The Canton Foundation has approved funding for Ligero to build an open-source tool that would let token issuers prove their circulating supply is within a declared cap without exposing individual holders’ balances.
The ZK Supply Cap Prover has a funding ceiling of 10 million Canton Coin, with payments tied to accepted milestones. Most of the budget depends on independent issuers using the system in production, rather than software delivery alone.
The public grant record identifies October 29 as the Technology & Operations approval date. The proposal was merged on October 30. This is approval to develop the system; it does not establish that the finished tool is already operating on MainNet.
What the proof would show
A supply cap is a promise about how many units of a token may be outstanding. On a network where positions are private, a holder cannot simply inspect every wallet and add the balances together.
Ligero proposes using a zero-knowledge proof: a mathematical check that demonstrates a statement is true without revealing the private information used to establish it. In this case, the statement is that the covered token’s aggregate circulation does not exceed its declared threshold.
The issuer would run the prover against its ledger data. Other parties would use a separate verifier to check the result, without receiving each holder’s balance. The planned tool targets tokens compatible with Canton’s CIP-0056 and CIP-0112 standards, which we covered in the Token Standard V2 approval.
The design starts with an initial proof over existing active holdings. Later proofs would update that starting point using changes such as issuance and redemption, reducing the need to repeat the entire calculation for every request.
The hard part is proving nothing was left out
Checking the arithmetic is only part of the task. A dishonest issuer could otherwise submit a smaller selection of holdings, prove that selection is below the cap and leave excess issuance out of the calculation.
The approved proposal therefore makes completeness central to the design: establishing that the proof covers all relevant issuance and active holdings, including where an issuer uses multiple synchronizers.
Ligero proposes connecting the calculation to authenticated network records and cryptographic commitments to the contract data. Those commitments act as checkable references without publishing the underlying balances. The first milestone must specify the mechanism and its trust assumptions for review.
There are still operational dependencies. The prover needs access to the issuer’s ledger view, and independent verification depends on relevant operators making contract hashes or commitments available. The project is designed to add this capability without changing Canton’s protocol or existing Daml templates; it does not make every private asset automatically verifiable.
The current scope also produces and verifies proofs off-chain. It does not add a Canton enforcement rule that stops an issuer creating more tokens.
A supply proof would answer a specific question about token circulation. It would not establish that an issuer holds sufficient cash in a bank, owns an underlying property or can honour every redemption. The proposal discusses reserve ratios and concentration limits as possible extensions, but places them outside this grant’s scope.
How the 10 million CC is allocated
The milestone schedule assigns 1,542,556 CC to specification, implementation, testing and external production validation. The remaining 8,457,444 CC — about 84.6% — is tied to production adoption.
The adoption milestone has four cumulative asset-value thresholds:
| Adoption tranche | Asset value covered by production proofs | CC payment after acceptance |
|---|---|---|
| A | $1 million | 497,836 |
| B | $100 million | 995,670 |
| C | $1 billion | 1,993,389 |
| D | $100 billion | 4,970,549 |
These are future acceptance targets, not assets already covered. The first two tranches require at least one named issuer unaffiliated with Ligero and uncompensated by the grant; the last two require at least two. Canton Coin is explicitly excluded from the adoption asset-value count.
Before the final two tranches can be paid, a Foundation-approved security audit must be completed and all high and critical findings remediated. The project therefore does not eliminate audits: it seeks to replace reliance on attestations for a particular supply claim while still requiring scrutiny of the software proving it.
That payment structure follows the Development Fund’s emphasis on verified adoption. The 10 million CC is a ceiling, with each payment subject to committee acceptance.
From a specification to independent issuer use
Development would progress from local proofs and benchmarks to DevNet and TestNet stress testing, then external MainNet validation. The first specification is estimated at six weeks from project start, with an eight-week hard commitment. That is a relative milestone, not an announced launch date.
Noves is named as a validation partner for data access, ledger-state reconstruction and verifier usability. Because it would receive part of the grant budget, its involvement is separate from the uncompensated issuer adoption required for the final milestone. Financial Privacy Inc. also committed in the review discussion to reviewing the first design milestone with QEDIT.
The MainNet validation plan includes testing against Canton Coin for scale and against a production standard-compatible token. The CC test is a performance exercise; it does not create a fixed supply cap for CC or count toward the adoption thresholds.
The work fits the Foundation’s public-verifiability roadmap: making useful facts about private markets independently checkable without disclosing entire portfolios. Ligero commits to an open-source release under MIT and Apache 2.0 licences and at least 18 months of maintenance after the external-production milestone closes.
The next evidence to watch is the reviewed specification, working proofs, published performance results and named issuers using them. Those steps will show whether a supply promise can become a routine, verifiable check while holders’ balances remain private.
