Proposal: Compliance Middleware SDK for EVM Developers on Zenith

Development Fund Proposal Submission

Proposal file: proposals/woof-compliance-middleware-sdk.md

---

Summary

An open-source SDK that makes Canton's compliance primitives callable from Solidity on Zenith. It ships base contracts with compliance modifiers, atomic ERC-20 to CIP-56 DvP settlement, party-to-address mapping, a TypeScript middleware layer, and reference dApps.

The SDK works at the application layer, gating positions, LP shares and pool access. That sits above the instrument-level controls a registry enforces, and no Solidity-native surface for it exists on Zenith today.

Total request: $120,000, paid in Canton Coin at the rate on each milestone's acceptance, across 2 milestones over 6 months.

---

Checklist

• [x] Proposal file added under /proposals/
• [x] Milestones and funding amounts defined
• [x] Acceptance criteria included
• [x] Alignment with Canton priorities described

---

Notes for Reviewers

SIGs: Regulatory Compliance as primary, Token & Asset Standards as secondary, since the SDK is the EVM-side consumption surface for CIP-56. @monsieurleberre and @shaul-da, we'd value your review.

@monsieurleberre reviewed an earlier draft and raised the key boundary question. The Registry App's native blocklist and credential-based allowlist are asset-model controls, set by the issuer over their own instrument. This SDK covers a dApp's own per-action permissions, including objects that are not registry instruments at all, such as positions and LP shares. Motivation now sets that boundary out explicitly. The two layers compose, and the SDK reimplements neither.

The proposal also states its main platform dependency openly. Zenith's external_call() is not yet publicly exercisable, so every cross-VM call sits behind a single adapter contract.

Already on record. CompliLedger / TokenProof (#231) confirmed in writing that the two efforts are complementary rather than overlapping (comment). We consume their DAML-side ComplianceGuard via external_call() and are coordinating on interface stability. Qasara (#300) named this class of SDK as a target consumer of their classified-event vocabulary (forum post, PR reply).

Champion: not yet confirmed. We're identifying one per the process, and are happy to walk any SIG member through the draft.