USDPROP | Technical Architecture

Technical comparison

ERC20 vs USDPROP controlled issuance model

A simple ERC20 transfer model does not include investor identity, eligibility, transfer restrictions, treasury controls or servicing logic. USDPROP combines ERC-3643 issuance with ONCHAINID, issuer-backed claims, compliance modules and operational controls.

Simple ERC20

Does not know who buys.

Does not validate KYC.

Does not block transfers.

Does not distribute dividends.

USDPROP Stack

Identity through ONCHAINID.

KYC and AML claims.

Compliance on transfers.

Safe multisig and separated agents.

Technical reference

Contract architecture and stack parameters.

Core deployment assumptions, upgrade model and operational role notes for technical review. Values are sourced from current deployment documentation and public Polygon addresses where available.

Contract architecture

14 deployed contract components on Polygon mainnet (chainId 137) are covered by the deployment pack. Upgradeable core contracts follow the UUPS upgrade model; upgrade execution is intended to be controlled through the Safe multisig.

Topology Summary

Core Operational Contracts: 9
Full Production Topology: 12
Total Deployed Components: 14

Topology counts use different scopes. Core Operational Contracts refers to the primary contracts directly involved in issuance, compliance, identity, NAV, distributions and treasury operations. Full Production Topology includes supporting ERC-3643 and ONCHAINID infrastructure contracts required for production operation. Total Deployed Components reflects the complete deployment package, including supporting deployed components, infrastructure dependencies and operational contract references.

The Smart Contract Structure & Deployment Report contains the complete contract inventory, deployment topology and interaction model.

Download Smart Contract Structure Report

Roles and permissions

Operational agents are separated across deployer, execution, admin, KYC issuer and NAV roles. NAV authority and administrative authority are assigned to separate operational roles. Role separation reduces administrative concentration risk and supports independent operational controls.

Governance update record

Initial deployment configuration: administrative and NAV authority were recorded together, and Safe governance used a 2 of 3 threshold. Current governance configuration: operational scripts separated NAV authority from administrative authority and updated governance to Safe multisig (5/7). Agent wallet addresses are intentionally not published in this reference.

Parameter	Current value
Network	Polygon mainnet, `chainId 137`
Token standard	ERC-3643 (T-REX protocol)
Identity	ONCHAINID, ERC-734 / ERC-735 identity and claim model
Proxy pattern	UUPS, OpenZeppelin upgradeable pattern for core upgradeable contracts
Payment token	USDC native Polygon, `0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359`
Treasury	Safe multisig (5/7), current governance configuration
Compliance	Reg D 506(c), Reg S and EU MiFID II operational support model
Tooling	Hardhat, ethers.js, OpenZeppelin

CORE STANDARDS & DEPENDENCIES

Technology Stack

Core protocols, identity standards, settlement components and dependencies used by the USDPROP architecture.

ERC-3643

Permissioned Security Token Standard

ONCHAINID

Identity & Claims Framework

Polygon

Settlement Network

USDC

Settlement Asset

Safe

Treasury Governance

Technical Due Diligence Quick View

Core Operational Contracts: 9
Full Production Topology: 12
Total Deployed Components: 14
Roles: 8 operational roles
Upgrade Model: UUPS + Safe governance
Treasury: Safe multisig (5/7)
Identity: ONCHAINID + ClaimIssuer
Settlement: USDC on Polygon
Deployment: Mainnet
Validation: 256 automated tests
Pass Rate: 100%

Due Diligence Assets Available

Architecture Package
Regression Validation Report
Smart Contract Structure Report
Deployment Records
Contract Inventory
Roles Matrix
Upgradeability Matrix

Primary Technical Artifacts

Architecture Package How the system is built

Validation Report How the system is tested

Smart Contract Structure Report What is deployed and how components interact

01 / System architecture

On-chain enforcement with off-chain eligibility inputs.

USDPROP separates investor onboarding and legal review from token transfer enforcement. Off-chain systems collect documents and KYC payloads. On-chain registries store identities, issuers and claim references used by the token compliance layer.

01InvestorWallet, documents, consent signatures
02KYC ProviderOff-chain checks and status payloads
03ClaimIssuerAttests approved claim topics
04IdentityRegistryMaps wallet to ONCHAINID identity
05ERC-3643 TokenRestricted ownership unit
06InvestmentManagerSubscription and consent execution
07NAVOraclePrice and NAV source for operations
08DividendDistributorDistribution accounting and claims
09Safe TreasuryMultisig controlled assets and approvals

Component map

Investor app: wallet connection, status display, consent signing.
Backend: API, signature verification, transaction execution path.
Contracts: identity, compliance, issuance, NAV and distribution modules.
Document room: private placement templates and review artifacts.

Dependency map

Token depends on IdentityRegistry and ModularCompliance.
IdentityRegistry depends on trusted issuers, claim topics and storage.
InvestmentManager depends on USDC, token minting permissions and NAV inputs.
DividendDistributor depends on token balances, accounting state and treasury funding.

Trust boundaries

KYC decisioning remains off-chain.
Claims are on-chain attestations from authorized issuers.
Treasury movements require Safe signer approval.
Admin and upgrade authority must be reviewed per deployment.

On-chain responsibilities

Identity registration, claim verification, transfer eligibility, issuance, burn, NAV reads, dividend accounting and event emission.

Off-chain responsibilities

Document intake, KYC/AML review, accreditation evidence, API validation, user interface state, operational monitoring and administrative workflows.

Contract inventory

Contract Inventory

This inventory lists the 9 Core Operational Contracts directly used by issuance, compliance, identity, NAV, distributions and treasury operations. Address cells include Polygonscan and source links for direct review.

Contract	Category	Standard	Upgradeable	Address
USDPROP Token	Issuance / ownership record	ERC-3643	Yes	`0x6F6c...5826`Polygonscan Source
IdentityRegistry	Identity registry	ONCHAINID / ERC-734 / ERC-735	No	`0x82e0...6bac`Polygonscan Source
ModularCompliance	Transfer compliance engine	T-REX ModularCompliance	Proxy / review upgrade path	`0x42a1...1294`Polygonscan Source
USDPROPComplianceModule	Custom compliance module	Compliance module	Yes	`0x6A78...bDcc`Polygonscan Source
ClaimIssuer	Claim attestation issuer	ONCHAINID ClaimIssuer	No	`0x656B...a61a`Polygonscan Source
InvestmentManager	Subscription execution	EIP-712 + USDC settlement	Yes	`0xe901...949f`Polygonscan Source
NAVOracle	NAV reference	Oracle adapter	Yes	`0x356B...F9a9`Polygonscan Source
DividendDistributor	Distribution accounting	Distribution module	Yes	`0x26Fa...D1D1`Polygonscan Source
Safe Treasury	Treasury control	Custom SafeMultisig	No; owners/threshold configurable	`0xe1f7...f92c`Polygonscan Source

Upgradeable status distinguishes UUPS-controlled contracts from proxy-based or governance-configurable components. ModularCompliance uses an ERC-1967 proxy deployment and its upgrade path should be reviewed against the deployed implementation and ownership records. Safe Treasury is not upgradeable; its signer set and threshold are governance-configurable.

02 / Smart contract suite

Deployed contract responsibilities and dependencies.

This section describes what each core contract does and what it depends on. Address links live in Contract Inventory and Deployment Records; upgrade status lives in the Upgradeability Matrix.

USDPROP Token

ERC-3643 restricted token representing the ownership record governed by identity and compliance checks.

Owner role: Token owner / administrative authority
Upgradeability: See Upgradeability Matrix.
Dependencies: IdentityRegistry, ModularCompliance, agents

IdentityRegistry

Registry that links investor wallets to ONCHAINID identities and eligible claim topics.

Owner role: Identity registry owner / identity agent
Upgradeability: See Upgradeability Matrix.
Dependencies: IdentityRegistryStorage, TrustedIssuersRegistry, ClaimTopicsRegistry

ModularCompliance

Compliance orchestration contract used by token transfers to validate module-level restrictions.

Owner role: Compliance owner / administrative authority
Upgradeability: See Upgradeability Matrix.
Dependencies: USDPROPComplianceModule, Token, IdentityRegistry

ClaimIssuer

Issuer contract used to sign and publish claim attestations accepted by the IdentityRegistry.

Owner role: KYC issuer / claim signer
Upgradeability: See Upgradeability Matrix.
Dependencies: Claim topics, trusted issuers registry, ONCHAINID identities

InvestmentManager

Execution contract for subscription flows, consent checks, USDC transfer and token issuance.

Owner role: execution agent / administrative authority
Upgradeability: See Upgradeability Matrix.
Dependencies: USDC, USDPROP Token, NAVOracle, investor consent signatures

NAVOracle

NAV source used by investment and distribution operations to reference pricing state.

Owner role: NAV authority
Upgradeability: See Upgradeability Matrix.
Dependencies: NAV update policy, admin controls, consuming contracts

DividendDistributor

Distribution accounting contract for dividend lifecycle and investor settlement claims.

Owner role: Distribution agent / treasury approver
Upgradeability: See Upgradeability Matrix.
Dependencies: USDPROP Token, USDC funding, NAV/accounting inputs

Safe Treasury

Custom SafeMultisig treasury contract used for controlled assets, approvals and operational funding.

Owner role: Safe owners, Threshold: 5 of 7 under current governance configuration
Upgradeability: See Upgradeability Matrix.
Dependencies: Signer set, threshold policy, treasury procedures

Roles and permissions

Roles & Permissions Matrix

Operational authority boundaries and control responsibilities. Role separation reduces single-key blast radius; formal review should confirm current assignees, signer custody and authority boundaries.

Role	Controls	Criticality
Owner	Contract ownership, role assignment, upgrade/admin handoff and emergency authority depending on the contract.	Critical
ClaimIssuer	Signs, updates and revokes investor claim topics for KYC, AML, accreditation and jurisdiction status.	Critical
AdminAgent	Operational configuration, parameter changes and administrative workflows authorized by ownership policy.	High
NAVAgent	NAV and accounting references consumed by investment, redemption and distribution workflows.	High
DistributionAgent	Distribution lifecycle preparation, entitlement accounting and settlement operation support.	High
SafeSigner	Approves treasury movements and upgrade execution through the Safe threshold model.	Critical
IdentityAgent	Registers ONCHAINID mappings and wallet-to-identity relationships used by transfer checks.	High
ComplianceAgent	Configures claim topics, trusted issuers, transfer modules, lockups and eligibility restrictions.	Critical

Upgradeability matrix

Upgradeability Matrix

What can be upgraded. Pattern labels reflect current deployment documentation and should be confirmed against Polygonscan proxy records during formal review.

Contract	Upgradeable	Pattern
USDPROP Token	Yes	UUPS
IdentityRegistry	No	Immutable direct deployment
ModularCompliance	Proxy / review upgrade path	ERC-1967 proxy deployment; review deployed implementation and ownership records
USDPROPComplianceModule	Yes	UUPS
ClaimIssuer	No	Immutable
InvestmentManager	Yes	UUPS
NAVOracle	Yes	UUPS
DividendDistributor	Yes	UUPS
Safe Treasury	No; owners/threshold configurable	Custom SafeMultisig governance configuration

03 / Upgrade path

How contract upgrades work.

Core upgradeable contracts follow the UUPS pattern. Upgrades should require Safe multisig (5/7) approval, and no single key should be able to upgrade unilaterally after ownership transfer.

Current Upgrade Authority Safe Treasury Threshold: 5 of 7

All production upgrades are expected to require Safe approval before execution.

1New implementation deployed to Polygon.Implementation address is recorded and prepared for review.
2Safe proposal created.The transaction calls upgradeToAndCall(newImpl, data) on the proxy.
35 of 7 Safe signers approve and execute.Proxy storage is preserved and execution is visible on-chain.
4New logic active.Upgrade event is emitted and can be verified on Polygonscan.

Storage layout rule

Storage layout must be preserved across upgrades. New variables are appended only. Existing slots must not be reordered, removed or type-mutated.

04 / Investment flow

`investWithConsent()` execution path.

The investment path uses investor consent, backend verification and on-chain settlement. Exact ABI parameters must be confirmed against the deployed contract before production integration.

InvestorSigns EIP-712 consent messageAmount, minimum output, deadline and nonce are included in signed data.
BackendVerifies wallet, consent and request envelopeRejects expired deadline, reused nonce and malformed payloads.
InvestmentManagerExecutes investmentCalls transfer path and validates token issuance conditions.
USDCTransfers subscription amountAllowance and balance checks apply before settlement.
USDPROP TokenIssues restricted ownership unitsMinting depends on role permissions and compliance state.
Event logEmits execution eventUsed for audit trail, UI state and operations review.

Nonce handling

Consent messages must be single use. Backend and contract state should reject replayed nonces.

Deadline handling

Signed intent includes an expiry. Expired execution requests must fail before value movement.

Slippage controls

Minimum token output or equivalent acceptance condition protects the investor from stale NAV assumptions.

Replay protection

EIP-712 domain separation, chain ID, contract address and nonce are required to prevent cross-context reuse.

05 / Redemption flow

`redeemWithConsent()` control path.

The redemption path mirrors investment consent patterns and adds validation around burn, settlement availability and redemption policy.

InvestorSigns EIP-712 redemption intentToken amount, minimum USDC output, deadline and nonce are included.
BackendPerforms redemption validationChecks wallet state, eligibility, nonce, deadline and operational policy.
TokenBurns redeemable ownership unitsOrder of operations must prevent double settlement and partial accounting drift.
USDCTransfers redemption proceedsTreasury funding and allowance paths must be reviewed per deployment.
Event logEmits redemption eventProvides audit evidence for investor and fund operations.

Consent model

Investor consent is explicit and scoped to the intended redemption parameters. The same signing policy should be used by the UI, backend and contract verification path.

Redemption controls

Controls can include eligibility review, redemption windows, NAV freshness, liquidity availability, lockups and manual approval gates.

06 / Identity and claims

ONCHAINID identities and issuer-backed claim topics.

Investor eligibility is represented through identity registration and claim attestations. Legal and KYC evidence remains outside the token contract. The token reads registry and compliance state before transfers.

ONCHAINID

Identity layer for associating wallet addresses with investor identity contracts and verifiable claims.

IdentityRegistry

Canonical registry used by the token to determine whether sender and recipient identities satisfy the required state.

ClaimIssuer

Authorized issuer that creates, updates or revokes claims used by compliance checks.

KYC AML Accredited Investor Reg D Reg S

CreateKYC provider approves an investor profile and prepares claim payload.
IssueClaimIssuer signs and publishes the relevant claim topic for the ONCHAINID identity.
VerifyIdentityRegistry and token compliance checks read issuer and claim-topic state.
UpdateClaims can be refreshed for expiry, jurisdiction, accreditation or policy changes.
RevokeIssuer or admin workflow removes trust when investor state changes.

07 / Compliance engine

Transfer validation before ownership movement.

ERC-3643 transfer validation routes through registry and compliance checks before token balances move. Compliance modules encode restrictions that are external to standard ERC20 behavior.

`canTransfer()`

Pre-transfer check used to test whether sender, recipient and amount satisfy registry and module requirements.

`moduleCheck()`

Module-level validation for country restrictions, limits, lockups or custom policy constraints.

Claim requirements

Transfer permissions can depend on KYC, AML, accreditation, Reg D and Reg S claims.

Control	Input	Enforcement point
Investor eligibility	Identity and claims	IdentityRegistry and token transfer path
Country restrictions	Jurisdiction claim or registry metadata	Compliance module
Lockups	Investor or issuance timestamp	Compliance module
Transfer restrictions	Sender, recipient, amount	`canTransfer()` and module checks

Operational modules

Launch modules and integration surfaces around the deployed issuance, identity, compliance, settlement and treasury system.

Circle CCTP by JavaScriptUSDC entry from other networks into Polygon.
KYC providerKYC works with both ONCHAINID and off-chain provider flows. Real integration with audited payload.
Admin panel includedDaily operation without touching scripts.
KYC panel includedOperational panel for reviewing KYC status, claims and investor eligibility.
Onboarding KYC app includedInvestor-facing onboarding flow for KYC collection and verification.
MonitoringAlerts for NAV, upgrades, roles and dividends.

08 / Treasury governance

Safe multisig as the treasury control boundary.

The current governance configuration uses a Safe multisig (5/7). Formal diligence should review owners, signer custody, threshold policy, recovery procedures and signer rotation controls.

Safe Signer Group7 configured signers

Execution Threshold5 signatures required

Governance BoundaryNo single signer execution

Safe TreasuryThreshold: 5 of 7

Approvals

Treasury operations require threshold approval before asset movement or operational funding.

Signer rotation

Rotation should be documented with an approval trail, owner replacement procedure and incident escalation path.

Threshold model

Threshold must balance liveness and compromise risk. Current governance configuration records Threshold: 5 of 7.

09 / Dividend distribution

NAV-based accounting and investor settlement lifecycle.

The distribution layer uses NAV/accounting inputs and token ownership state to calculate investor entitlement and settlement workflow.

Distribution lifecycle

Update NAV or accounting reference.
Prepare distribution amount and eligible holder state.
Fund distribution source with USDC.
Record distribution event and investor entitlements.
Settle or claim according to the deployed mechanism.

Investor settlement lifecycle

Investor remains eligible under current claims.
Balance snapshot or equivalent accounting state is checked.
USDC settlement path executes.
Event trail updates the investor app and operations records.

10 / Security model

Threat model, mitigations and residual risks.

This section documents known security assumptions. It does not replace a formal audit, threat model workshop or deployment-specific key ceremony.

Risk	Mitigation	Residual risk
Admin key risk	Use multisig, role separation, least privilege and monitored admin actions.	Compromised quorum or poorly scoped roles can still affect system state.
Oracle manipulation	Restrict NAV writer role, require review process and monitor NAV changes.	Incorrect NAV input can affect issuance, redemption or distribution calculations.
Signer compromise	Safe threshold, hardware wallets, signer rotation and incident runbook.	Threshold compromise remains a critical custody event.
Claim issuer compromise	Dedicated issuer keys, issuer monitoring, claim revocation and registry controls.	Invalid claims can create improper eligibility until detected and revoked.
Replay attacks	EIP-712 domain separation, nonce tracking, deadlines and chain ID binding.	Implementation defects in nonce or domain handling can reintroduce replay paths.
Upgrade risk	Publish upgrade policy, require review, use timelocks where applicable and monitor bytecode changes.	Upgrade authority remains a governance trust assumption unless fully removed.

11 / Network perimeter & application security

Cloudflare edge protection, nginx reverse proxy and private Express runtime.

Infrastructure controls for backend execution, API exposure, Doppler-managed runtime secrets and operational key blast-radius review.

Network perimeter

Layer	Configuration	Status
DNS / Edge	Cloudflare with Full Strict SSL mode	Active
TLS	End-to-end encryption with origin certificate installed	Active
Firewall	DigitalOcean UFW firewall, deny incoming by default	Active
Application surface	443 HTTPS through Cloudflare	Active
Administrative access	22 SSH, private-key authentication only, password login disabled, root login disabled	Active
HTTP edge path	Port 80 accepted only from Cloudflare for redirect and ACME challenge flow	Active
Internal runtime	Node.js Express on port 3002, blocked externally by UFW and proxied by nginx	Active
Runtime secrets	Doppler-managed backend secrets injected through a scoped service token; no execution-agent private key is stored in the project `.env`	Active

Traffic path

Internet → Cloudflare → nginx → Express :3002

The Node.js process on port 3002 is not reachable from the public internet. Application traffic passes through Cloudflare and nginx before reaching the backend application layer.

Server configuration

Parameter	Value
Provider	DigitalOcean
Type	Dedicated Droplet
SSH authentication	Private key only, password authentication disabled
Root login	Disabled
Process manager	systemd service running Node.js / Express on port 3002
Reverse proxy	nginx

Application-layer controls

Control	Implementation	Status
Security headers	Helmet.js in the Express backend plus nginx security headers	Active
CORS policy	Restricted origin allowlist, no wildcard origin	Active
Rate limiting	Per-IP limiter on critical backend routes	Active

Critical routes subject to rate limiting

`/api/invest/execute`

Investment execution path using investWithConsent.

`/api/invest/waitlist`

Investor operations demo and lead capture path.

Execution agent threat model

What the execution agent can do

Submit investWithConsent transactions with a valid investor EIP-712 signature.
Pay transaction gas from the execution agent wallet.

What the execution agent cannot do

Forge investor signatures.
Mint arbitrary tokens or issue ownership units without a valid investor signature, correct nonce, deadline and active compliance state.
Access the Safe treasury.
Upgrade contracts.
Modify NAV.
Execute administrative or governance actions outside the scoped execution path.

Execution boundary

The backend cannot mint arbitrary tokens, execute redemptions without valid investor consent, move treasury funds, update NAV, modify compliance, upgrade contracts or bypass investor consent.

Compromise scenario

If the execution agent key is compromised, the attacker can only submit scoped investment execution transactions using valid intercepted investor signatures within their deadline window and consume the POL balance held by the execution agent for gas. The attacker cannot drain treasury funds, mint arbitrary tokens, modify NAV, alter compliance rules, upgrade contracts or change governance state. The blast radius is operationally contained by contract-level permissions and by the limited gas balance policy.

POL balance policy

The execution agent wallet maintains a minimal POL balance sufficient for current operational needs only. This limits exposure in a compromise scenario to gas funds only.

Residual-risk framing

Operational exposure is bounded by EIP-712 consent requirements, nonce and deadline enforcement, contract-level permissions, backend rate limiting, treasury segregation and governance controls.

Execution agent key handling

Current state: the execution agent key is managed in Doppler and injected into the backend at runtime through a scoped service token. The production backend .env file no longer stores execution-agent private keys or RPC credentials.

Future production hardening may migrate execution agent signing to a dedicated signer-service, KMS-backed signer or relay model with rotation procedures and operational monitoring.

Mapping to validation report findings

Finding	Report reference	Status
Server-side private key exposure	Final Critique, Critical B	Mitigated by Doppler-managed backend and execution agent scope
execution agent scope limited to `investWithConsent`	Investment Flows validation	Confirmed by contract access control tests

The Critical B finding models a high-risk server-side key exposure scenario. The Doppler-managed backend materially reduces residual risk by removing static secret handling from local environment files, while the execution agent key retains a constrained operational scope.

Production hardening items

Item	Priority	Notes
SSH restricted to VPN only	High	Tailscale or equivalent; closes public SSH exposure
Role separation monitoring	Medium	Confirm NAV, administrative and execution authority remain separated during future role changes
Edge WAF rules	Medium	Cloudflare WAF and challenge rules for sensitive routes
Signer-service / KMS migration	Medium	Optional future migration from Doppler-injected runtime secrets to a dedicated signer-service or KMS-backed signer model
Monitoring and alerting	Medium	Alerts for failed executions, replay attempts, NAV updates, Safe transactions and unusual backend activity

12 / Deployment records

Polygon deployment artifact.

This section is the address and verification reference. Contract purpose is summarized in Contract Inventory; full topology is covered in the Smart Contract Structure Report.

NetworkPolygon

Chain ID137

Deployment time2026-05-20T19:24:58.692Z

Verification reviewPer contract

Verification Status Notes

Verified: Source code matches deployed bytecode and is publicly available.
Pending: Verification review has not yet been completed or published.
Not Verified: No public verification record currently available.

Component	Address	Verification Status	Record
USDPROP Token	`0x6F6c5Ab2865E028beDFEbabD86E046D73EAC5826`	Verified	Polygonscan
IdentityRegistry	`0x82e04Ac5abC1c6979781aeB2ACa5133B59f86bac`	Verified	Polygonscan
ModularCompliance	`0x42a133b07c53FEb1043Ac84481993ceec72D1294`	Verified	Polygonscan
USDPROPComplianceModule	`0x6A7863dF05D06956bfE8B7650f2c2983e214bDcc`	Verified	Polygonscan
ClaimIssuer	`0x656B7DDFf86ce7aBE9E86A8bf97642d55B95a61a`	Verified	Polygonscan
NAVOracle	`0x356B60F2600D0454871F9492a4B90cE750b0F9a9`	Verified	Polygonscan
InvestmentManager	`0xe901ef0395850A217b19F2cc0819527ae4D2949f`	Verified	Polygonscan
DividendDistributor	`0x26FaD8d74c2Eb3461c94e5CeAC8e8AEb48e6D1D1`	Verified	Polygonscan
Safe Treasury	`0xe1f7615962BcFEE1C9992A2c501702130835f92c`	Verified	Polygonscan
USDC	`0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359`	Verified	Polygonscan

13 / ABI and integration

Integration references and fresh deployment checklist.

ABI and address bundles are maintained with the externally owned investor runtime and deployment artifacts. A clean mainnet deployment is estimated at 4 to 6 hours including Safe setup and ClaimIssuer configuration.

Repository Structure

Reference layout used for contracts, deployment records, testing, operations and investor runtime.

contracts/Solidity contracts and interfaces, including UUPS upgradeable core contracts.
scripts/Deployment, verification, upgrade, NAV, KYC, dividend and operational helpers.
deployment.jsonCurrent deployment record consumed through DEPLOYMENT_PATH and scripts/deployment-loader.js.
test/Unit, integration, regression, deployment-loader, gas and UUPS upgradeability tests.
docs/Architecture, validation, deployment and due diligence documents.
external investor appInvestor-facing runtime application maintained in a separate repository.
external investor backendExecution-agent API maintained in a separate repository.
frontend/Legacy/admin-facing frontend assets and synchronized contract references where applicable.
backend/Legacy/admin API and internal integration services where applicable.

Production and Polygon staging deployments are resolved through DEPLOYMENT_PATH and DEPLOYMENT_ENV. Formal mainnet deployment requires separated NAV agent, 7 external Safe owners and Safe threshold 5 of 7.

External Dependencies

External protocols, libraries and infrastructure components relied upon by the deployment.

Polygon USDC OpenZeppelin Safe T-REX ONCHAINID

Prerequisites

Polygon RPC endpoint
Deployer EOA with POL for gas
Safe multisig (5/7) configured
USDC balance for initial NAV test
KYC agent EOA, separate from owner

Deploy order

Identity contracts (ONCHAINID)
Compliance module
Token (ERC-3643)
NAVOracle and InvestmentManager
DividendDistributor
Transfer ownership to Safe

Downloads and interfaces

Transaction example

const manager = new ethers.Contract(
  INVESTMENT_MANAGER,
  investmentManagerAbi,
  signer
);

// Pseudocode. Confirm exact ABI before execution.
await manager.investWithConsent({
  amountUSDC,
  minTokensOut,
  deadline,
  nonce,
  signature
});

Event category	Operational use	Consumer
Investment execution	Subscription audit trail and investor app state	Backend, investor app, operations logs
Transfer validation	Restricted ownership movement evidence	Compliance review, operations
Claim update	KYC/eligibility change trail	KYC panel, compliance review
Distribution	Dividend lifecycle and settlement state	Investor app, fund operations

14 / Gas and operations

Hardhat gas benchmarks.

Gas values are generated from the local Hardhat test suite using gas reporter. They are benchmark results from the local test environment, not actual Polygon mainnet transaction receipts.

Report context

REPORT_GAS=true npx hardhat test completed with 256 passing tests in 6s. Compiler settings: Solc 0.8.22, optimizer enabled, 200 runs, block limit 60,000,000 gas.

Operational gas benchmarks.

Method-level gas reported by the local Hardhat gas reporter suite. Max values are shown only where reported by the benchmark output.

Contract	Method	Average gas	Max gas	Primary drivers
InvestmentManager	`invest`	666,596 gas	1,023,888 gas	Legacy investment path, USDC transfer, compliance checks and token issuance
InvestmentManager	`investWithConsent`	721,289 gas	Not reported	EIP-712 consent validation, nonce/deadline checks, USDC transfer, compliance checks and token issuance
InvestmentManager	`redeem`	197,701 gas	Not reported	Legacy redemption path, lock-up checks, token burn and USDC settlement
InvestmentManager	`redeemWithConsent`	223,722 gas	Not reported	EIP-712 redemption consent, lock-up checks, token burn and USDC settlement
InvestmentManager	`permanentlyDisableLegacyPaths`	35,854 gas	Not reported	Governance hardening action for legacy execution paths
NAVOracle	`setNAV`	105,700 gas	Not reported	Authorized NAV update, cooldown and delta-limit enforcement
NAVOracle	`setNAVEmergency`	101,330 gas	Not reported	Emergency NAV override path controlled by ownership authority
NAVOracle	`setOracleLimits`	56,623 gas	Not reported	Oracle limit configuration
DividendDistributor	`depositAndDistribute`	252,212 gas	Not reported	USDC deposit, distribution accounting and settlement record update
DividendDistributor	`claimDividends`	107,965 gas	Not reported	Investor dividend claim and accounting update
DividendDistributor	`emergencyWithdraw`	49,135 gas	Not reported	Emergency withdrawal of uncommitted excess balance
DividendDistributor	`settleInvestorWithBalance`	52,266 gas	Not reported	Investor settlement state update using balance input
USDPROPComplianceModule	`migratePurchaseTimestamps`	121,858 gas	Not reported	Lock-up timestamp migration support
USDPROPComplianceModule	`finalizeLockupMigration`	52,199 gas	Not reported	Migration finalization control
USDPROPComplianceModule	`initializeOfac`	206,097 gas	Not reported	OFAC configuration initialization
USDPROPComplianceModule	`blockCountry`	55,085 gas	Not reported	Country restriction activation
USDPROPComplianceModule	`unblockCountry`	32,079 gas	Not reported	Country restriction removal
SafeMultisig	`proposeTransaction`	264,993 gas	Not reported	Generic proposal creation and calldata storage
SafeMultisig	`confirmTransaction`	167,598 gas	Not reported	Signer confirmation and possible execution when threshold is reached
SafeMultisig	`proposeApproveUSDC`	380,960 gas	Not reported	USDC approval proposal helper
SafeMultisig	`proposeDistributeDividends`	367,914 gas	Not reported	Dividend distribution proposal helper
SafeMultisig	`proposeAddOwner`	337,266 gas	Not reported	Owner addition proposal helper
SafeMultisig	`proposeRemoveOwner`	339,722 gas	Not reported	Owner removal proposal helper
SafeMultisig	`proposeChangeThreshold`	270,109 gas	Not reported	Threshold change proposal helper

Deployment gas benchmarks.

Contract deployment gas from the same local Hardhat gas reporter run.

Deployment component	Average gas	Primary drivers
USDPROPComplianceModule	4,780,743 gas	Compliance rule deployment, OFAC controls, lock-up logic and investor limits
InvestmentManager	3,443,935 gas	Subscription execution, redemption flow, consent validation and USDC settlement
Token	3,304,160 gas	ERC-3643 token logic, agent controls and transfer hooks
SafeMultisig	2,443,993 gas	Custom treasury governance, signer set and threshold configuration
DividendDistributor	2,420,162 gas	Distribution accounting, deposit and settlement logic
NAVOracle	1,848,464 gas	NAV storage, update limits and updater permissions
Identity	2,452,051 gas	ONCHAINID identity contract deployment
ClaimIssuer	2,714,490 gas	Claim issuer identity and claim signer permissions
IdentityRegistry	1,378,514 gas	Investor registry, country mapping and identity lookups
ModularCompliance	1,260,357 gas	Module registry and transfer validation dispatcher
TrustedIssuersRegistry	1,042,863 gas	Trusted issuer list and claim-topic authorization
IdentityRegistryStorage	956,786 gas	Registry storage and binding permissions
MockUSDC	664,328 gas	Local test settlement asset deployment
ClaimTopicsRegistry	478,595 gas	Required claim-topic setup
ERC1967Proxy	266,718 gas	Proxy deployment and implementation pointer

Interpretation note

These benchmarks are useful for relative comparison across methods and deployment components. Actual Polygon costs depend on live gas pricing, calldata, state access, contract state, RPC conditions and transaction inclusion behavior.

Regression Validation Report

Independent review package documenting regression coverage, security controls, protocol invariants, governance validation and operational risk assumptions.

The USDPROP validation suite covers deployment, hardening, identity, claims, compliance, investments, redemptions, treasury operations, governance controls, security protections and historical vulnerability regressions.

256Automated Regression Tests

13Functional Categories

42Access-Control Tests

74Negative-Path Tests

19Critical Security Behaviors

100%Pass Rate

Coverage Highlights

256 Automated Tests
74 Negative-Path Scenarios
42 Access-Control Tests
19 Critical Security Behaviors
Governance Validation
Treasury Validation
Compliance Validation
Deployment Validation
Threat Model Coverage

All tests are documented in the dedicated Validation Report.

Download Validation Report View Architecture PDF

Includes

Executive Validation Dashboard
Coverage Metrics
Security Requirements Matrix
Protocol Invariants
Negative Scenario Coverage
Audit Evidence Matrix
Trust Assumptions
Operational Failure Scenarios
Red Team Review

15 / Audit and review status

Published review state and known limitations.

Do not treat this page as an audit report. It is a technical architecture reference for review preparation.

Audit status

No external audit report is published in this repository at this time.

Review status

Deployment records and public addresses are available. Formal verification, source matching and role review must be performed per deployment.

Planned upgrades

Recommended review areas include monitoring, admin runbooks, signer continuity, KYC provider adapters, gas reporting and source verification pack.

Validation Status

Regression coverage, pass rate and evidence mapping are centralized in the Regression Validation Report.

See Validation Report for detailed coverage and evidence mapping.

Production Readiness Checklist

The following checklist summarizes completed diligence items and remaining actions before formal production sign-off.

Completed

Mainnet deployment records published.
Listed deployed contracts verified on Polygonscan.
EIP-712 consent flows documented.
Regression validation report available.
Network perimeter documented.
execution agent blast-radius controls documented.
Doppler runtime secrets management active for backend production secrets.
NAV authority separated from administrative authority.
Safe governance expanded to 7 signers.
Safe execution threshold increased to 5 of 7.

Pending before formal production sign-off

External smart-contract audit.
Legal and regulatory memorandum or opinion.
SSH VPN restriction.
Signer-service or KMS-backed signing review.
Monitoring and alerting runbook.
Independent review of Safe owners, threshold policy, signer rotation and recovery procedure.
Dependency and package review for frontend, backend, Hardhat, ethers.js and OpenZeppelin dependencies.

Known limitations

KYC provider decisions are off-chain trust inputs and require provider-level due diligence.
NAV inputs require operational governance and monitoring.
Admin roles, issuer roles and Safe signer policies remain deployment-specific trust assumptions.
Gas ranges are estimates and should be profiled against deployed bytecode.

Off-chain layer

Legal Document Room.

Base legal document templates used as operational references for private placement structuring, investor subscription, regulatory notice workflow and tax documentation. Templates are reference material, not legal advice.

Private placement document references

Common legal documents used in private placement and investor onboarding workflows.

PPM

PPM (Private Placement Memo) Fund terms, risk factors, and disclosures for accredited investors.

PDF Template Download template

SUB

Subscription Agreement Legal contract for token subscription and accreditation declaration.

PDF Template Download template

FORM D

SEC Form D (Template) Notice of exempt offering of securities under Reg D Rule 506(c).

PDF Template Download template

TAX

Tax W-8 / W-9 Forms Withholding tax certificates for domestic and foreign investors.

PDF Template Download template

16 / Documentation

Primary technical due diligence artifacts.

Review architecture, validation evidence, infrastructure security, deployment records and source references before conducting independent verification.

Architecture PDFDownload Architecture PDF Validation ReportDownload Regression Test & Validation Report Infrastructure SecurityDownload Infrastructure Security Reference Admin Operations GuideDownload Admin Operations Guide Fund Operations CapabilitiesDownload Fund Operations Capabilities Smart Contract StructureDownload Smart Contract Structure & Deployment Report Deployment LogDownload Deployment Log Contract repositoryPolygonscan source tabs Deployment recordsPolygon addresses and roles API documentationBackend health endpoint WhitepaperUSDPROP White Paper v1.2

USDPROP Technical Architecture

ERC20 vs USDPROP controlled issuance model

Simple ERC20

USDPROP Stack

Contract architecture and stack parameters.

Contract architecture

Topology Summary

Roles and permissions

Governance update record

Technology Stack

ERC-3643

ONCHAINID

Polygon

USDC

Safe

Technical Due Diligence Quick View

Due Diligence Assets Available

Primary Technical Artifacts

On-chain enforcement with off-chain eligibility inputs.

Component map

Dependency map

Trust boundaries

On-chain responsibilities

Off-chain responsibilities

Contract Inventory

Deployed contract responsibilities and dependencies.

USDPROP Token

IdentityRegistry

ModularCompliance

ClaimIssuer

InvestmentManager

NAVOracle

DividendDistributor

Safe Treasury

Roles & Permissions Matrix

Upgradeability Matrix

How contract upgrades work.

Storage layout rule

investWithConsent() execution path.

Nonce handling

Deadline handling

Slippage controls

Replay protection

redeemWithConsent() control path.

Consent model

Redemption controls

ONCHAINID identities and issuer-backed claim topics.

ONCHAINID

IdentityRegistry

ClaimIssuer

Transfer validation before ownership movement.

canTransfer()

moduleCheck()

Claim requirements

Launch modules and integration surfaces around the deployed issuance, identity, compliance, settlement and treasury system.

Safe multisig as the treasury control boundary.

Approvals

Signer rotation

Threshold model

NAV-based accounting and investor settlement lifecycle.

Distribution lifecycle

Investor settlement lifecycle

Threat model, mitigations and residual risks.

Cloudflare edge protection, nginx reverse proxy and private Express runtime.

Network perimeter

Traffic path

Server configuration

Application-layer controls

Critical routes subject to rate limiting

/api/invest/execute

/api/invest/waitlist

Execution agent threat model

What the execution agent can do

What the execution agent cannot do

Execution boundary

Compromise scenario

POL balance policy

Residual-risk framing

Execution agent key handling

Mapping to validation report findings

`investWithConsent()` execution path.

`redeemWithConsent()` control path.

`canTransfer()`

`moduleCheck()`

`/api/invest/execute`

`/api/invest/waitlist`