Hello, dear readers!
To understand how Dusk can check whether an investor is allowed to buy, hold, or transfer a tokenized asset, let’s first look at Citadel 2.
A trusted License Provider (LP) checks the investor’s information off-chain and issues an encrypted license. The LP signs schema-specific attr_data; when it represents personal information, this is a digest of the underlying canonical_attributes, not the personal data itself. Those attributes stay off-chain.
When the investor needs to use a service, they create a zero-knowledge proof showing that a registered license exists, that an accepted LP signed the relevant data, and that they control the license secret key. The proof does not reveal which license was used. The contract verifies it and records a public session.
The Service Provider (SP) then applies its own rules. Citadel does not decide whether an investor qualifies for a particular service. The SP chooses which issuers and attributes it accepts and can set requirements for expiration, revocation, replay protection, account binding, and other conditions.
The public session does not expose the user’s wallet key, license, provider keys, personal attributes, LP signature, or Merkle path. Instead, the blockchain gets the cryptographic information needed to verify the session, not the underlying personal data.
This is where Citadel becomes relevant to regulated assets: identity credentials, wallet binding and access-control logic can help determine who may receive or hold an asset and which transfers should be rejected. The actual eligibility rules belong to the financial application, not Citadel itself.
LP verifies the investor → issues a license → investor creates a ZK proof → Citadel verifies it → a session is recorded → the Service Provider applies its policy
One important detail: Citadel 2 is currently marked as Draft by its developers. This is the current protocol specification and implementation, not a claim that Citadel 2 is already a universal production mechanism for every regulated asset on Dusk
#dusk $DUSK @Dusk
To understand how Dusk can check whether an investor is allowed to buy, hold, or transfer a tokenized asset, let’s first look at Citadel 2.
A trusted License Provider (LP) checks the investor’s information off-chain and issues an encrypted license. The LP signs schema-specific attr_data; when it represents personal information, this is a digest of the underlying canonical_attributes, not the personal data itself. Those attributes stay off-chain.
When the investor needs to use a service, they create a zero-knowledge proof showing that a registered license exists, that an accepted LP signed the relevant data, and that they control the license secret key. The proof does not reveal which license was used. The contract verifies it and records a public session.
The Service Provider (SP) then applies its own rules. Citadel does not decide whether an investor qualifies for a particular service. The SP chooses which issuers and attributes it accepts and can set requirements for expiration, revocation, replay protection, account binding, and other conditions.
The public session does not expose the user’s wallet key, license, provider keys, personal attributes, LP signature, or Merkle path. Instead, the blockchain gets the cryptographic information needed to verify the session, not the underlying personal data.
This is where Citadel becomes relevant to regulated assets: identity credentials, wallet binding and access-control logic can help determine who may receive or hold an asset and which transfers should be rejected. The actual eligibility rules belong to the financial application, not Citadel itself.
LP verifies the investor → issues a license → investor creates a ZK proof → Citadel verifies it → a session is recorded → the Service Provider applies its policy
One important detail: Citadel 2 is currently marked as Draft by its developers. This is the current protocol specification and implementation, not a claim that Citadel 2 is already a universal production mechanism for every regulated asset on Dusk
#dusk $DUSK @Dusk
