Plimsoll

Source code

You cannot issue more than the room holds.

Each plate is an ERC-4626 vault position behind the note, counted on-chain rather than declared. The plane is what has been issued against them. When the plates fall below it, the network refuses to move the money.

Or drag the gauge beside the stack.

A number someone typed in

Every tokenised asset prices itself with a number its issuer typed in: the size of the reserve, the value of the collateral, the ratio that says the note is safe. The buyer cannot see behind it, the market trades against it, and nothing stops it being wrong the morning after it was entered. Plimsoll takes that number out of the issuer’s hands. Coverage is read from the vault positions themselves, signed by an attestor, and held against a line that moves only when a person approves it on a device. When coverage comes up short, the network refuses to move the money.

From the floor up

The survey

The Graph surveys the floor. A Substreams package reads every ERC-4626 deposit and withdrawal on Ethereum and works out what each vault actually holds, block by block: its share price, its entry and exit rates kept apart, its total assets. A contract that emits vault-shaped events but cannot name its underlying asset is thrown out, not counted.

It runs Pinax’s ERC-4626 extractor unchanged, so their module cache is reused rather than recomputed, and its output follows the Messari yield-aggregator schema.

The plates and the line

Hedera holds the plates and the plane above them. The note is a real bond, PLIM-A, issued through Hedera’s Asset Tokenization Studio. Its market asks the note before it books a trade, so it never books one the note would refuse, and coupons are paid by Hedera’s own scheduler rather than a keeper.

The cash that pays those coupons is a native Hedera token. Its freeze key belongs to the circuit breaker and it has no admin key, so that can never be changed. When coverage falls below the line, the network itself freezes the payer, and a frozen payer still cannot pay with our servers switched off.

The lock on the door

Ledger holds the key to the line. Halting a market, reopening it or moving the line takes a mandate that a person reads on a Ledger device in plain words: the action, the market, the coverage, the new line. Decline it and the device answers 6985 and no signature exists, so there is nothing for the contract to accept and nothing to retry.

On Hedera testnet the device approved a halt, then declined the resume. A resume signed with any other key was reverted, and the market stayed halted until the device approved it. The device is Ledger’s emulator running the real Ethereum app on a private seed. See the halt, the refused resume and the resume on HashScan.

The refusal is on the record

The note turned a transfer away

At 02:11 UTC on 10 September 2026, a transfer of PLIM-A to an address on the note’s block list reached Hedera testnet. The note reverted it, and the revert says what it refused: the error, and the address, written into the transaction itself.

CONTRACT_REVERT_EXECUTED

AccountIsBlocked(0x5da9…7f38)

Open the transaction on HashScan

The refusal nobody paid for

The attestation service is paid per answer over x402, and it charges only for an answer it can stand behind. Asked about PLIM-A, the negative control, it read the note’s position live — $1.00 against $1,000,000.00 — refused, signed the refusal and wrote it to a public Hedera topic as record 26. The buyer’s payment was authorised and never submitted, so there is no transfer to find.

Record 25 is the other outcome: PLIM-B, read live at 140.00% of what it owes, attested and paid for in one 0.001 HBAR transaction. Record 19 is the third, on one of the service’s own test notes: it could not prove coverage either way, so the record carries no number at all.

Record 26, refused and not charged

coverage_below_floor

Read the records on HashScanOpen the payment for record 25

Check it yourself

Every link opens a public explorer or repository. None of it needs a wallet.

Contract addresses, test runs and the device transcripts are in PROOF.md.

Issue only what the room holds.

The note, its market, the attestation service and the device authority run on Hedera testnet, and all of it is open source.

Open the appRead the source