Remate

Demo

About

Remate is a secondary market for a tokenized bonds and its KYC'd users. A holder auctions an exit; only wallets already KYC'd for that bond can bid and buy. It is a first-price exit auction, started by the holder, on an ATS hold with no live quote: sealed reserve, USDC on Arc, award in a Chainlink CRE confidential workflow, compliance enforced by the token at delivery. How it works. The seller lists by placing an ATS hold with ExitAuction as escrow. The bonds never leave the seller's wallet and keep earning the coupon. The reserve is sealed — only its hash is on-chain. Eligible investors approve and placeBid in USDC into BidEscrow on Arc testnet. A wallet without KYC for that bond is blocked in the app; executeHoldByPartition would revert anyway. After the deadline a Chainlink CRE handlerInTee is built to read the sealed reserve and a confidential compliance screen and to write a DON-signed report to BidEscrow. The highest eligible bid at or above reserve wins and pays its own bid. The operator then executeHold on Hedera and confirmDelivery on Arc. USDC is released to the seller; losers withdraw. Hedera holds the ATS bond (whitelist, internal KYC, coupon) and ExitAuction. Arc holds native USDC and BidEscrow. Chainlink holds the confidential award.

How it's made

Remate is a secondary market for a tokenized bond and its KYC'd users. A holder who has no live quote auctions an exit. Only wallets already KYC'd for that bond can bid and buy. We built the rails so that constraint is the token's, not a checkbox in our UI. Issuance stays in Hedera Asset Tokenization Studio (web app): whitelist, internal KYC, coupon, holds. We did not rewrite the bond. Our Hedera contract is ExitAuction.sol — Foundry, Solidity 0.8.26, evm paris. The seller lists with createHoldByPartition, ExitAuction as escrow, then createAuction. The bonds never leave the seller's wallet and keep earning the coupon — the holder can seek a price without giving up the asset or its yield. Delivery is executeHoldByPartition: KYC and whitelist run at that instant. A wallet that is not KYC'd for that bond is blocked in the app; the token would revert anyway. The cash leg is BidEscrow.sol on Arc testnet. Buyers approve native USDC (0x3600…0000) and placeBid. That is the business of the auction: public bids, dollar settlement, pull withdrawals for losers. confirmDelivery pays only the registered seller. The award must not be a venue operator picking a friend. packages/cre-award is a TypeScript CRE workflow with handlerInTee (@chainlink/cre-sdk). Inside the confidential handler it fetches Vault secrets, the sealed reserve and a compliance screen over authenticated HTTP, checks keccak256(reserve, salt) against the on-chain commitment, and computes a first-price award. Only winner, price, commitment, outcome and digest leave. Confidential Workflows are in private beta; we simulate with the CRE CLI. The simulator is not a hardware TEE. BidEscrow also has a documented awardByOperator fallback (visible as source=Operator). The app is a Next.js 15 monorepo (apps/web, apps/landing) with wagmi, viem and React Query: market, sell, auction, operator. Route handlers and a JSON store index auctions. An operator key mirrors the auction to Arc, triggers close, executeHold on Hedera, and confirmDelivery on Arc. Two chains, coordinated steps — not one atomic settlement. The operator can stall, void or cancel. It cannot redirect USDC or deliver to a non-compliant wallet. What was hard, and why it matters: holds instead of approve/transferFrom (the ATS approve path needs a whitelisted spender; holds keep coupon entitlement). Arc's 20 gwei fee floor. The CRE forwarder address — sources disagree on simulation vs production; BidEscrow.setForwarderAddress exists for that. The hederaTxHash stored on Arc is a pointer for humans, not a proof. Hedera is the compliant asset. Arc is the USDC cash. Chainlink CRE is the award the operator does not decide. The product is the exit: bid and buy, only if you are already allowed to hold the bond.