Technical Overview

Architecture

The ENRG Protocol consists of seven independent components, each with a clearly defined responsibility. This separation ensures cryptographic trust, implementation independence, and long-term protocol stability.

On-Chain Programs

enrg-mvp — Core Protocol

Core program responsible for:

• Verifying oracle Ed25519 signatures via solana_instructions_sysvar::get_instruction_relative
• Minting SRC tokens via CPI to SPL Token program
• Managing the Energy Vault (buyback, staking, DAO, emergency funds)
• Device lifecycle management (8 states per ADR-0005)
• Enforcing mint constraints (max supply, nonce, timestamp, power limits)
• Staking, unstaking, and reward distribution
• Founder vesting and buyback & burn

enrg-profile — Energy Profile

Manages energy producer profiles:

• Participant profiles (PDA per wallet)
• Device registration and metadata
• 30-day rolling energy window (update_energy_window_u128)
• Rated power configuration (determines max energy per mint)

enrg-mvp calls enrg_profile::cpi::record_production during each mint via declare_program! to update the producer's energy profile. The profile's rated_power determines the maximum energy per mint.

Instructions

Account Structure

EnergyProducer PDA (enrg-mvp)

seeds: ["producer", authority_pubkey]

{
  authority:      Pubkey,       // device owner
  device_id:     String (32),  // unique identifier
  nonce:         u64,          // replay attack protection
  energy_wh:     u64,          // total accumulated energy
  timestamp:     i64,          // last confirmation time
  max_power_w:   u64,          // nameplate power
  signature:     [u8; 64],     // last signature
  state:         DeviceState,  // 8-state lifecycle
  is_initialized: bool,
}

EnergyProfile PDA (enrg-profile)

seeds: ["profile", authority_pubkey]

{
  authority:      Pubkey,
  rated_power:    u64,         // W
  device_model:   String (32),
  manufacturer:   String (32),
  country:        String (32),
  energy_window:  [u128; 30],  // 30-day rolling window
  window_index:   u8,
  total_energy:   u128,
  is_initialized: bool,
}

Vault PDA (enrg-mvp)

seeds: ["vault"]

{
  mint:           Pubkey,      // SRC token mint
  authority:      Pubkey,      // deployer
  is_initialized: bool,
}

Fund PDAs (enrg-mvp)

seeds: ["buyback" | "staking" | "dao" | "emergency", vault_pubkey]

{
  vault:          Pubkey,
  total_deposits: u64,
  is_initialized: bool,
}

Device Lifecycle (ADR-0005)

Every device in the ENRG Protocol follows a cryptographically enforced state machine with 8 states. Each state has clearly defined behavior, and transitions are only possible through authorized instructions.

UNREGISTERED
    │
    ▼
REGISTERED     ← register_device()
    │
    ▼
CLAIMED        ← claim_device()
    │
    ▼
PROVISIONED    ← provision_device()
    │
    ▼
ACTIVE         ← activate_device()
    │
    ├── (suspicion) → QUARANTINE    ← quarantine_device()
    │                     │
    │                     └── → ACTIVE  ← release_from_quarantine()
    │
    ├── (maintenance) → MAINTENANCE
    │
    └── (removal) → REVOKED         ← revoke_device()

Source: ADR-0005: Device States

Oracle Flow

1. Device measures energy every 10 minutes using PZEM-004T or industrial Modbus/RS485 meter
2. Device signs data packet {device_id, timestamp, energy_wh, nonce} with Ed25519 private key (stored in ATECC608 Secure Element)
3. Device sends signed packet to Oracle API (POST /api/v1/proof/submit)
4. Oracle verifies Ed25519 signature via solana_instructions_sysvar::get_instruction_relative
5. Oracle validates monotonic nonce (replay protection) and timestamp (MAX_PROOF_AGE = 1 hour)
6. Oracle checks device status in Device Registry (must be ACTIVE)
7. Oracle aggregates verified readings into a pool. When pool reaches 1 MWh threshold, initiates minting
8. Oracle calls mint_energy on enrg-mvp program with signed OracleReport
9. Smart contract verifies oracle signature, validates producer PDA, calculates max_energy_wh = max_power_w * 10 / 60
10. SRC tokens minted via CPI to SPL Token program: 85% to producer, 15% distributed to vault funds
11. enrg-profile updated via CPI: record_production updates 30-day rolling energy window

Security

Ed25519 Verification

All device and oracle signatures are verified on-chain via solana_instructions_sysvar::get_instruction_relative. This reads the serialized Ed25519 instruction from the transaction's instruction sysvar and verifies the public key, message, and signature without trusting any off-chain component.

Replay Protection

• Monotonic nonce — each device has an incrementing counter. Duplicate nonces are rejected.
• Timestamp validation — MAX_PROOF_AGE = 1 hour. Proofs older than 1 hour are rejected.
• Rate limiting — Oracle API: 200 req/min general, 100 req/min proof submission, 20 req/min device registration.

STRIDE Threat Model

Device Trust Levels

Energy Reputation Score (ERS)

Each producer accumulates a reputation score based on:

• Duration of flawless operation
• Volume of verified energy
• Absence of anomalies in the generation profile

High ERS provides advantages in pool reward distribution and access to premium ENRG Market features. Sudden spikes, night-time generation, and profile anomalies trigger automatic quarantine.

Oracle API

Base URL: https://enrg-oracle.onrender.com/api/v1

Tokenomics

Fee Distribution (15% of Every Mint)

• 20% Buyback & Burn — constant deflationary pressure via buyback_and_burn instruction
• 40% Staking Rewards — distributed to SRC stakers proportionally to their share
• 30% DAO Reserve — governed by token holder voting
• 10% Emergency Fund — protocol insurance for unforeseen events

Source Multipliers

Mint Energy Formula

max_energy_wh = producer.max_power_w * 10 / 60
total_mint    = energy_wh * 10^9  // convert to base units with 9 decimals
producer_share = total_mint * 85 / 100
fee            = total_mint * 15 / 100

// Fee distribution:
buyback   = fee * 20 / 100
staking   = fee * 40 / 100
dao       = fee * 30 / 100
emergency = fee * 10 / 100