Lorenzo enzoBTC

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED ON UNRESOLVED DISCLOSURE GAPS, NOT A NEGATIVE FINDING. enzoBTC is Lorenzo Protocol’s omnichain wrapped-BTC token, mintable from native BTC, WBTC, or BTCB and held through three named custodians, but this review could not confirm the redemption mechanism or its timing, the custodian approval threshold, or any contract-level pause or freeze authority from primary sources. enzoBTC also inherits both the LayerZero and Wormhole messaging-layer dependencies this registry has separately rejected, and shares a named custodian, Cobo, with Function FBTC, also rejected in this registry — a concentration point across two products a client might otherwise treat as diversified. Absence of a negative finding is not sufficient evidence for approval when the basic facts needed to certify a position remain unconfirmed.

Kill criteria: the events that revoke this verdict
• Redemption mechanism, timing, and any gating conditions are independently confirmed and demonstrated at proposed size
• Custodian approval threshold and any contract-level pause, freeze, or upgrade authority are publicly disclosed and confirmed on-chain
• The May 2025 audit’s firm, full findings, and remediation status are independently confirmed via a primary source
• Twelve consecutive months with no depeg, custody, or bridge-dependency incident affecting enzoBTC specifically

The research file

Mechanism

enzoBTC is Lorenzo Protocol’s omnichain wrapped-BTC token, mintable from native BTC, WBTC, or BTCB and described by Lorenzo as fully BTC-collateralized. It uses both LayerZero and Wormhole for cross-chain interoperability — both reviewed separately in this registry and both rejected, meaning enzoBTC carries that messaging-layer dependency risk in addition to its own custody model. Users can deposit enzoBTC into Lorenzo’s yield vaults, positioned as an alternative to direct native BTC staking.

Control and governance

Custody of underlying BTC is held through named custodial institutions Cobo, Ceffu, and Chainup. Relayers validate Bitcoin-chain transactions and submit block headers to a Lorenzo appchain to track activity. BANK, Lorenzo’s governance and utility token, lets holders vote on product configuration, fees, and protocol upgrades — a token-governed system rather than a fixed multisig with disclosed signers. This review could not confirm the specific pause, freeze, or blacklist authority in the enzoBTC or FBTC_Vault contracts, the custodian approval threshold, or named individual signers.

Incident record

No enzoBTC-specific depeg, exploit, or custody failure was identified. A May 2025 audit round is reported to have covered fund-custody logic in the FBTC_Vault and enzoBTC contracts and to have found minor reentrancy risks that were subsequently patched, but this review could not independently verify the audit firm, exact findings, or remediation confirmation against a primary source — the claim rests on a secondary summary only.

Exit

This review could not confirm the specific redemption mechanism, timing, or any gating such as KYC or a minimum size from primary sources. That is a real, unresolved gap rather than a negative finding either way, but it means a client’s exit path cannot currently be certified.

Comparison

enzoBTC’s three-name custodian set is structurally similar in shape to Function FBTC’s three-party Security Council, also rejected in this registry, and the two products share Cobo as a common custodian — a cross-holding concentration point worth flagging for a client who might otherwise treat FBTC and enzoBTC as diversified BTC-wrapper exposure. Like FBTC and WBTC, this is custodial wrapped BTC, not sovereign BTC exposure, and it additionally stacks bridge-dependency risk neither WBTC nor FBTC carries in the same way. The LayerZero leg of that dependency is not theoretical: this registry’s LayerZero V2 memo documents the April 2026 compromise of LayerZero Labs’ own operational infrastructure that let attackers forge attestations and steal roughly $292M from a bridge relying on the same default trust configuration enzoBTC uses.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Lorenzo Protocol Docs — enzoBTC: decentralized wrapped BTC for DeFi · primary · accessed 2026-08-17
  Supports: mechanism, custodian names
• Lorenzo Protocol — audit report repository · primary · accessed 2026-08-17
  Supports: audit listing, content not independently retrieved
• DefiLlama — Lorenzo enzoBTC protocol record · secondary · accessed 2026-08-17
  Supports: tracked TVL
• BingX — what is Lorenzo Protocol (BANK) · secondary · accessed 2026-08-17
  Supports: governance token, protocol overview
• WEEX — what is Lorenzo Protocol (BANK) and how does it work · secondary · accessed 2026-08-17
  Supports: relayer mechanism, appchain

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.