Type a mark and the digest is computed in your browser with the Web Crypto API. Nothing is sent anywhere and nothing is broadcast. This is the exact payload format the registry contract takes.
Plenty of things call themselves a protocol while being a hosted product with a registry contract attached. The word carries a promise: permissionless, onchain, usable without asking anyone, and able to outlive the team that wrote it. Here is exactly where that promise holds and where it does not.
The registry, attestation hub, bond vault, and dispute contracts are permissionless. Anyone can anchor a mark without an account, an invoice, or approval. Anyone can post a bond and attest. Anyone can challenge an attestation. The claim schemas are a public standard, and a competitor could read the registry and build a rival interface on the same records tomorrow.
The licensing product is hosted software with a price. Revenue connectors to Shopify and Stripe are a service we run. Audit exports are a feature. Arbitration panels are an off-chain institution with real humans. A time locked multisig holds pause authority over the bond vault for the first twenty four months, with expiry written into the contract rather than promised in a post.
The SEC's proposed safe harbor turns on whether essential managerial efforts have completed or permanently ceased, and Rule 103 will require public statements to match offering disclosures. A project that calls its hosted SaaS a decentralized protocol has written itself a problem for later. Naming the boundary now, in public, is cheaper than explaining it under examination.
A digest of the evidence plus its schema is written to the registry. Free, permissionless, and the document itself stays with you.
An attestor with domain standing, counsel or an auditor, signs that the claim is true and posts a bond sized to the value at stake.
Anyone may dispute by posting their own bond. Undisputed attestations settle as correct when the window closes.
Disputes escalate to a domain qualified arbitration panel, not a token holder plebiscite. The losing side's bond is slashed and pays the winner.
The canonical token curated registry failure was adChain rejecting the New York Times partly over editorial history. Token holder votes decide popularity, not facts. Every claim in this system has a correct answer, so it goes to people qualified to determine it.
In a token curated registry the only reward is the bond. Here an acquirer in diligence, a competing licensee, or an underpaid licensor already has their own money riding on finding a bad record. The audit incentive comes from outside the protocol.
If nobody challenges, bonds secure nothing. Early on the protocol seeds professional challengers directly, and we disclose that as a bootstrap assumption rather than claiming decentralized security we do not yet have.
MarkRegistry anchor(bytes32 digest, bytes32 schemaId, bytes meta)
transferTitle(bytes32 markId, address to)
linkRegistration(bytes32 markId, string office, string serial)
LicenseRegistry grant(bytes32 markId, LicenseTerms terms) returns (bytes32)
sublicense(bytes32 parentId, LicenseTerms terms)
// reverts when terms exceed the parent envelope
AttestationHub attest(bytes32 subject, bytes32 claimHash, uint256 bond)
challenge(bytes32 attestationId, uint256 bond)
resolve(bytes32 disputeId)
BondVault bond(uint256 amount) / unbond(uint256 amount)
// unbonding delay covers the open challenge window
FeeRouter collect(uint256 usdc)
// splits to attestor yield, buyback and burn, operations
SettlementBook report(bytes32 licenseId, RevenueReport r, bytes sourceProof)
settle(bytes32 licenseId)sublicense() reverts when the child grant exceeds its parent in term, territory, class, or exclusivity. The conflict that normally surfaces during acquisition diligence becomes a transaction that simply fails.
A license may be published in full, published as a redacted envelope carrying only what a third party needs to check for conflict, or kept private with only its digest anchored.
The router never holds customer float. Royalties settle party to party in USDC. No customer document ever touches protocol infrastructure.
| Schema | The claim | How a challenge is proved | Bond |
|---|---|---|---|
| use.specimen.v1 | This specimen depicts the mark in commercial use on or before this date | Produce the specimen with a provably later origin, or show the digest does not match | Low |
| title.chain.v1 | Title passed from A to B on this date under this instrument | Produce a conflicting recorded assignment | High |
| license.envelope.v1 | These terms are the operative grant for this license | Produce the executed instrument with differing terms | High |
| sublicense.valid.v1 | This sublicense falls within its parent envelope | Arithmetic on the parent record, largely machine checkable | Medium |
| revenue.sourced.v1 | This revenue figure came from the connected source for this period | Re-query the connector, or show the signature does not verify | Medium |
Both, and the boundary between them is drawn explicitly. The registry, attestation, bonding, and dispute contracts are permissionless and are the protocol. The licensing product, the revenue connectors, the audit exports, and hosted arbitration support are operated by a company.
The distinction matters for a specific legal reason. United States exemptions for crypto assets turn substantially on whether the essential managerial efforts of a promoter have ceased, so a project that blurs the line between the part that runs without anyone and the part that a team operates is answering the hardest question about itself badly.
Onchain: a SHA-256 digest of the specimen or document, a timestamp, the anchoring address, linked registration numbers, structured license terms, and attestor signatures with their bonds. Offchain and private: the document contents themselves, which never leave the rights holder's systems.
A counterparty verifies by hashing the document they were given and checking that the digest matches the anchored one. If it matches, the document is the anchored document. If it does not, something changed.
An attestor, typically counsel, an auditor, or a verifier, posts collateral scaled to the value of the record being attested, then signs it. The attestation enters a challenge window during which anyone can dispute it by posting a counter bond. An undisputed attestation finalizes; a disputed one goes to a dispute market for resolution.
If the challenge succeeds, the attestor's bond is slashed and the challenger is paid from it. The mechanism is not novel in itself. Optimistic oracles, staked arbitration, and restaking systems have run variants of it at scale for years.
Money that is already being spent. Slashing only deters if somebody looks, and most bonded systems have to manufacture a reason for anyone to bother. Brand rights arrive with that reason already funded: acquirers running diligence, licensees in disputes, and licensors who suspect underpayment all pay professionals today to hunt for defective records.
Royalty audit is a standing professional service line, not a feature waiting to be adopted. Probant routes an existing detection budget into a mechanism that can pay it, rather than inventing an incentive from token emissions.
Four: a registry that holds anchors and their digests, an attestation contract that records signatures and their bonds, a bonding contract that holds and slashes collateral, and a dispute contract that runs the challenge window and resolution. A fee router sits alongside them, collecting in USDC and splitting between attestor yield, buyback, and operations.
None of them is deployed to Base mainnet yet. The published design precedes the deployment on purpose, so that the economics can be argued with before they are immutable.