DAML Smart Contracts

The Transfer choice on Holding declares its controller as owner :: observers. Every party added as an observer, including the registry’s read-only reporting party, is therefore authorised to move the holding to any receiver.

choice Transfer : ContractId Holding
  with receiver : Party
  controller owner :: observers
  do create this with owner = receiver

A reporting service with observer rights on every holding could transfer the full supply to itself in a single transaction.

Restrict the controller to owner and move observer-initiated flows to a separate proposal choice that the owner must accept.

Split is declared nonconsuming, so the original holding stays active after the two new holdings are created. The owner can split repeatedly and then transfer the original, inflating their balance.

Make Split a consuming choice and add an invariant test that the total amount across an owner’s holdings is unchanged after a split.

ExecuteTransfer accepts any executor named in the allocation instead of checking it against the instrument’s registry admin. A malicious venue could create allocations naming itself as executor and settle legs for instruments it does not administer.

Fetch the instrument configuration inside the choice and assertMsg that allocation.executor == instrument.admin.

Settlement batches add all counterparties as observers on each input holding. Parties on unrelated legs can see each other’s balances and the full holding history through divulgence.

Pass holdings to settlement as explicitly disclosed contracts scoped to each leg, and keep the observer set limited to the owner and instrument admin.

computeFee multiplies the amount by the basis-point rate and truncates to 2 decimal places. Transfers below 10.00 units pay no fee, so a user can split a large transfer into many small ones and avoid fees entirely.

Round fees up with ceiling at the instrument’s precision, or enforce a minimum fee per transfer.

ReleaseExpired succeeds when now >= lock.expiresAt. Because Canton allows ledger time to drift within the configured skew, a submitter can release a lock up to the skew window early and front-run the counterparty’s settlement.

Add a grace period at least as large as the domain’s ledger time skew before expired locks can be released.

Holding has no ensure clause, so zero or negative holdings can be created by the issuer and later merged into user balances.

Add ensure amount > 0.0 to Holding and Allocation.

When a command fails with CONTRACT_NOT_FOUND, the automation retries using the same cached disclosed factory contract. After a factory upgrade every settlement batch fails until the service restarts.

Invalidate the disclosure cache on CONTRACT_NOT_FOUND and refetch from the registry before retrying.

The HoldingV1 interface view leaves meta empty, so wallets that follow the Canton token standard cannot display instrument names or decimals.

Populate meta with the instrument symbol, name and decimals.

Test scripts allocate parties named AcmeRegistry and AcmeTreasury, matching production party hints. Running the script against a shared devnet participant could create confusingly named parties.

Prefix test party hints with test- or generate unique hints per run.