Migrating PEN to Base

This post opens a community discussion about migrating PEN from the Pendulum parachain to Base. It is not an executable governance proposal and it does not authorize a deployment. Its purpose is to collect feedback on the direction, migration model, governance design, and tradeoffs before a final proposal and implementation specification are presented.



# ## Summary



The team is evaluating a one-way migration of PEN to Base as a fixed-supply ERC-20 token.



The current working design is:



* A new PEN ERC-20 deployed on Base.
* A fixed maximum supply of 150,000,000 PEN (see the Supply model section for how this relates to today's on-chain figure).
* 18 decimals on Base, rather than PEN's current 12 decimals on Pendulum.
* The full supply created once at deployment and held in a Base migration vault.
* No further mint function, no owner mint authority, and no upgradeable proxy.
* A holder-initiated migration that removes transferable PEN from circulation on Pendulum and releases the corresponding PEN on Base.
* A 3-of-4 attestor model to verify finalized Pendulum migration events before the Base vault releases tokens.
* No Base-to-Pendulum bridge.



The intended economic conversion is **1 PEN on Pendulum for 1 PEN on Base**. Moving from 12 to 18 decimals is an exact technical conversion of base units by 10^6; it does not change a holder's PEN amount, ownership share, or the maximum supply.



The current technical planning document is available here:



https://github.com/pendulum-chain/pendulum/blob/fd7b64bbf50b5c3e1d257203eaf763f6984f72da/docs/pen-base-migration-prd.md




# ## How this discussion will be used



This discussion will remain open for at least two weeks. The team will publish a response to the main feedback themes and then bring a formal governance proposal with the final parameters, including the migration window, attestor operators, caps, guardian arrangements, quorum implementation, and end-of-window policy.



Nothing described here is irreversible until that formal proposal has been approved and the tested migration contracts and operational setup are ready for launch.



# ## Why consider this migration?



PEN currently exists as the native token of the Pendulum parachain in the Polkadot ecosystem. Pendulum was built there for good reasons and an alignment on cross-chain interoperability, upgradeability and onchain governance as main pillars of a successful decentralized ecosystem.



The question now is which environment gives PEN the best conditions to develop as a project token. Polkadot is concentrating its efforts on its core products and infrastructure. Pendulum's assessment is that, for PEN, an EVM ecosystem offers broader access to tooling around wallets, liquidity, governance, bridges, analytics, lending, and broader DeFi applications that token holders and ecosystem participants commonly use.



Base is the proposed destination because it gives EVM users a familiar wallet setup and immediate entry into an active, battle-tested EVM economy with an advanced stablecoin ecosystem including lots of non-USD stablecoin issuers like Avenia’s BRL and Circle’s EURC. The DEXs, lending markets, wallet integrations, governance tools, bridges, analytics, explorers, and treasury systems that users and builders need are already live. The migration would put PEN and its community inside that ecosystem from day one, rather than requiring the project to first build the surrounding tooling.



For Pendulum, Base is especially compelling because we see it as the EVM ecosystem with the best and most liquid non-USD stablecoin environment today. That makes it a strong fit for Pendulum's mission to bring onchain FX to life: liquid, accessible markets between stable currencies are the foundation for useful onchain FX.



Moving PEN to Base would provide:



* Immediate access to battle-tested EVM wallets, DEXs, lending markets, bridges, governance, analytics, treasury, and other DeFi tools.
* A direct route into a liquid non-USD stablecoin environment aligned with Pendulum's onchain-FX mission.
* A simpler path for users and partners already operating on EVM networks.
* A cleaner setup for Vortex-related buybacks where flows are routed within EVM networks.
* More transparent supply tracking through standard ERC-20 tooling and Base explorers.



This direction also aligns with the project's DEX-first strategy:



[<u>https://pendulum-chain.medium.com/decentralised-by-design-why-defi-and-pen-grows-stronger-with-a-dex-first-strategy-50c33559fcc2</u>](https://pendulum-chain.medium.com/decentralised-by-design-why-defi-and-pen-grows-stronger-with-a-dex-first-strategy-50c33559fcc2)



# ## Proposed migration design



This is a one-way token migration, not a two-way bridge.



When a holder wants to migrate:



1. The holder calls a migration function on Pendulum and enters a Base address.
2. The holder's freely transferable PEN is removed from Pendulum circulation. The current recommendation is to burn it; the final governance proposal will confirm the Pendulum-side implementation.
3. Pendulum emits a migration event containing a unique nonce, the recipient Base address, and the amount.
4. Attestor services independently observe the event after Pendulum has reached relay-chain finality.
5. When the Base migration vault receives three matching approvals for that same nonce, recipient, and amount, it releases the corresponding PEN to the holder's Base address.



The migration accepts only freely transferable PEN. Staked, locked, vesting, reserved, or otherwise encumbered balances must first become transferable. The migration UI and documentation will show these constraints before a holder initiates the transaction.



The action is irreversible. The UI should include clear confirmations, EIP-55 checksum validation for Base addresses, contract-address warnings, and a recommendation that large holders make a small test migration first.



# ## Supply model



The current working supply model is:



* Maximum supply: 150,000,000 PEN, pending final canonical-supply confirmation.
* Base decimals: 18.
* Full maximum supply minted once at deployment into the migration vault.
* No future mint authority, owner mint function, or upgradeable token proxy.
* The vault balance excluded from circulating-supply reporting.



\`totalSupply()\` on Base would equal the full maximum supply from deployment. Only tokens released from the migration vault would count as circulating supply. The formal proposal will include the confirmed supply figure and the tracker methodology used to distinguish total from circulating supply.



One detail we want to state openly: Pendulum's live on-chain issuance today is slightly below 150 million (approximately 149.93M). That figure is an untidy artifact of the chain's history (fee burns and similar); it is not a meaningful tokenomics number. The Base token is therefore deliberately set to a clean, canonical 150,000,000, which is the right constant for trackers, integrations, and an immutable token contract.

The difference — roughly 67,000 PEN, about 0.045% of supply — behaves as follows:

* It can never be released by the migration. Releases require a matching burn on Pendulum, and no burns can exist for tokens that were never in circulation there. It sits inert in the vault.
* It is excluded from circulating supply throughout the migration.
* At the end of the migration window it moves, together with any unmigrated remainder, to a community-treasury-controlled address via the same governed, timelocked process. It is not allocated to the team or any individual; only a public governance decision can ever spend it.

The net effect is that every holder's conversion stays exactly 1:1, and the small rounding difference ends up under community control rather than baked into the token as an odd decimal forever. The formal proposal will include the confirmed supply figure and the tracker methodology used to distinguish total from circulating supply.



# ## Migration window and unmigrated supply



Our analysis of the current vesting schedule indicates that essentially all time-locked PEN unlocks within a few months, so a migration window as short as three months is technically sufficient for token unlocks. We are weighing that against a longer earliest close date — for example six months — to reduce time pressure on holders and exchanges and to keep the attestation system running only as long as it is genuinely needed. We welcome feedback on the right balance.



The key point is that an earliest close date is not an automatic sweep. No unmigrated PEN would move simply because the window has elapsed. Any extension of the window or movement of remaining vault balance would require a separate governance decision and a timelocked execution after the agreed earliest close date.



Before any remainder is moved, governance would need to decide between options such as extending the migration window, allocating the remainder to a treasury-controlled address, burning it, or another explicitly approved path.



We welcome feedback on whether the default should be six months, 12 months, or open-ended, and on what safeguards should apply before a close decision can be made.



# ## Attestors and security model



The proposal does not use an on-chain Polkadot light client on Base. For a finite, one-way migration, the proposed tradeoff is a 3-of-4 attestor system with strict limits, monitoring, and a rapid pause capability.



Each attestor observes finalized Pendulum migration events from its own node and submits an on-chain approval to the Base migration vault. The vault releases tokens only after three distinct attestors approve the identical migration tuple: nonce, recipient, and amount.



The initial attestors may be team-operated because Pendulum currently has limited external node and RPC operation. This is a meaningful trust tradeoff, not a claim of trustlessness. The preferred direction is to add genuinely independent external operators as the system matures.



The final proposal must publish the initial security parameters and operators, including:



* The attestor set and the infrastructure-independence arrangements.
* Per-release and rolling 24-hour caps, with a target that a full attestor-quorum compromise is limited to a pre-agreed amount before a pause can take effect.
* The fast pause guardian Safe and its threshold.
* A timelock of at least 48 hours for unpausing, cap changes, attestor changes, and other parameter updates.
* Independent monitoring that verifies each Base release against a finalized Pendulum event and alerts on any inconsistency or attestor outage.



These safeguards do not remove the 3-of-4 trust assumption. They limit the potential damage of an attack, make it observable, and give the community time to react to governance-controlled changes.



# ## Governance after migration



The intended post-migration model is hybrid:



* An OpenZeppelin Governor and Timelock on Base for Base-side contracts and treasury parameters.
* Tally as the interface for Base-side on-chain governance.
* Snapshot for broader off-chain or cross-chain community decisions.
* An elected Safe to execute Snapshot-approved decisions where direct on-chain execution is not available.
* The existing technical committee for Pendulum-side runtime actions while the Pendulum chain continues to run.



The migration vault must neither exercise voting power nor make quorum unobtainable. This is a design requirement, not something that follows automatically from deploying an ERC20Votes token and a standard Governor. The final implementation must explicitly define and audit the circulating-supply and quorum mechanism, including how the vault is excluded from both Snapshot and on-chain governance calculations.



Pendulum-side runtime authority should remain narrowly scoped to security patches and emergency actions for as long as the chain operates. It should not create discretionary control over Base-side PEN or its treasury.



# ## DEX-first strategy and MEXC



The team does not currently intend to fund or pursue a new MEXC listing for the Base PEN token. This follows the DEX-first strategy: prioritize decentralized liquidity and DeFi-native growth first, then reconsider centralized-exchange listings only when they have a clear strategic case.



An exchange controls its own support for a token migration and any future listing. Holders should not assume that PEN held on MEXC, or on any other centralized exchange, will be migrated automatically. Unless an exchange expressly announces a supported process, a holder should expect to withdraw to self-custody and use the public migration route. Specific guidance for exchange-held PEN must be communicated before the migration window opens.



This is an important tradeoff. Base can improve access to EVM wallets and DEX infrastructure, but the new Base token may initially be accessible only through decentralized liquidity venues rather than a centralized exchange. We want explicit community feedback on that choice.



# ## Scope and what remains unchanged



This discussion does not propose:



* A two-way bridge between Base and Pendulum.
* A change to the 1:1 PEN economic conversion, maximum supply, or holder ownership share through the decimal change.
* Migration of non-PEN assets, including Spacewalk-wrapped and XCM assets.
* Automatic migration of staked, locked, or vesting balances before they become transferable.
* An immediate shutdown or decommissioning of the Pendulum chain.
* A new centralized-exchange listing funded as part of the migration.
* A new PEN staking program on Base.



Any longer-term decision about the operating model or future sunset of the Pendulum chain should be discussed separately.



# ## Proposed rollout



The likely rollout would be:



1. Collect community feedback through this discussion.
2. Publish the team's response and a formal governance proposal resolving the open parameters.
3. Deploy and test the migration flow on Foucoco and Base Sepolia.
4. Complete internal security reviews, key-management setup, monitoring, and operational drills.
5. Deploy on mainnet with conservative caps and a limited soft launch for team and invited large holders.
6. Open the migration UI publicly after the soft-launch checks pass.
7. Submit tracker updates so total and circulating supply are displayed correctly.
8. Hand Base-side controls from the bootstrap setup to the agreed governance structure.



# ## Questions for the community



We would especially like feedback on the following:



1. Do you support migrating PEN from Pendulum to Base in principle?
2. Is Base the right destination for PEN, or should another EVM ecosystem be considered?
3. Is the proposed 1:1, one-way migration model clear and acceptable?
4. Should the migration window have a six-month earliest close date, a 12-month earliest close date, or remain open-ended?
5. What should happen to unmigrated supply after the migration window, if anything?
6. Is a 3-of-4 attestor model acceptable for this finite migration, provided its identities, caps, guardian, timelock, and monitoring arrangements are published before launch?
7. Should independent external attestors be required before public launch, or is a team-operated setup acceptable during an initial migration period?
8. Do you agree with the DEX-first approach, including not funding a new MEXC listing for the Base token at this stage?
9. Does the proposed hybrid governance model make sense, and what conditions should the final circulating-supply quorum design meet?
10. Which holder groups, integrations, exchange arrangements, or operational edge cases should the team address before submitting a formal proposal?



Please share questions, concerns, and alternatives in this discussion. The goal is a migration path that is transparent, understandable, and aligned with the long-term interests of PEN holders.

#38 duplicate - pls. ignore