Composing the Stack

Each SDK in the Permissionless Technologies family solves one problem. Composed together, they form a complete stack for private, compliant, censorship-resistant finance.

┌──────────────────────────────────────────────────────────────┐
│                    YOUR APPLICATION                          │
├──────────────────────────────────────────────────────────────┤
│                                                              │
│   UPD (stablecoin)                                           │
│   ├─ UPP (privacy pool)                                      │
│   │   └─ UPC (compliance / ASP verification)                 │
│   │       └─ UPH (shared cryptographic primitives)           │
│   └─ UPR (Stabilizer operations — proprietary, licensed)     │
│                                                              │
└──────────────────────────────────────────────────────────────┘

The Layers

UPH — Shared Primitives (Foundation)

@permissionless-technologies/uph

UPH provides the cryptographic building blocks that everything else depends on: Merkle trees, Poseidon hashing, BLS12-381 field arithmetic, Circle STARK verification, and PLONK proof verification.

You rarely interact with UPH directly. It's the foundation that UPC and UPP are built on, and the target for shared security review.

You need UPH when: building a custom ZK circuit, implementing a new attestation verifier, or contributing to the primitives layer.

UPC — Compliance (Verification Layer)

@permissionless-technologies/upc-sdk

UPC sits above the primitives. It manages ASPs (Association Set Providers) — operators who maintain Merkle trees of approved identities. Users prove membership via ZK proof; your contract verifies the proof on-chain without learning who the user is.

UPC is standalone. You can use it without UPP — for example, to gate trading on a tokenized securities platform without adding full transaction privacy.

You need UPC when: your protocol must verify KYC, accredited investor status, sanctions clearance, or any other allowlist — without collecting or storing PII.

UPP — Privacy Pool (Confidentiality Layer)

@permissionless-technologies/upp-sdk

UPP wraps any ERC-20 in a shared Merkle tree. Shielded transfers use ZK proofs — the network verifies correctness without learning sender, recipient, or amount. Withdrawals optionally require a UPC compliance proof.

UPP is standalone. You can run a privacy pool for any ERC-20 without using UPD.

You need UPP when: your users need transaction privacy — protecting order flow, salaries, treasury movements, or personal financial activity from on-chain observers.

UPD — Stablecoin (Settlement Layer)

@permissionless-technologies/upd-sdk

UPD is the application-layer token: a non-freezable USD stablecoin backed by overcollateralized stETH. It uses UPC for its Stabilizer compliance checks and integrates natively with UPP for private transfers.

You need UPD when: you want a censorship-resistant USD settlement currency with no issuer that can freeze balances — and optionally paired with UPP for private transactions.

UPR — Stabilizer Operations (Proprietary)

Licensed software — not an npm package

UPR sits alongside UPD as the operational layer. Where UPD defines the smart contracts and economic rules, UPR automates the off-chain work of actually running a Stabilizer: managing delta-neutral hedges across CEX perpetual futures, optimizing funding fee capture, monitoring collateral ratios, and preventing liquidation.

You need UPR when: you want to run a UPD Stabilizer at institutional scale without building your own rebalancing infrastructure from scratch.

Mix and Match

You don't need all four. Common configurations:

End-to-End Flow

Here's how the full stack works together for a private UPD transfer:

1. User mints UPD
   → deposits stETH into UPD contracts
   → receives UPD (standard ERC-20)

2. User shields UPD into UPP
   → ERC-20 transfer to the pool contract (visible on-chain)
   → UPP creates an encrypted note (private balance record)

3. User sends privately
   → generates a ZK proof: "I own a note, balances conserved"
   → pool contract verifies the proof on-chain
   → recipient receives an encrypted note; no address, amount, or link is visible

4. User unshields
   → generates a ZK proof of note ownership + UPC compliance proof
   → UPC verifies: "origin address is in the approved ASP set"
   → pool releases funds to recipient address (visible on-chain)

At no point does any observer learn the amount transferred or the relationship between depositor and recipient.

Reference Implementation

upd.io runs all four components together as a live reference implementation. It demonstrates:

• UPD minting and burning via the Stabilizer system
• Shielding UPD into UPP for private transfers
• ASP compliance enforcement on withdrawal
• sUPD staking for yield

The current preview is deployed on Sepolia at preview.upd.io.

Where to Start