Reference Implementations
Reference Implementations (RIs) are target architectures for complete Canton applications. Each RI describes the parties, contracts, authority, privacy, and settlement flows of one application, and names the OpenZeppelin packages that it uses.
The four RIs are design documents in
OpenZeppelin/canton-specs.
The designs are still in review, and no RI has published application code
yet. This page will add code walkthroughs when implementations are available.
Privacy-Preserving DEX
An operator-run, non-custodial spot exchange built as a constant-product AMM (x·y = k), with one liquidity pool for each instrument pair. Each trade is an atomic delivery-versus-payment swap: two committed CIP-0112 allocations settle together or not at all, within limits that the trader signs. The ledger enforces the swap math. A decentralized venue validation party, hosted on several participant nodes, holds the authority to execute swaps, and the operator acts for it under a revocable delegation.
The DEX settles through the Token Standard V2 interfaces, so it works with any conforming token registry.
Design document: Privacy-Preserving DEX
Institutional Lending Protocol
A vault-based lending venue: fixed-rate, open-term, overcollateralized, and permissioned. Each position is an isolated collateralized debt position that accrues simple interest. For each market, a funder fills a treasury with debt tokens; borrows draw from it, and repayments flow back. Borrowers need a KYC claim from a trusted issuer, and each operation can also require a compliance attestation. The operator liquidates a position under the liquidation ratio and takes a liquidationBonus in collateral.
Assets move through the Token Standard V2 interfaces, directly inside the position choices. Each market uses Pausable as its emergency stop.
Design document: Institutional Lending Protocol
Cross-Chain Stablecoin Payments
The Canton side of a two-way stablecoin bridge. Inbound, an attested lock on an external chain mints a wrapped instrument on Canton. Outbound, a burn on Canton releases the backing asset on the external chain. Each inbound credit passes a single-use compliance attestation from an attester quorum and lands as a private CIP-0112 transfer instruction that the recipient accepts. The bridge mints and burns under rights that the instrument's token registry grants to it.
The hop between chains is not atomic, and privacy applies only on Canton. The design uses the Token package as the example registry, Scoped Authorization Grant for role grants, and Pausable for pause state. A Daml prototype of the bridge is in experiments/cross-chain-bridge.
Design document: Cross-Chain Stablecoin Payment Orchestration
Confidential Auction
A sealed-bid, uniform-price auction that distributes a fixed quantity of a fungible token in one round. The issuer's supply and each bidder's maximum payment are locked in advance as committed Token Standard V2 allocations. Bidders do not see each other's bids. The operator admits bids in batches, and the contracts guarantee that no accepted bid is dropped. An auction validation party, hosted by the operator and independent validation organizations, holds the authority of the auction contracts. One atomic transaction validates the clearing result and settles the payment and delivery of every winner.
Design document: Confidential Auction