CMTAT: Engineering a Security Token on EVM, with a Path to Privacy

Transcript

? OK parfait. Euh thank you everybody to be here. So I will start my presentation on TMTI and how to engineer security token on EVM with a path to privacy. So to just to present briefly the the project, uh TMTI is a security standard uh token standard framework with a multi-blockchain support. Uh so we have one implementation for for Ethereum and all EVM-based blockchain.

One one implementation for Tezos and specification for Solana. And we have also explored privacy technology with one implementation for Aztec and one for Zama. And it's used by several different companies. So Taurus, UBS for a money market fund, Obligate and so on. And the last year we've also seen uh a use with design for a stablecoin. For the EVM version, which is the main focus on this presentation, it's written in Solidity, built on top of ERC uh 20 and OpenZeppelin libraries.

For the security, major releases are audited by Alboard, which you have one people here, and Halborn and for minor releases we use static analyzer. And recently we also IO audit agent tools such as Nethermind, Deda and Verica Arena by Hacken. And for the challenge, uh we have uh uh when we design a security token, we want uh to uh we want the token to be used in several different use cases, so equities debt stablecoins several jurisdictions, so not only for example in Switzerland, but also uh Germany, France, uh Middle East.

And uh so uh to achieve this, said the code base may be flexible, modular and easily adaptable. We also want to integrate with the Ethereum ecosystem through different ERC. So for So for the architecture, functionalities are separated into different modules, so abstract contract. And from these different modules, we we create base contract and then deployment contract. So typically, if you want to to come and build your own security token, you can just take the module you want and build your own security token.

Otherwise, you can also use deployment contract and directly use it. We also provide some utility contracts such as the rule engine and rules to apply a a more compliant rule such as for example vesting rules. And for the different Ethereum standard, so we have four four categories of Ethereum standard. So we have the token standard, then all standards related to tokenization, then we have standards which are related to to proxy and upgradeable support, and finally, we have pure technical standards such as gasless, uh cross-chain,

uh cross-chain transfer and so on. So I don't have the time to explain to explain all of them, but in general, we will try to to implement the full standard. Some Some standards are only available through specific deployment version. Um And now we we also try to to make the the token multi-chain. Um So for So when you you you want to deploy your security token across different blockchains, you have several different challenges. So you have to maintain the same right and properties on each blockchain.

Uh you have to ensure a consistent whitelist/blacklist across all these blockchain and you have to enable transferability between these different blockchain which is the main focus now um uh for Sim Titi. So we have for that we have several key consideration. So you have to select the bridge and integrate it. You have the compatibility between your token and the bridge. And also you have to configure the bridge and the support. So typically we have some specific modules inside Sim Titi uh which are specific to this cross-chain technology.

So we have typically one module for optimist uh standard and all optimist based blockchain such as Inchain. We have also one module to to to support the Chainlink CCIP. And for Layer Zero, we have now external contracts. Uh so two adaptors which can be used uh with Sim Titi uh to enable cross-chain transfer through Layer Zero. And for the privacy um so now we have there is there are a lot of different technologies so you have to to select which technology you want to use. So we have started with Aztec uh written in Noir and this year we have we made a version for Zama.

And when you define uh a security token which is private, you have to to decide which information is public and which information is private. So typically the address, the balance, the total supply. Um for example for Zama the address all the addresses are public uh but the balance are private. And depending of what field you want to to put to to to make public, you will leak some information. So typically the total supply is made public, uh you may potentially leak some information when you mint and burn tokens.

And uh finally, you have to add compliance features. So, for example, viewing key to allow uh to allow an external auditor to to see the balance, uh address freezing and burn functionality, which may be more difficult to implement on a privacy token. And finally, for the integration, so it's not related directly to to the token, but it's it's may be more complex for for each institution to and to integrate into their systems. Uh you have additional components to manage. For Zama, typically, you have the KMS and the gateway.

And for Astek, you you have all the encrypted private notes, the new first, and the viewing key. And since the on-chain state is private, uh you have you you need the private key to to decrypt the balance and state. So, if you you have an explorer or an indexer, uh you need each time the the private key just to to see the balance. And uh it's all. So, if you are interested, you can go go and see our GitHub. All the contracts are open source. So, you can use it. You can build your company uh with that. And voilà.

And if uh if you have some questions, I am available. Feel free to ask now or to or to contact me on X and LinkedIn. Um I'm I'm launching a gold token based in Switzerland, and we're going to use the light version of the CMTA T token. Um and I was wondering if the it's planned to uh because you currently have certification for for example, if somebody's issuing a bond or an equity uh on the tax side, and also that law firms confirm uh that it's done correctly. Are you planning to branch

out to real world assets as ? Euh not my current knowledge but you can ask I think the Simtier Simtier organisation. I am more on the tech side. So maybe maybe but I cannot really answer. But it's good to see you you will use Simtier. Feel free to ask if you have some question about the smart contract. Another ? Perfect.

Thanks a lot for your attendance. And