Soft.Law Smart Contracts

IP registration and licensing contracts for the Soft.Law platform, deployed on Polkadot Hub using PolkaVM (PVM).

Contracts

Contract	Type	Description
IPAsset	ERC-721	IP asset ownership — mint, wrap/unwrap NFTs, configure revenue splits, set royalties
LicenseToken	ERC-1155	License tokens — create, purchase, revoke, transfer, recurring payments
Marketplace	Trading	Listings, offers, escrow, recurring payment enforcement
GovernanceArbitrator	Governance	Dispute submission, resolution, permissionless enforcement
RevenueDistributor	Revenue	Payment splitting, platform fees, ERC-2981 royalties, withdrawals

All 5 contracts are UUPS-upgradeable with Pausable and AccessControl.

Deployed Contracts (Polkadot Hub Testnet)

All-PVM deployment — PVM proxies + PVM implementations. May 5, 2026.

Contract	Proxy Address	Explorer
IPAsset	0xe2b456467a7eccb22fb7823f2d9cd6d74103293e	view
LicenseToken	0xded6c2c346b2985dde21fb95c4b6db1f905b8067	view
Marketplace	0xa98a586cd6b590ca46733c6123e9cb327a9bc4a8	view
GovernanceArbitrator	0x0bbd8b58e42a1a7ae9bf2c223495947483f9f3c0	view
RevenueDistributor	0x02a937eb4fc9ad8b44f127a2dc30da50f5527b00	view

Chain: Polkadot Hub Testnet (ID: 420420417) RPC: https://services.polkadothub-rpc.com/testnet Explorer: Blockscout Faucet: polkadot.io

Setup

Install foundry-polkadot

curl -L https://raw.githubusercontent.com/paritytech/foundry-polkadot/refs/heads/master/foundryup/install | bash
foundryup-polkadot

Environment

cp .env.example .env
# Add your PRIVATE_KEY to .env

Build

# REVM compilation (for testing)
forge build

# PVM compilation (for deployment)
forge build --resolc --force --out out-pvm

Testing

# Standard tests (Anvil EVM)
forge test                         # 807 tests

# Polkadot pallet-revive tests
forge test --polkadot=evm          # EVM backend inside pallet-revive
forge test --polkadot=pvm          # PVM backend (dual compilation)

# Specific tests
forge test --match-contract IPAssetTest
forge test --match-test "test_E2E_UserMintsIPAsset"

Deployment

PVM contracts are deployed via cast send --create (forge create --broadcast hangs on Polkadot Hub due to ETH-RPC sidecar receipt delay).

# Compile PVM
forge build --resolc --force --out out-pvm

# Deploy implementation
BYTECODE=$(python3 -c "import json; print(json.load(open('out-pvm/Contract.sol/Contract.json'))['bytecode']['object'])")
cast send --rpc-url $RPC_URL --private-key $PRIVATE_KEY \
  --gas-limit 30000000 --gas-price 1000000000000 --legacy --create "$BYTECODE"

# Deploy proxy with initialization
INIT_DATA=$(cast calldata "initialize(args...)" ...)
PROXY_BYTECODE=$(python3 -c "import json; print(json.load(open('out-pvm/ERC1967Proxy.sol/ERC1967Proxy.json'))['bytecode']['object'])")
CONSTRUCTOR_ARGS=$(cast abi-encode "constructor(address,bytes)" $IMPL $INIT_DATA)
cast send ... --create "${PROXY_BYTECODE}${CONSTRUCTOR_ARGS:2}"

See script/deployment-guide.md for the full 15-step deployment sequence.

Security

Audit Status

Audited with Pashov v2 (8 agents), Slither 0.11.5, Plamen v1.1.6.

Finding	Severity	Status
CRIT-01: Unvalidated missed payment revocation	CRITICAL	Fixed
H-01: Double revocation stuck disputes	HIGH	Fixed
H-02: Revenue dust locked (integer division)	HIGH	Fixed
H-03: Unbounded dispute array DoS	HIGH	Fixed
H-04/05/09: Buyer/seller funds loss	HIGH	Fixed
H-06: royaltyInfo returns wrong receiver	HIGH	Fixed
H-07: acceptOffer reentrancy	HIGH	Fixed
H-08: Missing __UUPSUpgradeable_init	HIGH	Fixed
M-15: Supply check after mint	MEDIUM	Fixed

807 tests passing, 5 expected failures (2 CRIT-01 fuzz pre-existing + 3 FFI-gated StorageLayout; pass with --ffi).

Security Tests

• test/SecurityAttack.t.sol — 18 attack vector tests
• test/HighFindingsProof.t.sol — Before/after proof for all HIGH findings
• test/FixedFindingsProof.t.sol — Verification tests for applied fixes
• test/InvariantAudit.t.sol — Fuzz and invariant testing
• test/OnChainAudit.t.sol — On-chain behavior verification

Architecture

User (wallet)
  |
  v
Marketplace ──── distributePayment ────> RevenueDistributor
  |                                          |
  |── createListing / makeOffer              |── configureSplit (via IPAsset)
  |── buyListing / acceptOffer               |── withdraw (pull payments)
  |── makeRecurringPayment                   |── royaltyInfo (ERC-2981)
  |
  v
IPAsset (ERC-721) ──── mintLicense ────> LicenseToken (ERC-1155)
  |                                          |
  |── mintIP / burnIP                        |── revokeLicense
  |── wrapNFT / unwrapNFT                    |── revokeForMissedPayments
  |── configureRevenueSplit                  |── markExpired
  |── setRoyaltyRate                         |── transferLicenseToken
  |
  v
GovernanceArbitrator
  |── submitDispute
  |── resolveDispute (ARBITRATOR_ROLE)
  |── executeAward (permissionless)

Project Structure

src/                    # Smart contracts (5 core + 2 helpers)
src/interfaces/         # Contract interfaces
test/                   # Unit, integration, e2e, security, invariant tests
script/                 # Foundry deployment scripts
deployments/            # Deployed contract addresses

License

Apache 2.0 — see LICENSE.