Clearing House

Demo

About

CLEARING HOUSE is a settlement venue for tokenised bonds, running live on Hedera's testnet. Anyone can connect a wallet, get verified and funded in a few seconds, and actually clear a trade against the real chain. It fills a specific gap. Platforms like Hedera's Asset Tokenization Studio can issue a compliant bond, but they don't ship a market to trade it. And in any bond trade, the real danger is the two sides settling separately: one party can hand over the bond while the other fails to pay. CLEARING HOUSE removes that risk by settling the bond and the cash in a single transaction- both move, or neither does. There is no in-between state where only one leg completed. Compliance is enforced inside that same settlement, not as a separate step afterward. Before anyone signs, the venue asks the chain itself whether each side of the trade is even allowed to move, so a buyer who has lost their verification simply cannot be filled, and a rejection comes back with a real, named reason instead of a generic failure. The part that sets it apart is that the venue cannot lie about what it cleared. A separate, independent checker rebuilds every trade's compliance from public chain data alone — sharing no code with the venue and compares that against what the venue reports. If the venue ever fabricated a trade or misreported who it settled for, the checker flags it immediately. Users don't have to trust the operator; they can verify it themselves. It's built on Hedera for issuance and settlement, uses The Graph to reconstruct that compliance history independently, and can settle the cash side over Circle's Arc as an alternate payment rail. Every part of it is real: real tokens, a real on-chain escrow backing every resting order, and real atomic settlement recorded on a public chain.

How it's made

The core is a set of Foundry-built Solidity contracts. A matching engine talks to trades through one interface, so the two legs, bond and cash, are handled identically regardless of chain or token. Settlement executes both legs in a single transaction or reverts entirely; there's no path that leaves one leg settled and the other not. It enforces two rules: a preflight that never reverts (so it names a reason before anyone signs) and an execute that must revert on failure, unwinding the whole trade. Hedera is the backbone. Bond and cash are issued via Hedera's Asset Tokenization Studio as ERC-1400/3643 compliant tokens. The key mechanism is the ATS Hold: seller and buyer each escrow their leg in a hold naming the venue's settlement contract as escrow. Because the token only checks that the caller equals that escrow, the venue needs no role, whitelist, or issuer trust to move held tokens, enough to run a permissionless market on a compliant token. Compliance is checked inside settlement, so a party who lost verification can't be filled. Contracts are source-verified on HashScan. The Graph keeps the venue honest. A subgraph ingests two independent streams — settlement receipts and token identity events — and reconstructs each trade's compliance in the mapping, sharing no code with the venue, so it catches a fabricated or misreported trade. The same check is exposed as an MCP server, so an agent can independently ask whether the venue lied. Arc (Circle) is the swappable cash rail: the engine can settle payment over Arc's Memo contract, emitting a USDC transfer from the payer plus an indexed memo with the trade id, so anyone can reconcile the payment to its trade from logs. Arc's CallFrom precompile means the payer submits the memo call directly. The venue is a Next.js/TypeScript app using viem. The order book and matching are off-chain, but every resting order is backed by a real on-chain hold. Users sign their own holds with an injected wallet; the operator signs onboarding and settlement server-side. Onboarding is open the operator verifies and faucet-funds any address in seconds. Hacky bits: the contracts target the "paris" EVM so one artifact deploys on both Hedera and Arc; the mirror node rejects topic filtering without a time bound, so we pull all logs and filter client-side; the hold preflight treats "insufficient funds" as passing, since the balance is short only because it's in the hold; and onboarding awaits four sequential receipts (~35s), so we raised the serverless timeout.