Decentralised Identity Liquidity · Base Mainnet

Sovereign identity.
Liquid value.
Zero data leaks.

Persona License is a modular rights management protocol that converts a verified human identity into a segmented, programmable asset — safely leased for AI generation, settled on-chain, and governed by the human whose likeness it represents.

Protocol Invariants

Hard-coded guarantees that no governance vote, council action, or upgrade may weaken.

I-1 · Zero-Leak Pipeline
Raw AI weights never leave a verified TEE enclave. Keys release only into attested enclaves; memory purged post-render.
I-2 · Sovereign Veto
Core SBT holder retains non-dilutable veto over every execution. Fractional holders receive yield rights only — never approve_lease() rights.
I-3 · Attested Settlement
No un-watermarked, un-attested render can trigger settlement. RoyaltySplitter requires a signed attestation from AttestationRegistry.
<250k
gas per full lease execution on Base
5
SSTOREs per settlement — zero live USDC transfers
25
source contracts across 5 protocol domains
72h
ragequit window before any upgrade takes effect
Protocol Architecture

Four pillars.
One invariant core.

PILLAR 01

Identity Primitive

ERC-1155 nodes (Core SBT, Visual, Vocal, Cognitive, Kinematic) encoded as tokenId = (identityId << 8) | nodeType. Each identity mints a deterministic ERC-6551 Token Bound Account — the digital twin holds its own child nodes and signs its own leases.

ERC-1155 ERC-6551 TBA ERC-5192 SBT EIP-1271 EAS ZK-KYC
PILLAR 02

Assembly Engine

Multi-agent matching across identity nodes. Buyers compose Visual + Vocal + Cognitive nodes; the LicensingRouter validates EIP-712 orders, verifies Merkle policy proofs against the current on-chain root, locks USDC escrow, and confirms TBA EIP-1271 approval before minting a dual-lock LeaseReceipt.

EIP-712 Orders Merkle Policy Proofs ERC-721 Soulbound Pull-Payment
PILLAR 03

Zero-Leak Pipeline

Arweave-encrypted AI weights → Lit threshold keys release only into attested AWS Nitro enclaves → dual-layer watermark (robust provenance layer + fragile tamper canary) signed with an ephemeral private key registered on-chain before render, destroyed after. No plaintext ever leaves the enclave.

AWS Nitro TEE Lit Threshold Keys Dual Watermark Arweave Storage Chainlink VRF
PILLAR 04

AthlEquity

Per-athlete ERC-20 Futures tokens launched via batch auction → exponential bonding curve → $1M graduation to AMM. Decaying exit tax (50% → 0% over 7 days) breaks pump-and-dump mechanics. Oracle-milestone vesting, clawback-burn on career abandonment, and buyback-burn on pro signing bonuses.

Bonding Curve Decaying Exit Tax Chainlink OCR 3-Source Consensus
Lease Execution Chain of Custody
Buyer
EIP-712 Order
TTL 60s · buyer address · node IDs · policy Merkle root
LicensingRouter
Validate + Escrow
Merkle proof · price floor · USDC safeTransferFrom
PersonaAccount TBA
EIP-1271 Approve
AgentPolicy bounds · pre-approved hash · Core SBT veto
LeaseReceipt
Dual-Lock Mint
expires (timestamp) AND renderBudget — either terminates
TEE Enclave
Blind Render
Lit key release · weights decrypt · watermark inject · key destroy
RoyaltySplitter
5-SSTORE Settlement
73% creator · 15% dividend · 10% agency · 5% infra · 2% protocol
Settlement Economics
Per-lease gross USDC routing — 5 balance writes, 0 live transfers
73%
15%
10%
2%
Creator TBA (73% of net)
Dividend reservoir → epoch Merkle drop (15%)
Agency wallet (10%, if registered)
Protocol treasury (2% remainder)

The 15% dividend reservoir accumulates across all leases in an epoch. At epoch close, one Merkle root write distributes to an unlimited number of Futures token stakers — cost to distribute to 100,000 holders: one on-chain write.

Smart Contract Registry

25 contracts.
5 domains.

Contract Domain Pattern Core Responsibility
IdentityRegistryIdentityUUPSERC-1155 node registry · EAS-gated mint · soulbound Core SBT · per-identity pause
PersonaAccountIdentityIMMUTABLEERC-6551 TBA · AuthGuard (I-2) · AgentPolicy · YieldRouter
LicensingRouterMarketplaceUUPSEIP-712 order validation · Merkle proof enforcement · USDC escrow · TBA approval gate
LeaseReceiptMarketplaceUUPSERC-721 soulbound · dual-lock userOf() · 10-state lifecycle · render budget enforcement
RoyaltySplitterMarketplaceUUPS5-SSTORE pull-payment accrual · epoch Merkle drops · agency registration · param-bound routing
AttestationRegistryVerificationUUPSTEE session lifecycle · ecrecover render-sig verification · I-3 settlement gate · watermark observations
FuturesTokenAthlEquityIMMUTABLEERC-20 · 10M fixed supply · decaying exit tax hook · buyback-and-burn · clawback-burn
LaunchControllerAthlEquityUUPS4-phase launch (Fan-Gate → Batch Auction → Curve/LBP → Graduation) · anti-sniping by construction
VestingVaultAthlEquityUUPSOracle-milestone unlocks · 8-year linear fallback · CEI-enforced clawback-burn
OracleGatewayAthlEquityUUPSChainlink OCR 3-source consensus · M-of-N threshold sigs · 12–24h dispute freeze · downstream dispatch
VePersonaLockerGovernanceIMMUTABLELock $PERSONA 1w–4y · decaying weight · multi-lock per address · governance rewards
PersonaGovernorGovernanceUUPS7-day vote + 72h timelock · 3-day fast-lane (ParamRegistry only) · Security Council cancel
PersonaTimelockGovernanceIMMUTABLE72h ragequit window · permissionless execution · cancel = Security Council freeze power
SecurityCouncilGovernanceIMMUTABLE5-of-9 scoped multisig · EIP-712 off-chain signing · sunset schedule · ratification obligation
CouncilPowersGovernanceIMMUTABLEEnumerated council ceiling · valid pause targets · Year 2 threshold trigger · cannot be raised by council
ParamRegistryGovernanceUUPS11 bounded parameters · hard floors/ceilings · fast-lane target · setParam reverts out-of-bounds
ConstitutionRegistryGovernanceIMMUTABLEVersioned constitution hash anchor · append-only amendment history · never modifies past records
Threat Model

Assume the network
is adversarial.

Sybil identity minting
Fake humans farm launch incentives or launder activity through the identity layer.
EAS-gated mint: one live PersonaKYC attestation per identity. Attestations revocable by compliance oracle. Impersonation blocked by ZK-KYC biometric binding at onboarding.
Governance capture of identity rights
51% vote redirects approve_lease() rights to fractional token holders, destroying creator sovereignty.
AuthGuard module is physically non-upgradeable (Invariant I-2). Governance cannot vote this away. FuturesToken holders receive yield rights only — verified in code, not convention.
MEV / quote sniping
Bots front-run favorable quotes between match and execution, extracting value from legitimate buyers.
Orders signed to a specific buyer address with 60-second TTL. All order flow via EIP-712 meta-tx through private mempool relay. Merkle proof makes the order inseparable from its policy context.
TEE side-channel / forged attestation
Attacker submits a forged Nitro attestation document to register an untrusted ephemeral key for key release.
Enclave measurement pinning (approved PCR digest set). VRF-randomised provider assignment. $50k USDC bond per provider with 50% burn / 50% snitch-reward slash on forgery. Dual-vendor TEE at Phase-5 hardening.
Bot sniping at AthlEquity launch
Three independent attack vectors: speed bots at block zero, whale Sybil attacks, and hour-one flippers.
LBP: block-zero buyer overpays (highest price). Batch auction: uniform clearing price — speed advantage zero. Decaying exit tax: 50% burn for hour-one flippers. Three orthogonal defences, any one sufficient.
Oracle spoofing (sports data)
Single compromised API feed triggers false milestone unlocks or buyback events, draining protocol funds.
Sportradar + Genius Sports + Stats Perform simultaneously. Off-chain OCR consensus discards outliers. M-of-N threshold signature on-chain. 12–24h dispute freeze before any financial state change.
AthlEquity · NIL Futures Market

Athletes as
yield-bearing assets.

The collegiate NIL ecosystem runs on booster collectives — unregulated slush funds where donors write large checks with no equity, no revenue share, and no guarantee the athlete won't transfer next season.

AthlEquity converts that donation model into a legitimate, liquid asset class. Fans invest in athletes the way VCs invest in startups: with real equity mechanics, oracle-verified revenue sharing, and cryptographic proof of milestones.

Token Economics (canonical: 10M supply)
Public float (IAO) 25%
Athlete treasury (VestingVault) 55%
Locked AMM liquidity 10%
Protocol allocation 10%
No inflation. No validator rewards. Fixed supply enforced in immutable contract bytecode.
Decaying Exit Tax — anti-pump-and-dump by construction
50%
25%
25% → 0% linear
0% · permanent
< 1h < 24h < 7d ≥ 7d
Governance Architecture

Three layers.
One ragequit window.

Layer 1

vePERSONA Democracy

Lock $PERSONA 1 week → 4 years. Voting weight = amount × (unlockAt − now) / MAX_LOCK. 7-day vote + 72h ragequit timelock. 4% quorum. Permissionless execution — no single party holds the execution key.

Layer 2

Parameter Fast-Lane

3-day vote + 24h timelock for bounded numeric updates. Target must be ParamRegistry — hard-validated on-chain. Hard floors and ceilings are immutable; an out-of-bounds proposal reverts in setParam(), not in the Governor.

Layer 3

Security Council

5-of-9 publicly identified multisig. Scoped to three powers: pauseIdentity, pauseModule (whitelist only), freezeUpgrades. Cannot mint, burn, or touch creator funds. Ratification obligation. Year 2: freezeUpgrades → 7-of-9. Council cannot veto its own dissolution.

Upgrade Pipeline
STEP 1
Proposal submitted
With compiled calldata + storage layout diff
STEP 2
7-day voting
4% quorum · simple majority
STEP 3 · RAGEQUIT WINDOW
72-hour timelock
Frontend alerts all creators · one-click revokeAll() path
STEP 4
Permissionless execution
Anyone can call execute()
Build Roadmap

Modular delivery.
Overlapping phases.

0
PHASE 0 — COMPLETE
Foundations
Foundry monorepo · CI (gas snapshots, storage-layout diffs, invariant harness) · AddressBook · EAS schemas · palette-locked design system
Weeks 1–3
1
PHASE 1 — COMPLETE
Identity Core
IdentityRegistry · PersonaAccount (AuthGuard/AgentPolicy/YieldRouter) · ZK-KYC onboarding · per-identity pause/revoke
Weeks 4–9 · Exit: mint→TBA→revoke E2E on Base Sepolia
2
PHASE 2 — COMPLETE
Marketplace Core
LicensingRouter (Merkle policy, EIP-712, escrow) · LeaseReceipt · RoyaltySplitter (5-SSTORE accrual + Merkle drops) · Matching Engine v1
Weeks 8–15 · Exit: lease execution <250k gas
3
PHASE 3 — COMPLETE
Zero-Leak Pipeline
AWS Nitro enclave image · render supervisor · VRF provider assignment · Lit conditions · watermark injection · AttestationRegistry
Weeks 12–21 · Exit: red-team attempt to extract weights fails
4
PHASE 4 — COMPLETE
AthlEquity
LaunchController (batch auction + curve + LBP) · FuturesToken (decaying tax) · VestingVault (oracle-milestone) · OracleGateway (3-source OCR)
Weeks 18–25 · Exit: simulated launch under bot adversarial harness
5
PHASE 5 — COMPLETE
Governance & Constitution
vePERSONA · PersonaGovernor · 72h Timelock · SecurityCouncil (5-of-9) · CouncilPowers · ParamRegistry · ConstitutionRegistry · Deployment Constitution
Weeks 22–28 · Exit: governance E2E incl. ragequit-window revocation
6
PHASE 6 — UPCOMING
Hardening & Launch
Two independent external audits · economic simulation · $100k bug bounty · White-Glove pilot (25 creators) · guarded mainnet with caps
Weeks 26–32 · Exit: pilot leases settle end-to-end on Base mainnet
Technical Stack
Smart Contracts
Solidity 0.8.26 · Foundry · OpenZeppelin upgradeable · ERC-1155 · ERC-721 · ERC-6551 · EIP-712 · UUPS proxy · EAS attestations
Network & Infrastructure
Base (OP Stack) · AWS Nitro TEE · Lit Protocol threshold keys · Arweave permanent storage · Chainlink OCR + VRF + Automation
Frontend
Next.js App Router · TypeScript · Tailwind CSS · Shadcn UI · EIP-4337 paymasters · EIP-712 meta-transactions · IBM Plex Sans/Mono