ENS v2 · Permissioned Resolver
A name you own, with permissions you control.
Every record separately permissioned. Enforced on-chain, revoked in one transaction, without asking us for anything.
Why it matters
An account a company can delete was never yours.
Your identity has to survive us. If we disappear, or get ordered to close your account, the name and the keys people reach you by keep working.
And the infrastructure helping run your account should hold the narrowest power possible — in a form you can check and withdraw yourself. A row in our database is a claim about our behaviour. We needed a permission that is a public fact.
It’s also the business model. Handles are what we sell, and that only works if a handle is genuinely yours.
What ENS v1 can’t do
In v1, control is all-or-nothing. Whoever can write, can write everything — so delegating “rotate this one pointer” means handing over the key people reach you by. That isn’t delegation, it’s surrender.
v2 gives every account its own resolver and per-record roles. Write permission becomes granular: per record, per address, revocable in one transaction.
How it works
- Your own resolver. Claiming a handle deploys you your own contract — not a row in a shared one.
- Records carry your routing. Messaging key, vault index, inbox, stealth address, contact challenge.
- Delegate exactly one thing. Our gateway may rotate your inbox pointer. Its attempt to write your pubkey reverts.
- Revoke without us. One transaction, your signature. No support ticket, no waiting on a company that may not want to comply.
- Prove it’s real.
verifyContract()returns the implementation your resolver came from. Check it yourself — no trust in our backend. - Unlinkable. Issued against a zero-knowledge nullifier, claimed by a relayer. Your payment and your handle never meet.
Discoverability is a dial, not a switch
Reachable and findable are different things. Five rungs, held in one record:
| Ghost | Not findable. Only someone you handed your handle to can reach you. |
|---|---|
| Unlisted | Resolvable if known. Not searchable, not reverse-linkable. |
| Known | Findable only by someone who already has an identifier for you. |
| Searchable | Appears in people-search, because you opted in. |
| Public | Fully linkable, deliberately. |
Every lookup runs through our gateway, so records can answer differently per caller. The gate is the creative part, not the index behind it.
Second axis: publish a question, never the answer. A stranger has to answer it correctly before you’re even notified they exist.
Specifics
| Handle | <name>.lortnoc.eth |
|---|---|
| Registry | LortnocRegistry, under lortnoc.eth |
| Resolver | Per-account proxy of PermissionedResolverImpl |
| Permissions | Enhanced Access Control — per-record roles |
| Delegation | authorizeTextRoles(name, key, account, grant) |
| Network | Sepolia, deployment pinned to 2026-06-29 |
Roles gate writes, not reads. Records are world-readable — that’s how people reach you. The ladder above is off-chain gateway policy, a separate mechanism.
On-chain issuance means the claim is a public transaction. Payment and handle stay unlinked; that a handle was claimed is public.
Free handles are deliberately not anonymous. Only paid handles carry the guarantee. Free messaging needs no handle at all.