Rules for a sealed block venue.

Asset Tokenization Studio lets an issuer mint a compliant bond. It does not let anyone trade one. Sotto is the missing half: a bondholder puts size up for bid, dealers compete under commit–reveal so nobody can last-look off a rival's price, and the winning trade settles as a single atomic delivery-versus-payment transaction — security leg and cash leg, both or neither.

There are three parties. The issuer brings the asset into existence and holds the compliance controls. The seller owns a block and wants to move size. The dealers price that block, blind to each other.

To offer a block, the seller calls createHoldByPartition naming the settlement contract as the escrow agent. This is an ATS primitive, not an escrow account the venue controls — the tokens never leave the seller's address.

• Available drops, Held rises, and Total does not move. You still earn the coupon on the whole position.
• Only the escrow agent can execute the hold, and only to the address named at award.
• If nothing is awarded before the hold expires, anyone may call reclaimHoldByPartition directly on ATS. No venue code is involved.

A hold with an expiry of 0 never expires and could never be reclaimed, so the venue never writes one. The default is 48 hours.

Hedera's EVM is public, so the venue cannot hide a price the way a private ledger can. Instead of claiming a privacy it does not have, Sotto makes the price unreadable until it no longer matters.

1. 1While the window is open, each dealer submits only keccak256(price, quantity, nonce, dealer). The venue receives a hash. Nobody — including us — can read a price.
2. 2The window closes on a Hedera consensus timestamp, not on our server clock.
3. 3Dealers reveal. Each reveal is recomputed against its commit and must match exactly. A dealer who cannot produce a matching reveal forfeits.
4. 4The best valid revealed price wins. Ties break on the earliest consensus sequence number.

The preimage lives in the dealer's browser and nowhere else. Losing it means the quote cannot be revealed and is forfeit — that is a property of the mechanism, not a bug, and the dealer portal warns before it can happen.

A revealed price is firm for a stated period measured from its own consensus timestamp — not for as long as the seller feels like waiting. Once it lapses the quote cannot be awarded.

Without that, a seller could sit on a revealed price and lift it after the market moved: a free option the dealer never agreed to write.

Both parties sign an EIP-712 Trade. Settlement then, in one transaction: verify both signatures and consume nonces, check the hold, move the cash, execute the hold. Any failure reverts everything.

Compliance is enforced by ATS at the transfer itself, inside executeHoldByPartition — not bolted on by the venue. If the issuer has revoked the buyer's KYC, delivery is refused, and the payment that ran a line earlier is rolled back with it.

This is why the venue can be permissionless without being unsafe. Sotto does not decide who may hold the asset; the asset does.

Every stage of every request is written to one Hedera Consensus Service topic. The sequence numbers are the integrity claim: a commit hash is timestamped by the network before any price behind it could be read.

That makes the venue auditable without being transparent while the auction is live. You can check the ordering yourself on the audit trail.

Stated plainly, because a settlement venue that only advertises its guarantees is not describing a settlement venue.

• The browser currently executes Path A. Path B is proven through the repository scripts but still needs native Hedera wallet signing and batch assembly before it can be offered as an interface action.
• Dealer bonding, permissionless slashing and expired-hold reclaim exist at contract or script level; their browser controls are not yet wired.
• The reveal window is a real deadline. An unrevealed quote is forfeit and the venue cannot recover it.
• Testnet resets periodically; balances are re-funded from the Circle and Hedera faucets.
• There is no admin function anywhere in the settlement contract that can move user funds.

Block

A large parcel of a security, traded in one negotiation rather than sliced into an order book.

RFQ

Request for quote. The seller asks; dealers answer; the seller picks.

Hold

An ATS escrow that reserves size in place, naming who may execute it and to whom.

Partition

A named tranche within an ATS security. Balances and holds are per partition.

DvP

Delivery versus payment. The security and the cash move together, or neither moves.

Notional

Price × quantity — the total cash owed for the block.

NAV band

A price range around the oracle mark. An award outside it is refused.

HCS

Hedera Consensus Service. The ordered, timestamped log the venue writes to.