal deposit wallet within one deployment set. A funder sends the configured USDC to that
wallet. Any executor can then convert its balance into renewal time at ENS's on-chain price.
The payment route is permissionless: it does not depend on the Namepass website or its automation.
The October 23, 2026 testnet deployment replaced the September 22 factory. Its deposit addresses differ from every previous deployment, and the previous addresses are retired. Derive addresses from the current factory before funding them.
flowchart LR
U[Funder] -->|USDC| W[Name's deposit wallet]
W -->|Sepolia payment| F[NamepassFactory, also the hub gateway]
W -->|Source-chain burn| C[Circle CCTP V2]
C -->|Attested claim| F
F -->|plan| A[View-only ENS adapter, selected by the timelock]
F -->|exact approval and call| E[ENS renewal contract]
- Normalize the ENS name. Call
NamepassFactory.predictWallet(label)with the label, such asvitalik, without.eth. CREATE2 derives the same wallet address on each chain in the current deployment set. - Send the configured USDC to that wallet on a supported testnet. Arc Testnet also accepts its native USDC through the wallet.
- Anyone can call
NamepassFactory.renewto process the wallet balance. On Ethereum Sepolia the wallet itself pays ENS. On the other supported chains the wallet burns through Circle CCTP V2 to the factory's own address on Sepolia. - After Circle attests a burn, anyone can submit its message and attestation to
NamepassFactory.completeCCTPon Sepolia. The factory asks the active adapter for a plan and settles the renewal.
The executor receives a fixed 0.10 USDC allowance on successful settlement. Circle's actual fee, when applicable, also comes from the processed amount. Balances remain separate by chain. A payment above Circle's per-message burn limit is processed in slices.
The deposit wallet is an ERC-1167 proxy derived from the factory. It has no private key to hold or
recover. The full wallet address is the funding target. Optional <label>.namepass.eth resolution
is separate from payment execution.
| Contract | Role |
|---|---|
| NamepassFactory | Derives wallets, authenticates funding, completes CCTP claims, settles payments, and selects the adapter through its governance executor |
| ENSV2RenewalAdapter | View-only: selects the ENS renewal path, calculates the exact duration and returns the exact call |
| NamepassResolver | Provides optional ENSIP-10 and CCIP-Read resolution |
Sourcify shows matching deployed bytecode and source for the October 23 contracts:
| Contract | Network | Verified source |
|---|---|---|
| NamepassFactory | Ethereum Sepolia | Sourcify |
| NamepassFactory | Base Sepolia | Sourcify |
| NamepassFactory | Arbitrum Sepolia | Sourcify |
| NamepassFactory | Arc Testnet | Sourcify |
| ENSV2RenewalAdapter | Ethereum Sepolia | Sourcify |
| NamepassResolver, namepass.eth on Sepolia | Ethereum Sepolia | Sourcify |
These links show source matches, not a security audit. See the deployment manifest and the resolver record for the underlying checks.
The factory is not an upgradeable proxy. Its initialized payment route is fixed. It fixes its payment token and Circle contracts at initialization and holds no funds between calls. The adapter is view-only, has no owner and immutable ENS contract addresses. There is no owner sweep from deposit wallets.
The factory's governance executor can activate a new adapter after its timelock requirements are met. The factory then approves that adapter's named spender for exactly the quoted price of one payment and requires that exactly that price left, so a replacement adapter can direct at most one payment's price. The testnet timelock is wallet-controlled. Mainnet is designed to use an ENS governance executor, but no mainnet deployment has occurred. The factory owner can change CCTP finality settings. A caller supplies a fee ceiling for one CCTP call. Neither setting changes the fixed factory payment route. Unsupported tokens sent to a wallet can be permanently lost.
Direct renewal is atomic. A CCTP claim mints and renews in one transaction. If settlement fails, the claim reverts and the attested message can be submitted again. The route depends on ENS, Circle, USDC, and the configured contracts. See contract boundaries and engineering constraints for the exact rules.
The adapter reads the selected ENS renewer's current oracle. It calculates the longest whole-second
duration that the available USDC can buy after fees, handling ENS discount tiers and integer
rounding. ENS prices the renewal again inside its own renew, and the factory requires the actual
token charge to equal the adapter's price. A mismatch reverts settlement. The adapter supports
both migrated ENS V2 names and premigrated V1 reservations.
These checks run on-chain. A displayed estimate does not replace the selected ENS contract's price at execution.
The October 23 deployment uses one factory address on Ethereum Sepolia, Base Sepolia, Arbitrum
Sepolia, and Arc Testnet, and the beta application serves it. The
deployment record contains the addresses, receipts, source verification
and the canary deposits on every chain, including native and ERC-20 Arc deposits. On Sepolia,
<label>.namepass.eth resolves through the wildcard resolver to the same deposit address the
factory derives, and the first resolution activates the label. The mainnet namepass.eth record
predates the October 23 factory. None of this evidence is a security audit.
For the protocol's full contract rules, see contract design and engineering constraints. For local setup and tests, see CONTRIBUTING.md.
Namepass is licensed under the MIT License. Third-party notices remain with their respective files.