StockCustody, a contract that holds both security tokens (via the Stock Token License) and standard ERC-20 settlement assets (USDC) in a unified internal ledger. Users deposit tokens into custody before placing orders. The off-chain matching engine locks balances when orders match, then settles atomically on-chain. Liquidation from connected lending markets is handled through a dedicated router, supporting both internal buyer matching and external sale paths.
Licensees also receive access to Trusset’s off-chain orderbook matching engine and RWA price feeds through the Issuer App, enabling a complete trading infrastructure without building matching logic from scratch.
What’s Included
The license ships one deployable contract with external interface dependencies:| Contract | Purpose |
|---|---|
StockCustody | UUPS-upgradeable custody with deposit/withdraw, balance locking, trade settlement (single, batch, priority), liquidation handling, stock split reconciliation, and emergency controls |
ISecurityToken | Interface for compliance-checked security tokens (included in the Stock Token License) |
ILendingMarket | Callback interface for lending market liquidation settlement |
StockCustody interacts with externally deployed contracts: StockToken instances for compliance-checked transfers, USDC (or another ERC-20) for settlement, and a LiquidationRouter that bridges between lending markets and custody.
Key Capabilities
Hybrid orderbook settlement. Users deposit tokens into custody, the off-chain matching engine pairs orders and locks balances, then the operator settles trades atomically on-chain. Internal transfers between custody accounts bypass on-chain compliance checks - the matching engine validates compliance before matching. Single trades, batch settlements (with gas-aware processing), and priority liquidation trades are all supported. Dual token classification. The contract distinguishes between compliance-checked tokens (security tokens withcanTransfer validation on deposit/withdraw) and standard ERC-20s (USDC, stablecoins) that transfer without compliance checks. Each token is classified at registration time via addSupportedToken.
Liquidation integration. Two settlement paths handle liquidated collateral from connected lending markets. Internal buyer matching moves tokens within custody and routes USDC to the lending market via the router. External sale handles off-custody sales where the operator provides USDC proceeds. Both paths notify the lending market through receiveLiquidationProceeds callbacks. Partial fills are supported for internal buyer liquidations.
Emergency controls. Per-user withdrawal freezes prevent front-running during liquidation. A global withdrawal pause acts as a circuit breaker. Both are independent of the token-level and registry-level freezing mechanisms in the Stock Token suite.
Stock split reconciliation. After a StockToken.stockSplit() executes, the custody contract’s ERC-20 balance increases but internal ledger entries do not. The reconcileAfterSplit function adjusts all user balances and locked amounts by the split ratio.
Role Architecture
The contract uses a three-role model:| Role | Assigned to | Responsibilities |
|---|---|---|
| Admin | Deploying institution (multi-sig) | Token registration, router/USDC configuration, withdrawal pause, upgrade authorization, stock split reconciliation, operator management, two-step admin transfer |
| Operator | Matching engine / settlement service | Lock/unlock balances, settle trades (single, batch, priority), settle liquidations, freeze/unfreeze users |
| Liquidation Router | External router contract | Deliver seized collateral via receiveLiquidatedCollateral |
transferAdmin then acceptAdmin) to prevent accidental transfer to an incorrect address.
Compliance Model
Trade settlements within custody do not validate on-chain compliance. Compliance is enforced at the deposit and withdrawal boundaries throughStockToken.canTransfer. The off-chain matching engine is responsible for validating that both counterparties are eligible before matching orders. Under MiCA, the beneficial ownership transfer at settlement time must be compliant - the deploying institution’s matching engine carries this obligation.
This boundary-based model means that once tokens are in custody, internal transfers between users are purely ledger operations. This significantly reduces gas costs for high-frequency trading while maintaining regulatory compliance at the entry and exit points.