EVM Contract Set

One generic, standards-based token contract, not a menu of asset-specific contracts, carries every instrument issued on this ledger.

Every ordinary transfer checks identity and compliance inside the same transaction that moves value, except for the platform's own bypass list; a failed check reverts before any balance changes.

A single custodian role can freeze an address, force a transfer, or recover a lost wallet's tokens without a second signer's on-chain consent.

Multi-party trades use a dedicated escrow contract. Local-only execution is atomic; hashlock-committed settlements can defer blocked deliveries. See XvP SettlementXvP Settlement lets two or more parties exchange tokenized assets without either side delivering first: local legs settle atomically, external legs by hashlock.Read the concept.

Custody calls use one role; the signing account supplies additional approvalCopy Anchor Link

The EVM (Ethereum Virtual Machine) Contract Set does not ask a second party to co-sign a transfer, a freeze, or most recoveries. Use a custody approval policy or a weighted Smart Wallet when a privileged call needs more than one approver. The EVM Contract Set is the on-chain half of the platform on EVM chains: one Composable TokenA Composable Token lets an issuer bring a new regulated instrument to market by configuring facts, features, and rules, not new contract code.Read the concept configured per instrument, meaning one regulated contract deployed per issued asset rather than a different contract per product type. It builds on published standards an outside auditor already recognizes: ERC-3643 for identity-gated transfers, ERC-20 as the base fungible interface. The coverage question stops being "which fixed asset types does the platform support" and becomes "which instrument terms does this configuration carry."

The commitment worth understanding before choosing this ledger is enforcement placement. A compliant transfer is not a policy an off-chain system is trusted to apply; it is a condition the contract itself checks before the balance changes. A transfer that would violate compliance cannot settle and then get unwound later, because it never settles in the first place.

Custody power concentrates freezing and forced transfer in one custodian role, and the contract asks for nothing more than that role to exercise them. Recovering a lost wallet has two paths instead of one: the identity registry's named replacement wallet can claim the balance itself once the registry flags the original wallet lost, or the custodian role can force the same recovery directly. Institutions pair the custodian role, and who the registry may name as a replacement, with their own authorization policy before granting either (see Custody ApprovalCustody Approval lets you require a decision from your own approvers before a key signs, enforced by the party holding the key, not the platform.Read the concept).

A failed compliance check reverts the transferCopy Anchor Link

A transfer that fails compliance reverts during execution, inside the same transaction that would have moved the balance. No separate remediation queue exists to run afterward: the sender sees the failed transaction, and no balance anywhere has moved. The fix is not to resubmit the same request. It is to fix the eligibility, scope, limit, or approval condition the failing module flagged, or to get the receiver registered and cleared in the identity registry if that check is what failed. Compliance PolicyA Compliance Policy lets a compliance team write eligibility and holding rules once, while a platform floor reaches every current-factory token.Read the concept covers how to find which tier, this instrument's own rules or the platform-wide floor, rejected the movement.

Day to day, the EVM Contract Set behaves as one deployed token per instrument. Issuing starts with an Instrument TemplateAn Instrument Template lets an issuer configure a new instrument from an approved shape, instead of re-deciding what it records, does, and permits each time.Read the concept, not a request for a new contract: the template supplies the facts, features, and compliance choice, and deployment produces one configured token that already carries identity and compliance enforcement.

Servicing steps read the same way. Freezing an address, freezing part of a balance, and forcing a transfer are each a single call from whoever holds the custodian role for that asset. Recovering a lost wallet's tokens can be that same call, or a direct call from the registry-named replacement wallet instead. None of them wait on a second signer at the contract level. Freeze the whole address when the wallet itself is the concern: a full freeze blocks both directions, so it can neither send nor receive, and a mint to it reverts too. Freeze part of the balance instead when only a specific amount needs to hold: a partial freeze locks that amount while the holder keeps receiving and keeps spending whatever sits above it.

Trades between counterparties settle through a dedicated escrow contract rather than the token contract itself. See XvP Settlement for local atomic execution, external coordination, and deferred deliveries.

The compliance check runs inside the same step that moves the balanceCopy Anchor Link

The low-level operation that changes a balance is the same operation that runs the compliance check, so an ordinary transfer or mint cannot settle without that operation running. Two deliberate exceptions covered below break that pattern: the platform's own bypass list, and the custodian role's privileged powers. The EVM Contract Set combines identity, compliance, features, and custody around the token. First, an identity registry with trusted issuers decides who may hold the asset at all (see Onchain IdentityAn On-Chain Identity lets a subject's verification serve every asset that accepts it, so a screened wallet skips re-onboarding for the next regulated asset.Read the concept). The Composable Token itself carries identity checks, roles, and metadata. Second, a compliance layer evaluates every ordinary transfer or mint twice. It checks this instrument's own compliance modules first, small rule contracts plugged into the token that each test one condition such as eligibility or a holding limit. Then it checks a platform-wide set of the same kind of module that applies across every instrument on the deployment. Third, Token Features can approve or refuse an operation before it runs, and when one rewrites an operation it can split it into several legs. A fee feature, for example, turns one transfer into a net leg plus a fee leg rather than moving the requested amount whole. Fourth, a custody layer sits alongside, with its own privileged bypass. Put a rule at the instrument tier when it belongs to this issuance's own terms, such as an eligibility test or a holding limit unique to the offering. Put it at the platform tier when it has to hold for every instrument regardless of terms. Compliance PolicyA Compliance Policy lets a compliance team write eligibility and holding rules once, while a platform floor reaches every current-factory token.Read the concept names which rules belong at which tier, and Transfer-Path ComplianceTransfer-Path Compliance enforces a regulated token's rules inside the on-chain transfer itself, so a movement that fails any rule reverts and never settles.Read the concept describes the general mechanism this contract set implements.

Two conditions decide an operation without evaluating the ordinary compliance rules at all, one clearing everything and the other blocking everything. Compliance keeps its own bypass list, separate from the instrument's own modules and the platform-wide set. An address the platform's compliance administrators, or the automation that provisions a new instrument or addon, add to it returns cleared instantly from every check, skipping both tiers for any transfer or mint into it. A paused token works the other way: every ordinary transfer, mint, and burn fails outright before compliance runs at all. The fix is to wait for the emergency role that paused the token to lift the pause, not to resubmit differently.

Minting passes through the identical gate as an ordinary transfer, with its own revert reason. Burning is different: it has no destination address for identity or the ordinary compliance modules to check, so those two checks do not run. That is not the same as unconditional. A burn still runs through the custody layer, so a frozen sender's own redemption reverts. It still runs through Token Features too, so a feature such as a conversion lock can refuse a burn on the same terms it would refuse a transfer.

The custodian role's privileged powers skip the ordinary compliance and freeze checks by design, since a freeze or a forced transfer is itself the enforcement step, not something compliance needs to re-approve. Two things they do not skip. The receiving wallet's identity check still runs, so even a forced transfer cannot deliver tokens to a wallet the identity registry has not verified. A current registry checks the required claims; older registries can fall back to registration. And the ledger records the write: a forced transfer records as a transfer, with the custodian's step recorded as its own on-chain event. Recovering a lost wallet is the one custodial power with a second path. The identity registry's named replacement wallet can claim the balance itself once the registry flags the original wallet lost, with no role check at all, or the custodian role can force the same recovery directly. Custody functions are gated by a single role check made by the platform's access manager, the per-token contract that records role assignments and answers whether a caller holds one.

Read the outcome of a submitted transactionCopy Anchor Link

A simulation or preflight can reject a blocked transfer before submission. A transaction can also revert during on-chain execution after the Platform API has accepted the request. Follow the accepted request's status until its outcome is recorded. The error code reference names every reason along with what it takes to clear each one. A burn skips recipient eligibility checks, but a feature or a stateful compliance hook can still revert it. Read the failure details and resolve the cause before starting another attempt.

The EVM Contract Set is otherwise a standards surface: ERC-3643 for identity-gated transfer semantics, ERC-20 underneath for the base fungible interface. A wallet can submit these transactions directly, or through ERC-4337 account-abstraction infrastructure when an integration wants sponsored or batched submission; that infrastructure is a separate layer from the contract set itself.

Custody operations are ordinary contract calls gated by a role check, with no additional signature payload from a second party required at the call level. Multi-party settlement integrates through the settlement contract's own interface, not through the token contract; see XvP Settlement.

The control and the transaction are one object, so nothing settles then reversesCopy Anchor Link

For an auditor, the EVM Contract Set makes the control the same object as the transaction it controls. Every ordinary transfer is checked twice inside one transaction: this instrument's own compliance modules, then a platform-wide set of rules evaluated the same way for every instrument on the deployment. A failing check reverts before any balance changes, so there is never a window in which a non-compliant transfer is settled and then reversed. The platform's own bypass list is the one address-level exception, and it is a recorded administrative decision, not a gap an ordinary sender can reach.

Custody enforcement on this ledger is single-role authorized: the contract itself asks for one role check, not a second party's on-chain consent, for freezing, forced transfer, and recovery. Controls that require multi-party sign-off for those steps live in the platform's own operating policy around who may hold that role (see Custody Approval), not in the contract's own logic.

On-chain events and receipts record contract execution. Keep the platform audit trail and approval evidence as well: the chain alone does not identify every human decision behind a signing account.

Frequently asked questionsCopy Anchor Link