Plimsoll

Demo

About

Every tokenised asset today prices itself with a number its issuer typed in, and a market that trusts that number has no way to stop trading when it stops being true. Plimsoll is a market for tokenised notes backed by real ERC-4626 vault positions, where coverage is computed continuously from the vault flows themselves and never taken from the issuer. Nothing in the calculation is typed in: the note's obligations are read from its own supply and nominal value on Hedera, the holder is the note's own on-chain issuer, and we value what that address actually holds in the nominated vaults on Base, so a claim of backing larger than the real balance has nowhere to go. When coverage falls below the note's load line, the network refuses: transfers revert with a typed reason, coupons stop settling because the cash leg is frozen at consensus, and a paid request for a coverage attestation returns a signed refusal that is never charged. Moving the load line or halting a market requires a human to approve it on a Ledger device, and a refusal on the device produces no signature at all. The name comes from the Plimsoll line, the mark on a ship's hull made law in 1876 after ships were deliberately overloaded and sunk for the insurance: a visible limit past which the authorities will not let a vessel sail.

How it's made

Plimsoll is five pieces that each own one job. The truth layer is a Rust Substreams package (`packages/substreams`) that imports Pinax's ERC-4626 extractor by pinned URL, so its module hash and server-side cache are unchanged, and adds what they deliberately left out: a vault registry resolved by an `asset()` probe instead of topic0 matching, entry and exit rates kept apart so a fee spread cannot hide in one blended number, a `consistent()` check that refuses a zero or out-of-band share price, per-holder positions read with batched `eth_call`s inside the stream (`map_positions`), and Messari Yield Aggregator v1.3.1 entities, all from one spkg that runs on Ethereum and Base and is published to substreams.dev as v0.2.0; a cross-check script compares the stream against independent archive nodes wei for wei, and `check_package.py` refuses to release a package whose embedded README names a module the package does not contain, a check that exists because we shipped exactly that mistake once. An MCP server (`packages/mcp`, Streamable HTTP plus an A2A card) serves that feed with the package hash, module hash and block on every answer and refuses rather than serve a stale figure. The attestation service (`packages/attestor`, TypeScript with viem and the Hedera SDK) values the issuer's positions on Base with `eth_call` pinned to a block hash and corroborated by a second RPC, reads the note's supply, par, issuer and load line from Hedera so no number in the ratio is configured, and signs EIP-712 over `CoverageOracle`'s own domain and types, with a test that hashes the same payload in TypeScript and in Solidity; it is sold per call over x402 through Blocky402, where the `exact` scheme settles only after the handler succeeds, so any refusal returns a 4xx and settlement is never called, which makes a refusal free by construction rather than by refund, and every verdict is anchored to an immutable HCS topic so `verify-charge` can check from public data that a charge exists if and only if an attestation was warranted. The contracts (`packages/contracts`, Foundry, 201 tests, Sourcify-verified on Hedera testnet) put a coverage gate in front of an order book built on ATS's non-reverting `canTransferByPartition` pre-flight and `holdByPartition` escrow, pay coupons in an HTS cash token whose freeze key is a contract key with no admin key, and re-arm coupons with HIP-1215 `scheduleCall`; moving a load line or halting a market needs a mandate approved on a Ledger device through the Device Management Kit, the contract rebuilds the displayed text from typed arguments rather than parsing it, and the verifier answers only to its adapter while the adapter answers only to LoadLine, so a signed mandate cannot be spent through a side door. One command (`packages/verify`) checks all of it from public endpoints with no keys. The hackiest part: the Ledger Ethereum app reflows newlines into spaces and wraps at about nineteen characters, so a market code containing `NONCE: 9` could make a human approve what reads as a mandate with two nonces; we found it on the emulator and closed it with a charset rule enforced identically in TypeScript and Solidity. The most humbling part: our own checks caught an attestation we had submitted from test fixtures while the real backing was zero, and the deployment record now says so beside the stored number instead of letting it read as a measurement.