rehold

Demo

About

REHOLD is a repo-financing platform built on Hedera, on top of the Asset Tokenization Studio (ATS). It lets institutions post tokenised treasury bonds as collateral for short-term cash loans — with pricing, margin monitoring, and liquidation all running as smart contract logic instead of manual back-office reconciliation. The name comes from the core technical insight the platform is built around: collateral is never moved into a separate custody wallet, it is placed on Hold — locked in place under ATS's own native escrow primitive, in the investor's own compliant identity, until it's released or executed. The Problem Institutional finance runs on repo. Every day, trillions of dollars change hands in short-term loans secured by high-quality collateral — mostly government treasuries — because it's one of the safest, most liquid ways for cash-rich institutions to earn a return and for asset-rich institutions to access cash without selling what they own. But the mechanics behind that trade haven't caught up with what's possible today. A repo trade has two "legs": the cash leg (money moving from lender to borrower) and the collateral leg (the bond moving from borrower to lender, as security). The cash leg is often fast — but the collateral leg still runs on a parallel paper-and-legal process: custody agreements, manual valuation checks, phone calls and faxes to confirm a margin call, and overnight batch reconciliation to make sure both sides agree on who holds what. It's slow, it's manual, and it's opaque outside of the two counterparties involved. Tokenising the collateral changes what's possible. If the treasury itself is a compliant, programmable token, the collateral leg can become a provable, automatic, on-chain state change — the same trade, but the slow half disappears. What REHOLD Does REHOLD is a full repo desk for tokenised treasuries: Issuers create tokenised, KYC-gated treasury bonds through ATS, with real lifecycle features — coupons, maturity, redemption. Investors buy those bonds, then pledge them into REHOLD as collateral to raise cash without selling — the token gets locked in place, not moved to some separate custody wallet, so their compliance status and ownership record never leave their own identity. Lenders supply the actual cash liquidity that funds these trades, earning a return for taking on well-collateralized credit risk — the same economic role played by money-market funds and cash desks in the real $4-trillion-a-day repo market. A live price oracle continuously values the pledged collateral. If its value falls too far relative to the loan, the system automatically issues a margin call, and — if unaddressed — force-liquidates just enough collateral through REHOLD's own secondary market to restore safety, without anyone needing to notice, call, or intervene manually. At the end of the trade, either the borrower repays and gets their bond back, or — if they don't — a Hedera Scheduled Transaction fires automatically at maturity to settle the position, redeeming the bond at face value from the issuer rather than dumping it into a possibly depressed market. Every transfer anywhere in this flow — issuance, trading, pledging, liquidation, redemption — passes through ATS's own compliance machinery: KYC verification, freeze/blacklist enforcement, and pausability. None of it is bypassed or reimplemented; REHOLD is built to work with ATS's compliance layer, not around it.

How it's made

REHOLD is a repo desk that sits next to a live Hedera Asset Tokenization Studio bond. This repo is the cash/risk layer: Solidity on Hedera testnet (chain 296) plus a Vite desk.. Stack. Solidity 0.8.28 (Hardhat, OpenZeppelin, Hedera HTS precompiles). Four contracts: BondPriceOracle, RepoVault, SecondaryMarket, MarginEngine. Cash is Circle testnet USDC (HTS). UI is Vite + React + wagmi/viem against Hashio; MetaMask. Event tape comes from the Hedera Mirror Node. A Node keeper heartbeats NAV. Market view uses lightweight-charts. Architecture. Two layers, one chain. ATS owns the bond: KYC, allowlist, coupons, Hold, maturity redeem. ReHold never copies that. The vault is bond-agnostic: it takes a diamond address, looks up a per-bond NAV oracle, and lends from one USDC pool. The trade is a Hold, not a transfer. The investor authorizeOperators the vault. originateRepo locks units in place under their identity (createHoldFromByPartition), then sends USDC. Title never leaves them, so coupons still accrue. Repay pulls principal + fee, releaseHoldByPartition, done. Term is on the vault (termEnd), not hold expiry. Risk is a separate contract. MarginEngine.evaluate is permissionless: mark collateral with the 8-decimal NAV, then healthy (≥110%), issueMarginCall (102–110%), or liquidatePartial (<102%). Liquidation executes the hold, ships bonds to SecondaryMarket.sellOnBehalf, and sells only enough to restore 110%. Peer trades use the same book; ATS compliance still reverts ineligible transfers. ow it is pieced together. The investor stays the bond holder. RepoVault.originateRepo calls ATS createHoldFromByPartition as an operator, then wires USDC from the lender pool. Repay calls releaseHoldByPartition. If NAV falls under 102%, MarginEngine.evaluate (permissionless) executes the hold and SecondaryMarket.sellOnBehalf sells just enough to restore 110%. ATS still owns KYC, control list, freeze, coupons, and fullRedeemAtMaturity. We only vendor ABI shims that match the diamond’s selectors. Partners that actually matter. Hedera gives HTS (bond + USDC), HIP-719 association, and cheap marks. ATS Hold is the whole product: collateral locks in the investor’s identity instead of moving to a vault. Circle USDC is the cash leg. HashScan is the explorer we verify against. The hacky bits, all real: ATS rejects hold expiry 0 (WrongExpirationTimestamp), so we set expirationTimestamp = type(uint256).max and enforce term on the vault, not the hold — otherwise borrowers could reclaim via reclaimHoldByPartition. Creating a hold also burns ERC-20 allowance to the vault, so the desk has a separate Approve Vault step. HTS needs HIP-719 associate() on every EOA before approve/transferFrom; contracts associate in the constructor. Hashio wraps ATS AccountIsBlocked as RPC 0x128, so the UI pattern-matches both. Liquidation has no bid book — we scan asks and treat the seller as the cash-paying counterparty (demo-scale, O(n)). The NAV oracle is a single updater with a 30% circuit breaker; the keeper re-pushes the same price every 5 minutes just to refresh updatedAt. After every vault/market redeploy we must allowlist and KYC those contract addresses on the bond, same as people.