Latest audited release: v3.0.0
Latest release: v3.2.0
CMTAT is a blockchain-agnostic open-source security token framework. This repository provides the Solidity reference implementation for EVM-compatible blockchains such as Ethereum, Optimism, Arbitrum, and Polygon PoS. It is developed and maintained by the Capital Markets and Technology Association (CMTA).
It provides a modular implementation focused on regulated issuance and lifecycle management (transfer restrictions, enforcement, pause/deactivation, supply controls, documentation, and optional cross-chain features), with multiple deployment variants (standalone and upgradeable) to fit different product and jurisdiction requirements.
CMTAT extends the standard ERC-20 token with compliance features required for regulated financial instruments:
| Feature | Purpose | Standards | Module Scope |
|---|---|---|---|
| Pause | Freeze all transfers globally (e.g., during corporate actions) | ERC-3643, ERC-7551 (eWpG profile) | Core |
| Deactivate | Permanently disable token operations when required by lifecycle/governance decisions | ERC-8343 (draft, not yet merged) | Core |
| Account Freeze | Block specific addresses from transferring | ERC-3643 enforcement model, ERC-7943 send/receive checks | Core |
| Mint / Burn | Controlled issuance and redemption of tokens | ERC-3643, ERC-7551 (eWpG profile) | Core |
| Batch Mint / Batch Burn | Process multiple mint or burn operations in a single transaction | ERC-3643 | Core |
| Configurable Decimals | Define token decimals at deployment time | ERC-20-compatible behavior | Core |
| Forced Transfer | Admins can move tokens from frozen accounts | ERC-3643, ERC-7551 (eWpG profile), ERC-7943 | Core/Extension |
| Set Name / Symbol | Update token name and symbol after deployment (supported deployment versions) | ERC-3643 | Core |
| Contract Versioning | Expose the contract's implementation version on-chain as a human-readable SemVer string via version() |
ERC-8303 (draft, not yet merged), ERC-3643 | Core |
| Freeze Partial Tokens | Freeze a specific amount of tokens on an address | ERC-3643, ERC-7551 (eWpG profile), ERC-7943 equivalent (setFrozenTokens/getFrozenTokens) |
Extension |
| Transfer Validation | Plug-in rule engine to restrict transfers by origin, receiver, or amount | ERC-3643, ERC-7551, ERC-7943 | Extension/Option |
| Snapshots | Record balances at a specific point in time (e.g., for dividends) | CMTAT SnapshotEngine integration | Extension/Option |
| Holder List | Maintain on-chain the set of addresses holding a non-zero balance (issuer reporting, corporate actions) | Fungible holder enumeration (draft) | Option |
| Documents | Attach legal documents to the token on-chain | ERC-1643-compatible document model | Extension/Option |
| Cross-Chain Mint/Burn | Cross-chain bridge-oriented mint/burn interface | ERC-7802 | Extension |
| Permit | Signature-based approvals without on-chain approve transaction | ERC-2612 | Deployment-version specific |
| Multicall | Execute multiple calls in one transaction | ERC-6357 | Deployment-version specific |
| UUPS Upgradeability | Upgradeable proxy pattern support | ERC-1822 | Deployment-version specific |
| Debt Features | Debt lifecycle and credit-event related capabilities | CMTAT Debt modules | Deployment-version specific |
| ERC-1363 Payable Token Hooks | Token callbacks (transferAndCall / approveAndCall) |
ERC-1363 | Deployment-version specific |
Document model note:
- CMTAT implements both the original ERC-1643 — only ever a GitHub issue (2018 draft), never a merged EIP — and its current rework, the draft proposal "Document Management for Security Tokens" (ethereum/ERCs PR #1754, open/draft).
- ERC-1643 document identifiers in CMTAT use
bytes32names. - CMTAT tokenization terms keep the modified CMTAT document structure (
IERC1643CMTAT.DocumentInfo) withstring name.
CMTAT is used in production by major financial institutions including UBS, Taurus SA, Zand Trust, Daura, Obligate, and Syz Group to tokenize equities, artwork, bonds, structured products, money market funds, and stablecoins.
- Equities: Magic Tomato SA (2022), Qoqa Brew (2022), Cité Gestion SA (2023), CODE41 (2023).
- Debt / Bonds: UBS Project Guardian digital bond (2024), SCCF tokenized trade-finance notes (2023), Obligate
- Structured Products: UBS tokenized warrant on Ethereum (2024)
- Stablecoins: Zand Trust (2025) issued an AED stablecoin using CMTAT v3.0.0 via Taurus infrastructure; Zand Trust.
- Tokenized Market Funds: UBS uMINT (2024)
- Tokenized Artwork: Syz Art tokenization.
- Private DvP settlement: Seturion (2026) (Börse Stuttgart Group) achieved private delivery-vs-payment settlement of tokenized assets on a public blockchain while keeping sensitive data confidential, using CMTAT on Aztec, a zero-knowledge Ethereum Layer-2. Read more.
| Product | Deployment Version |
|---|---|
| Equities | CMTAT Standard |
| Equities / Bonds with balance snapshots (dividends, corporate actions) | CMTAT Snapshot, CMTAT Debt, CMTAT DebtEngine |
| On-chain shareholder registry / holder enumeration | CMTAT HolderList |
| Equities (Germany / eWpG) | CMTAT ERC-7551 |
| Debt / Bonds | CMTAT Debt |
| Debt / Bonds (external debt engine) | CMTAT DebtEngine |
| Stablecoins | CMTAT Light |
| Allowlist / Whitelist | CMTAT Allowlist or CMTAT Standard with RuleEngine |
| Permit + Multicall | CMTAT Permit |
| Payable token / DeFi callbacks | CMTAT ERC-1363 |
| Any (UUPS upgradeable proxy) | CMTAT UUPS |
Most products come in a standalone (immutable) or upgradeable (proxy) variant. The UUPS variant (CMTATUpgradeableUUPS) is upgradeable only — no standalone counterpart exists.
Measured with solc 0.8.34, optimizer enabled (200 runs). EVM deployed bytecode limit: 24.576 KiB.
| Deployment Version | Deployed (KiB) | Initcode standalone (KiB) | Initcode upgradeable (KiB) |
|---|---|---|---|
| CMTAT Standard | 22.251 | 25.663 | 22.577 |
| CMTAT Snapshot | 22.075 | 25.487 | 22.401 |
| CMTAT HolderList | 23.825 | 27.255 | 24.151 |
| CMTAT Light | 11.278 | 13.055 | 11.487 |
| CMTAT Allowlist | 19.882 | 23.079 | 20.208 |
| CMTAT Debt | 23.189 | 26.324 | 23.398 |
| CMTAT DebtEngine | 23.799 | 26.934 | 24.008 |
| CMTAT ERC-7551 | 22.812 | 26.224 | 23.138 |
| CMTAT ERC-1363 | 23.813 | 27.267 | 24.139 |
| CMTAT Permit | 23.341 | 26.650 | 23.550 |
| CMTAT UUPS | 23.552 | — | 23.904 |
All variants are within the deployed bytecode limit. The deployed size is identical between standalone and upgradeable for the same variant; the initcode is larger for standalone contracts since it includes the full constructor logic rather than an initializer.
CMTAT implements a wide set of Ethereum standards:
- ERC-20 — fungible token
- ERC-3643 — security token (without on-chain identity)
- ERC-7551 — crypto security token interface (Germany eWpG profile)
- ERC-7943 (uRWA) — universal RWA interface
- ERC-1404 — restricted token. CMTAT (and the RuleEngine mock) implement both the original ERC-1404 — only ever published as a GitHub issue, never a merged EIP (
detectTransferRestriction/messageForTransferRestriction) — and its current rework, the draft proposal "Simple Restricted Token" (ERCs PR #1701, open/draft), which adds the spender-awaredetectTransferRestrictionFrom. - ERC-2612 Permit — gasless approvals (specific deployment versions only)
- ERC-1363 — payable token hooks (specific deployment versions only)
- ERC-6357 Multicall — batched calls in one transaction (specific deployment versions only)
- ERC-2771 — meta-transactions (gas sponsorship / gasless)
- ERC-7802 — cross-chain transfers
- ERC-7201 — storage namespaces for upgradeability
- ERC-8303 — contract version exposed on-chain via
version()(draft, not yet merged — PR #1819) - ERC-8343 — contract deactivation (
deactivateContract()/deactivated()), formerlyICMTATDeactivate(draft, not yet merged — PR #1900) - UUPS Proxy (ERC-1822 pattern) — upgradeability pattern (specific deployment versions only)
CMTAT provides cross-chain compatibility through ERC20CrossChain and related deployment options:
- ERC-7802: native
crosschainMint/crosschainBurnsupport for bridge-style interoperability. - Chainlink CCIP (CCT): compatible burn/mint token flow, including
getCCIPAdmin()support through theCCIPModule. Scripts and examples are available in the project CMTAT-CCIP - LayerZero: supported through external OFT adapters (ERC-3643 and ERC-7802 variants) in CMTAT-LayerZero.
For full architecture, permissions, and operational notes, see:
This section regroups projects which implements new CMTAT deployment version for EVM/Ethereum with additionnal features
The SnapshotEngine is a smart contract system designed to perform ERC-20 on-chain snapshots, making it easier to distribute dividends or other token-based rewards directly on-chain. The SnapshotEngine can be external or integrated directly in the main token contract.
Integration of FIX descriptor support for CMTAT.
This project provides a modular engine system that enables CMTAT tokens to store, manage, and verify FIX (Financial Information eXchange) protocol descriptors on-chain.
Integration of CMTAT with Chainlink's Automated Compliance Engine (ACE), keeping compliance rules in a separate policy engine so updating compliance becomes a configuration change rather than a contract redeployment. Two deployment variants are provided: Lite (transfer validation only) and Standard (policy-authoritative authorization).
CMTAT is blockchain-agnostic and also has implementations/adaptations beyond this Solidity EVM repository:
- Solana: CMTAT-Solana
- Tezos:
- Official SmartPy implementation: CMTAT-Tezos-FA2
- LIGO implementation: CMTAT-Ligo
- Aztec (privacy-focused variant): private-CMTAT-aztec
- Zama Confidential variant: CMTAT-Confidential
- A confidential security token implementation combining CMTAT compliance features with the Zama Confidential Blockchain Protocol for private balances.
- CMTAT-Canton: CMTAT version for Canton
The RuleEngine is an external contract used to apply transfer restrictions to another contract, such as CMTAT and ERC-3643 tokens. Acting as a controller, it can call different contract rules and apply these rules on each transfer.
Rules is a collection of on-chain compliance and transfer-restriction rules designed for use with the CMTA RuleEngine and the CMTAT token standard.
The SnapshotEngine is a smart contract system designed to perform ERC-20 on-chain snapshots, making it easier to distribute dividends or other token-based rewards directly on-chain
The IncomeVault is a prototype to perform coupon-payment dividend with a CMTAT and the snapshotEngine
Factory to deploy CMTAT with Transparent, UUPS and Beacon proxy using deterministic addresses (via CREATE2)
The DvP (Delivery versus Payment) smart contract (DVP.sol) interacts with an Asset Token smart contract (Delivery) and a Payment Order Token smart contract (Payment).
CMTAT has been audited by ABDK (v1.0, v2.3.0) and Halborn (v3.0.0), with ~99% test coverage across 5,626 automated tests.
WARNING — audit status. Only v3.0.0 has undergone a formal external security audit (Halborn). The subsequent releases v3.1.0, v3.2.0 and v3.3.0 have NOT been formally audited; they have only been reviewed with static analyzers (Slither, Aderyn) and AI-assisted auditing tools (Nethermind Audit Agent), which are not a substitute for a formal audit. Anyone deploying these versions in production must perform their own independent security assessment and audit before relying on them.
In addition to external audits and test coverage, CMTAT security reviews also include static analysis tools such as Aderyn and Slither, as well as AI-assisted auditing tools such as Nethermind Audit Agent.
Per-tool reports, maintainer feedback, and dispositions are collected in doc/security/AUDIT.md. The v3.3.0 static-analysis run (Slither 0.11.5 — 110 results; Aderyn 0.6.5 — 2 High, 10 Low) surfaced no exploitable finding requiring a code fix: every result is a false positive, a documented design choice, an environment note, or a style/optimization item.
See SECURITY.md for the responsible disclosure policy.
MPL-2.0 — weak copyleft, allows commercial use.
| Topic | MPL-2.0 | MIT | GNU GPL (v3) | Apache-2.0 |
|---|---|---|---|---|
| Open source | ✔ | ✔ | ✔ | ✔ |
| Commercial use | ✔ | ✔ | ✔ | ✔ |
| Copyleft level | Weak (file-level) | None (permissive) | Strong (project-level) | None (permissive) |
| If you modify licensed code | Must publish modified MPL files | No obligation to publish | Must publish derivative source under GPL | No obligation to publish |
| Proprietary code mixing | Allowed (keep MPL files under MPL) | Allowed | Restricted by GPL copyleft | Allowed |
| Patent license | ✔ (explicit) | ✘ (not explicit) | ✔ (via GPLv3 terms) | ✔ (explicit) |
| Notice / attribution | Required | Required | Required | Required (+ NOTICE handling) |
Similarity: all four licenses allow commercial use and redistribution.
Key difference: MPL-2.0 is a middle ground between permissive licenses (MIT/Apache-2.0) and strong copyleft (GPL): only modified MPL-covered files must remain open.
What is the patent license?
A patent license in an open-source license means contributors grant users permission to use any patents that would otherwise be needed to use their contributed code. This reduces patent-risk for adopters. Apache-2.0, MPL-2.0, and GPLv3 include explicit patent protections (with termination clauses if someone starts a patent lawsuit over the covered software), while MIT does not include an explicit patent grant.
Hardhat is the main development toolchain for this repository and for CMTAT. Forge (Foundry) is also installed and can compile the contracts, but Foundry-specific deployment scripts and Foundry-native test suites are maintained in a dedicated repository: CMTAT-Foundry.
# Install dependencies
npm install
# Compile contracts
npm run hardhat:compile
# Run all tests
npm run test
# Generate coverage report
npm run coverageFull specification, architecture details, module descriptions, and ERC compatibility tables are in doc/README.md. A short module/variant overview is in doc/SUMMARY.md.
Additional resources:
- Usage Guide
- FAQ
- Specification
- Security Reports · Audit overview
- CMTA Website
- GitHub Releases
Focused, subsystem-level guides live in doc/technical/:
- Architecture & operations — Deployment variants · Lifecycle: pause & deactivation · Access control (roles)
- Standards — ERC-3643 implementation · ERC-7551 (eWpG) · ERC-7943 (uRWA) integration · Documents (ERC-1643) · RuleEngine (ERC-1404)
- Features — Holder list · Snapshots · Debt & credit events · Permit & Multicall · Cross-chain bridge integration
- Use cases & porting — Stablecoins · ERC-1450 integration · ERC-1450 improvements · Guideline: porting to a new blockchain