Documentation

Development Repository layout apps/frontend/ Vite + React UI apps/backend/ Fastify JSON API and OpenAPI document packages/core/ Pure ledger-domain logic, zero runtime dependencies packages/design-system/ Design tokens and domain-free React components docker/ Deployment images, compose f

Security boundaries Canton Lens relays credentials to a participant and displays private ledger data. Canton remains the authority for token validity and ledger visibility; the deployer owns every boundary before the request reaches Canton. Token boundaries | Profile | Credential location | Con

@canton-lens/design-system The design system for Canton Lens. Only tokens (CSS variables) and the domain-free primitives built from them live here. The boundary — what is not here This package knows nothing about the ledger. The words party · contract · lens · offset appear nowh

Canton Lens

Gating any CI — GitHub not required canton-stress gates a build the way every command-line tool does: it exits non-zero when an SLA is breached. Nothing about that is tied to a platform, a hosted service, or a repository host. node src/cli.ts run <dar> --workload-file <w.json> \ --min-thro

canton-stress — design & complexity > A load / performance / stress-testing harness for Canton applications > (app-level, not core protocol). Drives realistic high-concurrency, multi-party > transaction workloads at an app's DARs on a real ledger and measures how it > performs — throughput, la

Measuring large networks: the DSO on up to 43 participants Locally the DSO series stops at 8 hosts. This directory measures it on up to 43 participants, on one rented machine, in one command. (MainNet's DSO has 13 Super Validator nodes as of 2026-10-20; earlier versions of this page said 43, which

Daml contract source - fronow/Canton-Stress-Test/examples/network/metered/cosign/daml/CoSign.daml module CoSign where -- Signed by the issuer and every co-signer, so all of them confirm every -- transfer. The owner is an observer and the controller of Transfer. template CoAsset with issuer :

Billed traffic on a metered network Every cost figure canton-stress published before this came from a sandbox with no traffic control, so the only size it could report was the prepared transaction, which was described as a lower bound on the bill. It is not: for token transfers it turned out to be

Cost model v0: predictions written BEFORE measuring Written 2026-10-12, before any of the cases below was run. The point is the ordering: these numbers are fixed here first, then measured, and the result reported whichever way it goes. (Same discipline as the contention law.) The model, fitted

A real multi-participant Canton network daml sandbox gives you one participant with an in-process synchronizer. That is enough to measure an *app*, but not enough to measure a *topology*: it cannot show party-to-participant placement, cross-participant workflows, or per-participant latency.

Wallet-count scaling: OpenZeppelin Canton token template This supersedes the headline number in BENCHMARK.md. That run used a single sending wallet, so its ~15 transfers/s is what one wallet sustains while contending with itself — not the registry's capacity. Prompted by a ques

Benchmark: OpenZeppelin's Canton token template Third-party code we did not write. OpenZeppelin/canton-token-template (AGPL-3.0), a reference implementation of the Canton Network Token Standard (CIP-0056). We depend on its DAR; none of its source is vendored here. What was measured: the

What a transfer costs: envelope size across two registries Canton meters traffic (CIP-0104), so every committed transaction is paid for by the byte. This measures how many bytes two different Token Standard registries spend to do the same standard transfer — and therefore what a data-model dec

Multi-input selection: what happens when one holding is not enough This extends the turnover law in BENCHMARK-TURNOVER.md to transfers that must gather several holdings. Every earlier run here sent 1.0 out of 1000.0-value holdings, so a single input always covered the transfer a

Multi-input contention — pre-registered predictions Written before the confirming runs, so the ordering is provable in git history. Do not edit the numbers below after a run; add results underneath. Round 1 (already run) — the linear guess, and how it failed gen-multiinput.cjs predicted,

Daml contract source - fronow/Canton-Stress-Test/examples/settlement-app/daml/Settlement.daml -- A small settlement app shaped like the real ones (daml-finance, the Canton -- Network Token Standard): NOTHING you want to load-test is directly -- creatable. You cannot create Holding — a hold

Benchmark: a Canton Network Token Standard registry What was measured: the standard interface choice TransferFactory_Transfer from splice-api-token-transfer-instruction-v1 (CIP-0056), exercised against a registry that implements the real Holding and TransferFactory interfaces from the

Why performance testing a ledger app is harder than it looks *An explainer for people who build on Canton but don't spend their lives in performance engineering. No pitch — just the ideas, and why the obvious approach gives you wrong numbers.* --- The question everyone eventually gets asked > *

What we built — explained simply *(English first, Bulgarian below — Български превод по-долу)* --- 🇬🇧 English Imagine a bank made of Lego Canton is a way for banks to build things that move money. Think of it like a very serious set of Lego bricks. People snap the bricks together and buil

How to load-test a Canton application > A method, not a tool manual. Everything here is either standard performance > engineering or something this project measured the hard way — each trap below > is one that produced a wrong answer on a real run before it was fixed. Tool > mechanics live in [TES

canton-stress A load / performance / stress-testing harness for Canton applications. Point it at a DAR, drive concurrent multi-party transactions at a real ledger, and measure throughput, latency percentiles, and contention. Status: complete and validated live. Declarative workloads, coord

canton-stress — testing guide (what to test, how, on which apps) > Step-by-step: from zero to a real load/performance test against a Canton app. > Honest about what the tool can and can't drive today. > > This is the mechanics. For the *method* — which load model answers your > question, the t

Workload file format A workload is data, not code: a party population, a setup program that drives the app into a loadable state, and a weighted mix of measured operations. Pass one with --workload-file. node src/cli.ts check <workload.json> validate offline, no ledger node src/cli

Workload library Parameterised workload templates, so a team does not start from a blank file — and so two teams measuring the same thing measure it the *same* way. A template contains $param:<name> placeholders. Ask what it needs: node src/cli.ts check workloads/token-standard-transfer.json

Migration Guide: Upgrading from cggmp21 v0.6 to cggmp24 v0.7 This guide provides the necessary steps to migrate your project from the older cggmp21 protocol implementation to the latest cggmp24 version. This upgrade is essential to align with the most recent CGGMP24 paper revision. There's

Contributing Guide Thanks for taking interest to contributing to our project! Join us in Discord! We welcome all contributors to communicate with us [in Discord]! Please, reach out to us in #lockness-contribute room. Pull Requests Prior to making a PR, we ask you to communicate it with us,

Ensures reliability of broadcast channel by adding one extra communication round CGGMP24 protocol requires message in the first round to be sent over reliable broadcast channel. We ensure reliability of the broadcast channel by introducing extra communication round (at cost of additional latency). Y

Core key share is obtained as an output of key generation protocol). It can not be used in signing protocol as it lacks of required auxiliary information. You need to carry out key refresh protocol) to obtain "completed" [KeyShare].

Key share is obtained as output of key refresh protocol. It contains a core share and auxiliary data required to carry out signing. Compared to the paper, we removed the El-Gamal private key as it's not used for 3-round presigning, which is the only on