Skip to main content
Request a demo
Developers

Smart Contracts

What the chain enforces should be readable by whoever is deciding to trust it.

One transaction boundaryThree stacked elements — a record, a rule and a ledger posting — enclosed by a single boundary, indicating that all three commit together or not at all.ONE TRANSACTION BOUNDARYRecordwhat is trueRulewhat is permittedPostingwhat it did to the bookscommit together

What it changes

  1. Eligibility enforced on chainThe compliance module refuses a non-compliant transfer regardless of what any interface permits, and reports a reason code rather than reverting anonymously.
  2. The off-chain mirror is checked against itA test parses the Solidity enum and fails if the platform’s reason ordering drifts — so the interface never explains a refusal with the wrong reason.
  3. No upgrade mechanismDeliberately. An upgradeable securities token lets the issuer rewrite the rules under holders after they have subscribed. The cost is that a defect cannot be patched in place, and that is the trade we chose.
Ask, agree, then actThree steps. One person requests, a different person approves, and only then does the state change. The approval binds to what was requested, so editing it afterwards invalidates the sign-off.Requestone personApprovea different oneActnow it movesThe approval binds to what was asked.Edit it afterwards and the sign-off is void.
Every irreversible act on this platform takes this shape, whatever the subject of the page: one person asks, a different one agrees, and only then does anything move.

What it includes

Identity registryWho is verified, in which country, and until when.
Compliance moduleTransfer rules: verification, freezes, lockups, blocked countries, holder caps and concentration.
TokenPermissioned transfers with agent controls for regulated intervention.
FactoryDeploys a fully wired asset in one transaction, and refuses to deploy with the issuer and transfer agent as one key.

Evidence, not assertion

Controls that have been verified running, rather than described.

  • 27 Solidity tests executing against a real in-process EVM, not mocked.
  • Concentration limits apply to secondary transfers only — a test caught that a cap below 100% is unsatisfiable at primary issuance.
  • Burns skip the transfer gate, because refusing redemption over lapsed paperwork would trap a holder in the instrument.
What counts as evidenceThree rows. A control described in a document is unticked; a control enforced by code and one refused by the database are ticked. Only the second and third are evidence that something holds.Described in a documentEnforced by codeRefused by the database
A control written down is not a control. Only the two lower rows are evidence that something holds, and both are what the list beside this describes.

See it against something real.

Bring an instrument you are actually considering. Structuring it is the only way to judge whether the model fits.

Request Enterprise DemoBack to developers
Your instrument, against this modelAn unspecified asset on the left feeds four stages: structure, compliance policy, the offering book and the register. The asset is drawn as an outline because it is the reader's, not the platform's.Your assetwhatever it isStructurePolicyBookRegister