# @tokenize.it/contracts

> Tokenize.it smart contracts for company tokenization, crowdinvesting, private offers, employee participation, dividend distributions, exits, co-investments and token lockups

Latest version **7.1.0** (published 2026-07-15) · AGPL-3.0 license · 0 weekly downloads

## Install

```sh
npm install @tokenize.it/contracts
pnpm add @tokenize.it/contracts
yarn add @tokenize.it/contracts
bun add @tokenize.it/contracts
```

## Health

**Score 60/100 (C)** — status: active.

Positive: has types; no vulnerabilities; high maintenance score; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 7.1.0 |
| Published | 2026-07-15 |
| First published | 2023-03-09 |
| Weekly downloads | 0 |
| License | AGPL-3.0 |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 3 |
| Unpacked size | 3 MB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 27 |
| Maintainers | malteish, gashawk, tokenizeit |
| Keywords | evm, ethereum, smart contract, tokenize.it |

## Links

- npm: https://www.npmjs.com/package/@tokenize.it/contracts
- Repository: https://github.com/corpus-io/tokenize.it-smart-contracts
- Issues: https://github.com/corpus-io/tokenize.it-smart-contracts/issues
- npm.io page: https://npm.io/package/@tokenize.it/contracts

## Dependencies (3)

- [@opengsn/contracts](https://npm.io/package/@opengsn/contracts.md) 2.2.5
- [@openzeppelin/contracts](https://npm.io/package/@openzeppelin/contracts.md) 4.9.6
- [@openzeppelin/contracts-upgradeable](https://npm.io/package/@openzeppelin/contracts-upgradeable.md) 4.9.6

## Recent versions

- 7.1.0 (latest) — 2026-07-15
- 7.1.1-alpha1 (alpha) — 2026-08-18
- 7.1.0-beta1 (beta) — 2026-06-01
- 7.0.0-alpha3 — 2026-04-20
- 6.1.0 — 2025-12-19
- 6.0.0-beta — 2025-11-07
- 5.0.1 — 2024-01-05
- 5.0.0 — 2023-12-14
- 5.0.0-beta2 — 2023-12-11
- 5.0.0-beta1 — 2023-12-11
- 5.0.0-alpha3 — 2023-12-04
- 5.0.0-alpha2 — 2023-11-28
- 4.2.0-beta.0 — 2023-08-17
- 4.1.0-alpha.0 — 2023-05-19
- 4.0.1 — 2023-03-21
- … 2 more at https://npm.io/package/@tokenize.it/contracts/versions

## README

# tokenize.it

These smart contracts implement [tokenize.it](https://tokenize.it/)'s tokenized cap table management. Using tokenize.it, it is possible to:

- generate tokens that grant economical rights to the token holder
- sell these tokens to investors either publicly or privately
- distribute tokens to employees or partners, either directly or through a vesting contract
- distribute proceeds (e.g. dividends) to token holders based on a snapshot
- enable token exits, allowing holders to redeem their tokens for currency
- hold tokens in a timelock that can participate in distributions and exits before unlocking
- coinvest with trusted lead investors. The coinvestor gets the chance to access deal terms that might otherwise not be available to them, and the lead investors get the chance to share in the profits of the coinvestor.

# Getting Started

## ... for usage

```
yarn add @tokenizeit/contracts
```

or

```
npm install @tokenizeit/contracts
```

## ... for development

1. clone repository: `git clone --recurse-submodules git@github.com:corpus-ventures/tokenize.it-smart-contracts.git`
2. enter project root folder: `cd tokenize.it-smart-contracts`
3. if repository was cloned without submodules, init submodules now (not necessary if cloning command above was used): `git submodule update --init --recursive`
4. init project: `yarn install`
5. run tests: `yarn test`

If you are missing dependencies:

- node/npm:
  - install [nvm](https://github.com/nvm-sh/nvm)
  - `nvm install 18`
  - `nvm use 18`
- yarn: `npm install yarn`
- foundry: [install guide](https://book.getfoundry.sh/getting-started/installation)

More dev information can be found here:

- [testing](docs/testing.md).
- [deployment](docs/deployment.md).
- [npm publishing](docs/npm_publishing.md).

# Main Concept

1. Using tokenize.it's legal approach, a company can create tokens that grant economical rights to the token holders. The best smart contract to create these tokens is [Token.sol](contracts/Token.sol)
2. Funds are raised through selling of these tokens:
   - a customized deal to a specific investor can be realized through the [PrivateOffer.sol](contracts/PrivateOffer.sol) contract.
   - crowdinvesting, which is open to everyone meeting the requirements, is done through the [Crowdinvesting.sol](contracts/Crowdinvesting.sol) contract
3. Employee participation is easy:
   - direct distribution of tokens (does not need another smart contract)
   - vesting can be realized using the [Vesting.sol](./contracts/Vesting.sol) contract
4. Secondary market trading between investors:
   - investors can trade existing tokens between each other using the [TokenSwap.sol](contracts/TokenSwap.sol) contract
   - unlike PrivateOffer and Crowdinvesting which mint new tokens, TokenSwap facilitates the exchange of already-issued tokens between parties at a preset price
5. Co-invested positions:
   - [CoinvestedPosition.sol](contracts/CoinvestedPosition.sol) holds tokens on behalf of a co-investor and distributes sale proceeds between lead investors (carry) and the co-investor
6. Distributing proceeds and exits:
   - dividends or other proceeds can be distributed proportionally based on a token snapshot using [Distribution.sol](contracts/Distribution.sol)
   - a company can set up an exit contract [Exit.sol](contracts/Exit.sol), allowing token holders to redeem their tokens for currency at a fixed price
   - the exit for a given token is registered in the global [GlobalTokenExitRegistry.sol](contracts/GlobalTokenExitRegistry.sol), which is the authoritative source for which exit contract is valid
7. Timelock:
   - tokens can be timelocked, e.g. in a [TimeLock.sol](contracts/TimeLock.sol) that blocks withdrawals until a configured timestamp
   - all relevant features work timelocked, e.g. claiming distributions or coinvesting

The requirements for an address to send or receive tokens are checked against the [AllowList.sol](contracts/AllowList.sol) contract. Fees are collected according to the settings in [FeeSettings.sol](./contracts/FeeSettings.sol). Tokenize.it will deploy and manage at least one AllowList and one FeeSettings contract.

# Contracts

The smart contracts can be found in the contracts/ folder.

All contracts are based on the well documented and tested [OpenZeppelin smart contract suite](https://docs.openzeppelin.com/contracts/4.x/).

## EIP-2771

It is possible to directly use all smart contracts in this project, without going through the platform's frontend at all.
In order to improve UX, though, a frontend will be offered. In order to improve UX even more, the user will not have to pay gas when using this frontend. This is achieved through three approaches:

1. the platform executes transactions like contract deployments that do not require the user's signature
2. actions concerning our own contracts that require the user's approval are executed as meta-transactions, using EIP-2771
3. granting allowances on external currencies is possible through EIP-2612 (ERC20Permit), which is widely adopted. This is not in the scope of this documentation though.

Several of the contracts implement [EIP-2771](https://eips.ethereum.org/EIPS/eip-2771), and therefore use a trusted forwarder. The forwarder will be set in the constructor and there is no way to change it after deployment. The forwarder used will be the openGSN v2 forwarder deployed on mainnet. Some information about this contract:

- [Documentation and addresses](https://docs-v2.opengsn.org/)
- [Code](https://github.com/opengsn/gsn/blob/v2.2.5/packages/contracts/src/forwarder/Forwarder.sol)
- [Audit reports](https://docs-v2.opengsn.org/audits.html)
- Deployment on Ethereum Mainnet: **0xAa3E82b4c4093b4bA13Cb5714382C99ADBf750cA**

  - deployed 2022-04-21
  - [official resources](https://docs-v2.opengsn.org/networks/xdai/xdai.html)
  - Visit on [etherscan](https://etherscan.io/address/0xaa3e82b4c4093b4ba13cb5714382c99adbf750ca) ([see transactions here](https://etherscan.io/txsInternal?a=0xAa3E82b4c4093b4bA13Cb5714382C99ADBf750cA&&m=advanced&p=1))
  - This [dashboard](https://dune.com/oren/meta-transactions-on-ethereum-over-time) lists the forwarder as second most active forwarder contract with over 2000 transactions executed
  - used in our [tests](./test/CrowdinvestingERC2771.t.sol).

- Deployment on Gnosis Chain: **0x7eEae829DF28F9Ce522274D5771A6Be91d00E5ED**
  - deployed 2021-04-29
  - [official resources](https://docs-v2.opengsn.org/networks/xdai/xdai.html)
  - visit on [blockscout](https://gnosis.blockscout.com/address/0x7eEae829DF28F9Ce522274D5771A6Be91d00E5ED)

The platform will maintain a hot wallet (EOA) in order to send transactions to the forwarder contract. This results in the following flow:

- contract A supports EIP-2771 and uses `forwarder` as its (one and only, immutable) trusted forwarder
- user (investor or founder) wants to use function `a(...)` of contract `A` and uses the platform for this
- platform (tokenize.it) prepares meta transaction payload and asks user for signature
- user signs the payload with their own key (using metamask or similar)
- platform now has payload and signature and uses its hot wallet to call `forwarder.execute(payload, signature, ...)`
- forwarder verifies signature and payload on-chain
- forwarder executes `A.a(...)` with parameters according to payload
- contract `A` only verifies it is being called by the ONE forwarder it trusts. It does not verify any signatures. This is why the forwarder is called trusted forwarder: it is trusted to do the verification.
- contract `A` executes function `a(...)` in the name of user

This is a trustless process, because:

1. the forwarder contract can not be updated
2. the trusted forwarder setting in contract A is immutable
3. signature verification is executed on-chain

Open gas station network provides tools to execute meta transactions without involving a third party hot wallet. Tokenize.it does not plan on using these tools though. Exclusively using a hot wallet for transaction execution does not harm security at all.

The hot wallet approach might reduce availability, which is not a major concern for this use case (the hot wallet being available whenever the frontend is available is good enough). Keep in mind that EIP-2771 is purely offered for UX reasons. All smart contracts can be used directly, too, further reducing concerns about hot wallet availability.

An [Openzeppelin Defender Relay](https://docs.openzeppelin.com/defender/relay) may be used as hot wallet.

## Supported Currencies

The currencies used for payments must conform to the ERC20 standard. This standard is not very strict though. It can be implemented in many ways, including **incompatible and even malicious contracts**. Therefore, tokenize.it will limit the currencies supported in the web frontend to this list:

- WETH: [0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2](https://etherscan.io/address/0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2)
- WBTC: [0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599](https://etherscan.io/address/0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599)
- USDC: [0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48](https://etherscan.io/address/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48)
- EUROC: [0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c](https://etherscan.io/address/0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c)
- DAI: [0x6B175474E89094C44Da98b954EedeAC495271d0F](https://etherscan.io/token/0x6b175474e89094c44da98b954eedeac495271d0f)
- EURe: [0x3231cb76718cdef2155fc47b5286d82e6eda273f](https://etherscan.io/token/0x3231cb76718cdef2155fc47b5286d82e6eda273f)

These implementations have been checked and tested to work well with the tokenize.it smart contracts. The use of any other currencies is HIGHLY DISCOURAGED and might lead to:

- loss of funds due to various attacks
- partial payments due to the currency deducting a transfer fee
- other issues

To enforce the use of trusted currencies only, they are added to the [AllowList.sol](contracts/AllowList.sol) contract with the special `TRUSTED_CURRENCY` bit. PrivateOffers and Crowdinvesting campaigns will only accept currencies that are on the AllowList and have the `TRUSTED_CURRENCY` bit set. This makes using a malicious currency by mistake impossible, but still allows either the platform or other operators of their own AllowLists to edit and extend the list of supported currencies.

# Resources

The following resources are available regarding the contracts:

- [Basic high level overview](docs/user_overview.md)
- [Basic dev overview](docs/dev_overview.md)
- [More detailed walkthrough](docs/using_the_contracts.md)
- In-depth explanation: please read the [contracts](contracts/)
- [Invariants](docs/invariants.md)
- [Price format explainer](docs/price.md)
- [Fee Collection](./docs/fees.md)
- [Deployment](./docs/deployment.md)
- [Testing](docs/testing.md).
- [npm publishing](docs/npm_publishing.md).
- Remaining questions: please get in touch at [hi@tokenize.it](mailto:hi@tokenize.it)

---
_Source: https://npm.io/package/@tokenize.it/contracts · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._