Designing for Irreversibility: Lessons from Shipping ENSv2

ENSv2 replaces the flat ENS registry with hierarchical registries, shipping on L1 while millions of v1 names keep working. There is no undo: names are user-owned assets, and a bad deploy or design flaw is permanent. This talk covers how that constraint shaped three layers of the system.

Protocol: token IDs regenerate whenever a name's permissions change or it is re-registered, so a seller can't list a name on a marketplace and quietly strip its roles before sale. Revoking a single role makes a name soulbound.

Accounts: users get deterministic smart accounts with owner-derived salts, so funds sent to a counterfactual address are safe because the derivation itself is the security model. We also cover spoofing bugs we found and fixed.

Process: phased runbooks, resumable deploys, and full dress rehearsals on Sepolia, including real incidents they caught.

Attendees leave with a practical checklist for designing, auditing, and shipping systems where mistakes can't be rolled back.

Speakers: Makoto Inoue, workemon.eth

Track: Users, Builders, and Agents