1. Architecture Overview
The Helios platform operates a vertically integrated digital gold infrastructure built on three primary pillars: on-chain smart contract backbone (Polygon PoS), enterprise-grade risk management, and data-driven analytics intelligence.
Every layer has been engineered for institutional reliability — UUPS upgradeable proxy patterns, multi-role access control, circuit breakers, timelocked treasury operations, and statistical anomaly detection — running on battle-tested OpenZeppelin contracts.
System Topology
The system is deployed across three execution environments:
- On-Chain (Polygon PoS) — Smart contracts, token operations, membership NFTs, vault management, treasury
- Edge Compute (Cloudflare) — Static site, API routes, SSR, CDN-distributed globally
- Application Layer (TypeScript) — Risk engine, analytics pipeline, validation, session management
2. Smart Contract Suite
Six production-grade Solidity contracts form the on-chain backbone. All contracts use OpenZeppelin upgradeable libraries with UUPS proxy deployment, AccessControl for role-based permissions, Pausable for emergency stops, and ReentrancyGuard for reentrancy protection.
| Contract | Type | Purpose | Key Security |
|---|---|---|---|
| HeliosTreasury | UUPS Proxy | Central treasury with timelocked withdrawals, daily caps, 6 allocation categories | 48-hour timelock, daily caps, multi-role |
| HeliosNamespaceRegistry | UUPS Proxy | .helios namespace claims, resolution, metadata, reverse lookup | Rate limiting (5/day), anti-squat fees, name validation |
| HeliosMembership | ERC-721 UUPS | Soulbound membership NFTs with 10 tiers, upgrade-only, operator activation | Soulbound (non-transferable), upgrade-only locks |
| HeliosGoldToken | ERC-20 UUPS | hGOLD reserve-backed token (1 hGOLD = 0.01 troy oz) | Reserve-backed mint cap, daily limits, compliance blacklist |
| HeliosCertificateNFT | ERC-721 UUPS | Gold certificate NFTs with unique serial numbers, redemption burns | ISSUER role, duplicate serial prevention, burn-on-redeem |
| HeliosVaultFactory | UUPS Proxy | Multi-sig vault creation, signer management, emergency freeze | Max 10 signers, namespace-bound, operator-only creation |
2.1 HeliosTreasury
The treasury contract is the financial backbone of the platform. All fees from namespace registration, membership activation, and service charges flow into the treasury. Withdrawals require a 48-hour timelock and are subject to daily caps.
- 48-hour mandatory timelock on all withdrawal requests
- Configurable daily withdrawal cap (default: 100 POL)
- 6 allocation categories: Operations (25%), Reserve (30%), Development (20%), Marketing (10%), Compliance (10%), Emergency (5%)
- Full audit trail with WithdrawalRequested, WithdrawalExecuted, WithdrawalCancelled events
- Admin can cancel pending withdrawals during timelock window
2.2 HeliosNamespaceRegistry
The namespace system provides human-readable identity for all participants. Each namespace maps to an on-chain address and ecosystem type, with full forward and reverse resolution.
- Name validation: 3-32 characters, alphanumeric + hyphens, no consecutive hyphens
- Rate limiting: maximum 5 claims per address per 24-hour period
- Anti-squatting: registration fee forwarded to treasury
- Metadata storage: key-value pairs for profile enrichment
- Operator-reserved namespaces for system identities
- Transfer functionality with full ownership history
2.3 HeliosMembership
Soulbound ERC-721 NFTs represent membership status. Each member receives exactly one NFT that tracks their tier level. Upgrades are permitted; downgrades are blocked at the contract level.
| Tier | Name | Category |
|---|---|---|
| 0 | Helios Club | Core Membership |
| 1 | Gold Starter | Gold Desk Access |
| 2 | Gold Builder | Gold Desk Access |
| 3 | Gold Position | Gold Desk Access |
| 4 | Gold Reserve | Gold Desk Access |
| 5 | Gold Portfolio | Gold Desk Access |
| 6 | Private Desk | Institutional Access |
| 7 | Strategic | Institutional Access |
| 8 | Premier | Institutional Access |
| 9 | Institutional | Institutional Access |
2.4 HeliosGoldToken (hGOLD)
hGOLD is an ERC-20 token where 1 hGOLD represents 0.01 troy ounces of physical gold held in reserve. The contract enforces that total supply never exceeds verified reserve backing.
- Reserve-backed minting: supply cap = verifiedReserveOz * 100
- MINTER_ROLE required for all minting operations
- Daily mint limit (configurable, default: 100,000 hGOLD = 1,000 oz)
- Compliance blacklist: blocked addresses cannot send or receive
- Full audit trail: MintEvent, BurnEvent, ReserveUpdated indexed events
- Reserve ratio publicly queryable: reserveRatio() view function
2.5 HeliosCertificateNFT
Gold certificates are non-fungible tokens representing specific gold holdings with unique serial numbers, weight, purity, and vault location metadata.
- Unique serial number enforcement — no duplicates permitted
- Certificate metadata: serial, weight (milliounces), purity, vault ID, issue date
- Redemption burns the NFT and emits CertificateRedeemed event
- Tracking: totalActiveWeightMilliOz, totalMinted, totalRedeemed counters
- ISSUER_ROLE required for minting; holder can redeem
2.6 HeliosVaultFactory
The vault factory creates and manages multi-signature vault contracts bound to specific namespaces. Each vault supports up to 10 signers with operator-controlled emergency freeze capability.
- Namespace-bound: each vault linked to a .helios identity
- Multi-sig: configurable threshold for transaction approval
- Emergency freeze: operator can freeze vault to halt all operations
- Signer management: add/remove with role-based access control
- Vault enumeration: list all vaults for a given namespace
3. Risk Management Engine
The risk management engine provides enterprise-grade transaction screening, portfolio risk assessment, anomaly detection, and automated circuit breakers. It operates as a TypeScript module in the application layer with six risk categories scored and weighted into a composite assessment.
3.1 Risk Categories & Weights
| Category | Weight (Txn) | Weight (Portfolio) | Description |
|---|---|---|---|
| Transaction | 30% | 10% | Amount, velocity, tier limits, pattern detection |
| Counterparty | 20% | 5% | Account age, transaction history, behavioral baseline |
| Compliance | 30% | 10% | KYC/AML verification, jurisdiction screening, CTR filing |
| Portfolio | 5% | 40% | Concentration, leverage, diversification, drawdown |
| Market | 10% | 25% | Gold volatility, price movement, circuit breaker proximity |
| Operational | 5% | 10% | Platform uptime, contract health, liquidity depth |
3.2 Risk Score Tiers
| Score | Level | Action |
|---|---|---|
| 0 – 25 | Low | Auto-approve |
| 26 – 50 | Moderate | Auto-approve with logging |
| 51 – 70 | Elevated | Manual review required |
| 71 – 85 | High | Escalate to compliance team |
| 86 – 100 | Critical | Automatic block |
3.3 Circuit Breaker System
An automated circuit breaker halts all platform transactions when triggered. Conditions include gold price moving more than 8% in any one-hour window, or manual activation by operators.
- Automatic trigger: gold price ±8% within 1 hour
- Manual trigger: operators can trip for any reason
- Auto-reset: 30-minute cooldown (configurable)
- Manual override: requires explicit operator reset
- Real-time proximity monitoring: distance-to-trigger displayed on dashboard
3.4 Velocity Controls
Per-member transaction velocity is monitored across three time windows to detect abnormal activity patterns.
| Window | Limit | Action on Exceed |
|---|---|---|
| Per-minute | 5 transactions | Block + flag |
| Per-hour | 30 transactions | Block + flag |
| Per-day | 100 transactions | Block + escalate |
3.5 Anomaly Detection
Statistical anomaly detection uses Z-score analysis against historical transaction data. Any value exceeding 3 standard deviations from the member's historical mean is flagged for review.
3.6 Exposure Limits by Tier
| Tier | Max Single Txn | Max Daily | Max Concentration | KYC Required |
|---|---|---|---|---|
| Club (0) | $5,000 | $10,000 | 50% | Level 1 |
| Gold Starter (1) | $25,000 | $50,000 | 50% | Level 1 |
| Gold Builder (2) | $50,000 | $100,000 | 45% | Level 2 |
| Gold Position (3) | $100,000 | $250,000 | 45% | Level 2 |
| Gold Reserve (4) | $250,000 | $500,000 | 40% | Level 2 |
| Gold Portfolio (5) | $500,000 | $1,000,000 | 40% | Level 3 |
| Private Desk (6) | $1,000,000 | $2,500,000 | 35% | Level 3 |
| Strategic (7) | $2,500,000 | $5,000,000 | 35% | Level 3 |
| Premier (8) | $5,000,000 | $10,000,000 | 30% | Level 3 |
| Institutional (9) | $10,000,000 | $25,000,000 | 30% | Level 3 |
4. Data Analytics & Intelligence
The analytics layer provides quantitative intelligence across portfolio performance, reserve adequacy, member metrics, and market correlation — built with data science methodologies including Monte Carlo simulation, correlation matrices, and predictive modeling.
4.1 Portfolio Analytics
- Total return, Sharpe ratio, max drawdown, annualized volatility
- Per-asset allocation tracking with 24h change indicators
- Best/worst day identification from historical snapshots
- CAGR calculation for staking positions with lock-period awareness
4.2 Reserve Stress Testing
Monte Carlo simulation models thousands of gold price scenarios using geometric Brownian motion to evaluate the probability of reserve inadequacy under adverse market conditions.
- Configurable simulation count (default: 10,000 scenarios)
- GBM price model with calibrated drift and volatility
- Output: probability of inadequacy, 5th/95th percentiles, worst case
- Stress horizons: 30, 90, 180, 365 day projections
4.3 Correlation Engine
Pearson correlation analysis tracks relationships between gold and other assets (BTC, ETH, POL, DXY, VIX) across 30-day, 90-day, and 1-year windows. Used for portfolio risk diversification scoring.
4.4 Member LTV Prediction
A weighted factor model predicts member lifetime value using six signals: tier level, tenure, transaction frequency, referral network size, portfolio value, and engagement score. Includes tier migration probability estimation.
4.5 Platform Health Score
A composite health metric (0-100) aggregates six component scores: reserve adequacy (25%), liquidity depth (20%), member growth (15%), operational stability (15%), compliance posture (15%), and market conditions (10%). Automated alerts trigger when components fall below thresholds.
4.6 Technical Indicators
- Simple Moving Average (SMA) with configurable period
- Exponential Moving Average (EMA) with smoothing factor
- Dual-EMA crossover trend detection (bullish/bearish/neutral)
- Applied to gold price, hGOLD volume, and platform TVL
5. Security Framework
The security layer implements defense-in-depth across seven domains: input sanitization, rate limiting, request signing, address validation, amount safety, contract interaction guards, and session management.
5.1 Input Sanitization
- XSS pattern detection and stripping (script tags, event handlers, data URIs, iframes)
- SQL injection pattern detection (UNION SELECT, DROP TABLE, etc.)
- Null byte stripping
- Length enforcement with configurable max
- Namespace name validation: 3-32 chars, alphanumeric + hyphens, reserved word blocking
5.2 Rate Limiting
Token bucket algorithm provides smooth rate limiting per IP, member ID, or endpoint. Default: 30 requests per 60-second window with automatic token refill.
5.3 Security Headers
| Header | Value |
|---|---|
| Content-Security-Policy | Strict CSP with self-only defaults + approved RPC endpoints |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY |
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=() |
| Cross-Origin-Opener-Policy | same-origin |
5.4 Address Validation
- EVM addresses: 0x prefix, 40 hex characters, EIP-55 checksum detection
- Stellar addresses: G prefix, 56 base32 characters
- XRPL addresses: r prefix, base58 encoding, length validation
- Auto-detection: chain type inferred from address format
5.5 Contract Interaction Safety
- Pre-flight gas estimation and boundary checks
- Dangerous method detection (selfdestruct, delegatecall)
- Gas price reasonableness validation (> 500 gwei warning)
- Gas limit ceiling (10M gas warning)
- HMAC request signing for API integrity verification
5.6 Session Security
- Cryptographically secure session token generation (Web Crypto API)
- Browser fingerprinting for session binding (privacy-respecting, non-PII signals)
- Constant-time signature comparison to prevent timing attacks
6. Deployment Infrastructure
Contract deployment uses Hardhat with UUPS proxy deployment via OpenZeppelin Upgrades Plugin. All six contracts are deployed through a single orchestrated script that produces a complete deployment manifest.
6.1 Deployment Pipeline
- Compile: Solidity 0.8.24 with optimizer (200 runs + viaIR)
- Deploy: Sequential UUPS proxy deployment for all 6 contracts
- Configure: Post-deployment tier pricing, role grants, namespace reservations
- Verify: Automated PolygonScan source verification
- Manifest: JSON output with all addresses, gas costs, timestamps
6.2 Network Configuration
| Network | Chain ID | Purpose |
|---|---|---|
| Polygon PoS | 137 | Production mainnet — all live contracts |
| Amoy Testnet | 80002 | Staging and integration testing |
| Hardhat Local | 31337 | Development and unit testing |
6.3 Post-Deployment Configuration
- 10-tier membership pricing set on-chain
- OPERATOR_ROLE granted to operations wallet
- MINTER_ROLE and ISSUER_ROLE granted to authorized addresses
- System namespaces reserved (helios, admin, treasury, system, support, platform)
- Treasury allocation categories verified
7. Wallet Infrastructure
The platform operates a three-wallet architecture on Polygon PoS, with hardware wallet migration supported for all operational and treasury wallets.
| Wallet | Purpose | Security |
|---|---|---|
| Deployer | Contract deployment, admin operations | HD wallet, .env secured |
| Operations | Day-to-day platform transactions, operator role | Dedicated EOA, role-gated |
| Treasury | Fee collection, reserve management | Contract-managed, timelocked |
8. Technology Stack
| Layer | Technology | Version |
|---|---|---|
| Frontend | Next.js (App Router, Static Export) | 16.x |
| Styling | Tailwind CSS v4 | 4.x |
| Animation | Framer Motion | 12.x |
| Language | TypeScript (strict) | 5.x |
| Smart Contracts | Solidity | 0.8.24 |
| Contract Framework | Hardhat + OpenZeppelin Upgradeable | Latest |
| Blockchain | Polygon PoS | Chain 137 |
| Token Standard | ERC-20 (hGOLD), ERC-721 (Membership, Certificates) | — |
| Deployment | Cloudflare Pages | Wrangler v4 |
| Analytics | Custom pipeline + GA4 ready | — |
9. Compliance & Governance
The platform implements a multi-layer compliance framework designed for operation across regulated jurisdictions. Smart contract enforcement is complemented by application-layer screening.
- On-chain compliance blacklist for sanctioned addresses
- Tiered KYC requirements escalating with transaction size and membership tier
- Jurisdiction screening against OFAC, EU, and UN sanctions lists
- Currency Transaction Report (CTR) threshold monitoring at $10,000
- Structuring detection for patterns designed to circumvent reporting
- Full audit trail: every risk assessment generates a unique ID with immutable logging
- 48-hour treasury timelock provides governance window for withdrawal oversight