Bond Desk

Demo

About

Bond Desk is a compliant corporate bond market on Hedera testnet, watched by a confidential Chainlink CRE enclave. The bond is a real Asset Tokenization Studio (ATS) token, created through the live ATS factory on testnet, so it carries its own KYC list, freeze list and transfer rules. An on-chain order book trades it against USDC and asks the token's own compliance check (canTransferFrom) before every fill: KYC is enforced by the contract, not by the UI. Three bonds with different coupon schedules trade on the desk today, each with its own book. Coupons are paid by the Hedera Schedule Service: the lifecycle contract calls HIP-1215 scheduleCall, Hedera executes it at the due time, and the executed call schedules the next coupon from inside itself. Collateral is native HBAR held in a vault and valued against the live Chainlink HBAR/USD feed on Hedera. Risk is handled by a Chainlink CRE workflow running inside a TEE. It reads the coverage, compares it with thresholds that never leave the enclave, and signs an EIP-712 verdict (OK, WARN, FREEZE, DEFAULT). Anyone can relay the verdict; the RiskGate contract checks the signature and the nonce, not the sender, and a FREEZE halts trading for that bond only. The policy is private, the verdict is public and verifiable. The same desk is a web app (a dense trading terminal with full keyboard control), a public OpenAPI service, a paid Bazantic gateway with an MCP server, and a Bazantic Recipe that chains three gateways (Hedera Mirror Node, Bond Desk, Bank of Canada Valet) so an agent can find the best bond a wallet is allowed to hold and whether its coupon beats the sovereign benchmark. Everything ran on Hedera testnet with verified contracts and a receipt for every step: issuance through ATS, KYC grants, a rejected non-KYC fill and an accepted KYC fill, coupons paid by the Schedule Service on their own, WARN and FREEZE verdicts relayed, a fill rejected while frozen, an unfreeze. Both CRE workflows are deployed on the CRE network: the bond monitor runs hourly against Hedera, and the liquidation-protection workflow defends our position in Chainlink's Sepolia challenge every 30 seconds. For Hedera's harness track we also opened PR #62 on hedera-dev/hedera-harness, which makes the harness prove that a scheduled transaction executed and that its child transaction succeeded. Live app: https://wd6nrvmajt.ap-south-1.awsapprunner.com · Docs: https://bond-desk.mintlify.site

How it's made

Contracts: Foundry, Solidity 0.8.28, OpenZeppelin v5. Six contracts (BondRegistry, BondMarket, CollateralVault, NavOracle, BondLifecycle, RiskGate) around ATS v8 bond tokens created through the existing testnet factory. ATS is treated as a black box behind its canTransferFrom, KYC, snapshot and freeze facets; we did not fork it. BondLifecycle is the Schedule Service payer: it calls scheduleCall on the 0x16b system contract and each executed coupon arms the next one. We hit the out-of-gas nested schedule and a block.timestamp lag on testnet and fixed both (4M schedule gas, a 10 s lag margin). RiskGate verifies EIP-712 verdicts: trusted signer, strictly increasing nonce per bond, freshness window. Chainlink CRE: TypeScript SDK, handlerInTee pinned to AWS Nitro, one batched JSON-RPC read per run because Hedera is not a CRE-supported chain, viem signing inside the enclave, secrets in the Vault DON. The same decide.ts policy module drives the Sepolia liquidation-protection workflow, which probes the challenge contract's onlyActive gate inside its read batch so it never spends gas outside a scoring window. The relayer (Node, viem) verifies the signature locally before paying gas; the deployed workflow can also deliver verdicts to Hedera itself. API and app: Hono on Node 22 with mirror-node history plus eth_call state, an OpenAPI 3.1 document that renders as an interactive reference in a browser and stays JSON for programs, served from one AWS App Runner image together with the Vite/React/wagmi app. The app is a trading terminal: sortable desk, depth ladders, keyboard for everything (j/k/Enter, b/s, arrows to nudge price), a compliance page that shows the token's own decision, a coupon page with the pending schedule, a risk page where anyone can paste and relay a verdict. Every write is simulated first, so a revert is decoded into a sentence before the wallet signs. Testnet self-service KYC works through EIP-191 signed messages and an officer key on the API. Bazantic: three gateways (Bond Desk API, Hedera Mirror Node testnet, Bank of Canada Valet, the last one written from scratch as an OpenAPI spec) and a Recipe with seven tool bindings, published through Bazantic's control MCP and tested on a KYC wallet and a no-KYC wallet. Hedera harness: our own Foundry harness with mocks for the 0x16b and 0x167 system contracts, a base test that fires due schedules, and doctor/verify/validate-schedule scripts (42 tests). Upstream, PR #62 on hedera-dev/hedera-harness adds a CHAIN-stage check that reads the scheduled child transaction at its execution timestamp on the mirror node, because the schedules endpoint cannot tell an executed-and-succeeded schedule from an executed-and-reverted one. We exercised the upstream branch end to end on testnet with real reverted fixtures. Hacky and notable: explicit gas overrides where hashio's estimator is wrong, the scheduling lag margin, splitting CRE secrets across two files to fit a 10-id cap, and discovering that cre execution logs returns confidential-handler logs once per DON node.