How a fund’s daily value is calculated, checked and signed.

0. Scope and precedence

• This document governs how ETP Foundry calculates and proposes a fund's daily NAV and its other fund actions, and how the fund's parties sign them.
• It is the governing text. Where any other ETP Foundry document or web page differs from it, this document wins. The Rulebook (v0.3) and the Committee terms (v1.4) describe process and people under it.
• It does not replace a fund's own legal documents. A real fund's prospectus, trust deed and agreements, drafted by the sponsor's lawyers, govern the fund. Where they set a stricter rule, theirs applies.
• Every version is kept. A NAV is read under the version in force on the day it describes.

1. Definitions

Numbers carry at most 10 decimal places (the ledger's Numeric 10). Times are UTC unless a time zone is named.

2. Funds and their parties

2.1 Who does what

Market makers (authorised participants) create and redeem shares. They are approved by a compliance action (§8.4); they do not sign the NAV.

2.2 Templates per fund type

Each fund type comes with a template that names its price source, valuation point and seats. Seats and price sources are configuration, not new code.

Canton Coin has no issuer, so there is no reserve to confirm and no reserve signer. Any fund can add a lender seat.

2.3 Which actions need which roles

A template may change these (a private-credit fund requires the valuation agent on the NAV). A role the fund does not seat is not required of it. The rules of §5 always apply.

3. The daily NAV

3.1 The formula

NAV per share = ((Σ units_i × price_i) + cash − accrued fees − liabilities) ÷ shares outstanding

• units_i: units of asset i the fund holds at the valuation point, read from the ledger.
• price_i: chosen by the order in §3.3.
• cash, accrued fees (§8.3), liabilities: in the NAV currency.
• shares outstanding: every share of the fund at the valuation point.

Precision. Intermediate figures are held at 10 decimal places. The published NAV is rounded half up to the fund's published decimals (default 4). The ledger refuses a NAV that differs from the formula by more than half a unit in the last published place, or that has more decimals than the fund publishes.

Example. 0.5 cBTC at 60,000 + 10 cETH at 3,000 + cash 1,000 − fees 50 − liabilities 0, over 1,000 shares = 60,950 ÷ 1,000 = 60.9500 per share.

3.2 Valuation point

Every price carries its own timestamp. Creation and redemption orders are dealt at the next NAV struck after the order (forward pricing), never at a past one.

3.3 Where prices come from, in order

For each asset at the valuation point, the first usable level is taken. The level used is recorded with each price.

• Feeds disagree. If both feeds are fresh but differ by more than 100 bp, neither is used alone: the asset goes to fair value, or failing that to level 4.
• Wrapped tokens. For cBTC and cETH the feed prices BTC and ETH. The token is valued at par with its underlying while its reserve signer confirms the backing. A refused or failed reserve confirmation is grounds to stop creations, by a seat's pause or a suspension (§6.4, §6.5); no discount is invented.
• ETP Foundry is not a price provider. It reads the sources the fund's terms name.

3.4 Stale prices

• Chainlink: stale when the last update is older than the feed's heartbeat plus a grace period (3,600 s + 600 s for BTC/USD and ETH/USD). Refused outright when the answer is not positive or the round is incomplete.
• REST feeds (Kaiko): stale when the quoted time is older than the maximum age (default 3,600 s). A feed with no timestamp is treated as stale.
• A price from after the valuation point (beyond one minute of clock difference) is not used.
• Carry forward is allowed for one valuation point, flagged stale, with the administrator's signature. After that the asset has no price, the fund strikes no NAV, and creations and redemptions stop until it does.

3.5 Indicative value between valuation points

The engine also evaluates the formula on live prices between valuation points. That figure is indicative: never signed, never used for a creation or redemption, never shown as an official value, and always labelled.

4. What each seat checks and sends

Each seat sends a few numbers from its own systems, checked against the proposal. Nobody is asked for an opinion. A malformed submission is refused with an error naming the field, and nothing is recorded. A well-formed submission that fails its check is recorded as that seat's refusal, with the numbers. A figure a seat's systems cannot produce is not estimated: its checker sends nothing. Exact fields are served at GET /api/signer-protocol.

4.1 Administrator: NAV recomputation

Sends its own navPerShare, netAssets, sharesOutstanding, the valuationPoint, and the time of the oldest price it used (at most 24 hours before the valuation point). It signs only if its NAV is within its declared tolerance of the proposal (navBps, default 1 bp).

4.2 Reserve signer (token issuer): reserve snapshot

Sends reserves, supply, asOf, an evidenceRef (proof-of-reserve report, contract addresses and block, or custodian statement reference), redemptionsOpen and mintBurnPaused. It passes only if reserves ≥ supply, the snapshot is fresh (default 24 hours), redemptions are open and minting and burning are not paused. A failure is a refusal naming each reason. The snapshot is the issuer's own statement on a permanent record, not an audit.

4.3 Custodian: holdings reconciliation

Sends units it holds for the fund, units the ledger shows, units pledged or lent, and the statement time (fresh, default 24 hours). It passes only if the two holdings match and nothing is encumbered.

4.4 Transfer agent: register reconciliation

Sends shares on its register, shares on the ledger, and the register time (fresh, default 24 hours). It passes only if they match.

4.5 Lender

Checks the NAV against its own value for the shares, within a tolerance it declared in advance in its seat settings and never widens at submission time.

4.6 Venue, valuation agent (fair value only)

Where an asset has no usable feed, venues or market makers sign a fair value from their own trades (totals for a short window: count, volume, average, low and high), and a valuation agent signs a fair value for loans with no market price. How venue submissions are combined is an open item (§14).

4.7 Sponsor

Signs the actions its role requires (§2.3). It can never reach K alone (§5).

What is never sent: order books, trade tapes, client identities, keys, statements or registers. Submissions go to ETP Foundry's desk and are kept in its append-only record. They are shown to the fund committee and its auditor. That is ETP Foundry's access policy, not a property of the ledger: ETP Foundry can read every submission.

5. Signing: K of N, and the rules that do not bend

Enforced by the ledger (Daml package crossdesk 3.3.0) and checked again by the desk before anything is submitted:

1. K ≥ 2, and K is no more than the number of seats that count.
2. The sponsor can never reach K alone. Counted sponsor seats are fewer than K, and every finalised action carries at least one counted signature from another role.
3. No ETP Foundry seat counts. The engine is never a member. A seat ETP Foundry hosts signs on the record but is never counted.
4. A seat signs only as its own role, with evidence naming that role and at least one check it made.
5. The roster cannot drift. If the committee's members or K change after the fund is set up, every proposal is refused.
6. One NAV per fund per day. The daily NAV takes the fund's single daily slot.
7. A seat is never filled with a stand-in. An open or invited seat is shown as open or invited. The committee cannot be set up on the ledger while a seat is open.

Keys. Every signature records how it was made:

• L1, hosted: the key sits with ETP Foundry, so ETP Foundry could technically sign. Disclosed every time, and never counted.
• L2, the seat's own key: ETP Foundry cannot sign through the Ledger API. It can still delay or refuse to submit. Built and proven on DevNet on 26 September 2026; switched off on the running desk today.
• L3, the seat's own Canton node: not built.

6. When the parties do not agree

6.1 A normal day

1. Proposal. At the valuation point, once the committee is set up, the engine proposes the day's NAV once, with every input attached. While seats are open, nothing is proposed. If an asset has no fresh price, nothing is proposed: the reason is recorded and an alert is raised.
2. Signatures. Each seat's checker reads the open proposal with everything needed to recompute it, and signs as its role or refuses.
3. Finalisation. After every signature, and on a sweep every 5 minutes, the engine asks the ledger to finalise. Until K and the required roles are met, the ledger says no.

6.2 Refusal and re-proposal

A seat that disagrees refuses with a category, a reason and, if it wishes, evidence. The refusal is recorded in the desk's event log and shown on the proposal. (The ledger has no refuse step; a refusal is the absence of a signature plus the recorded reason.) Then:

• Price refused: the engine withdraws the proposal and proposes again without the disputed source, moving down the order in §3.3. At most 3 proposals per fund per day. When no usable source is left, the case is escalated ("needs fair value signed by the seats") with an alert. The engine does nothing further.
• Reserves, holdings or shares refused: nothing is proposed again, since the numbers are not the issue. A critical alert is raised. The engine does not pause the fund: a pause is a seat's act (§6.4).
• Other: recorded and alerted, no automatic action.

6.3 Deadline

A NAV not finalised by the valuation point + 2 hours is recorded as missed, with an alert. Nothing is carried forward automatically. The last signed NAV stays visible with its date.

6.4 Emergency pause (72 hours)

One seat that can see a problem (sponsor, administrator, a reserve signer, the custodian or the transfer agent) may stop creations, redemptions or both, for 1 to 72 hours, with a reason. It can stop the fund; it can never move a number. The seat that set it may lift it early, saying why.

6.5 Suspension

Anything longer than a pause is a suspension under the full quorum: a reason, when notice was given (never after it takes effect), when it takes effect and when it will be reviewed. Resuming is the same action with both flags off. Grounds: no usable price for an asset; a refused or failed reserve or custody confirmation; the market for a large part of the basket closed; a legal or operational event.

6.6 Corrections

Every error is corrected on the record, under the same quorum as the original, and the original is never deleted. A correction must state why the original was wrong, must keep the same kind of action, and must change something. A NAV correction publishes a new NAV record that points to the original; both stay on the ledger.

These thresholds are common industry practice, not law. The ledger stores the class and the error in bp on the correction.

This version sets no time limit for finding an error (§14).

7. Publication and labels

Every value says who stood behind it:

• Signed: finalised on the ledger with K counted signatures. The record names each signer, its role, whether its signature counted, its evidence and how its key signed (L1, L2).
• Indicative: calculated by the engine, signed by nobody whose signature counts. Always labelled indicative.
• Missed / no NAV: published as a gap with its reason. Never filled with an estimate.

Each price in a signed NAV carries its source, its level (§3.3) and its time. A carried-forward price is flagged stale.

Today every value is indicative. No outside party holds a seat, so nothing has been signed by one.

Asset prices from Chainlink, Kaiko and other providers are used under their own terms. ETP Foundry does not republish exchange-derived prices.

8. Other fund actions

8.1 Holdings and reserve confirmation

Every reserve signer confirms its own token, and every custodian its holdings (§4.2, §4.3). Evidence is referenced on each line.

8.2 Creating and redeeming shares

1. A market maker is approved by a compliance action (§8.4).
2. It orders whole creation units (a number of shares set in the fund's terms) before the cut-off.
3. It delivers the basket for those units, plus any cash component (NAV × shares − value of the delivered assets; zero for a pure in-kind basket).
4. The basket and the shares change hands in one atomic transaction: both legs or neither. A share never exists without the assets behind it. Redemption is the reverse.
5. Dealing happens only against a signed NAV, and not while a pause or suspension is in force. Today the desk enforces this on every path it offers (§13).

8.3 Fees

Fees accrue daily on actual/365 fixed: net assets × annual rate (bp) × days ÷ (10,000 × 365). The ledger refuses an accrued figure more than half a cent from the formula. Example: 1,000,000 × 50 bp × 1 ÷ 3,650,000 = 13.6986301370, published 13.70.

8.4 Compliance actions

Approve or remove a market maker, set the rule for who may hold shares, pause or resume transfers. Each names its subject and effective time, and is signed by the sponsor within the quorum; the transfer agent co-signs where there is one.

8.5 Basket changes and rebalancing

Proposed by the sponsor or the engine, citing the fund rule it applies; signed by the sponsor and the administrator within the quorum. Notice comes first; the change takes effect later, at a valuation point. At the stated prices a change must not move the NAV (what a share held before = what it holds after + any cash added); the ledger refuses one that would. Applying the signed change to the basket on the ledger is a separate step, done once.

8.6 Wind-down

A wind-down is an action under the full quorum. It states the reason, how remaining assets are returned to holders, the last creation date and the final redemption date. The final redemption is at least 60 days after notice, enforced on the ledger; finalising it publishes a notice to every party that can see the fund.

9. Governance

9.1 Oversight

There is no independent oversight function today. A charter is written; no member is appointed. The fund committee is not an oversight function: its members are interested parties. Until one exists, ETP Foundry performs the reviews below, publishes them and says that it does.

9.2 Conflicts of interest

• ETP Foundry calculates but never signs, and the ledger refuses it as a member. It does not trade the funds' assets.
• Disclosed conflicts: if a fund pays a fee in basis points, ETP Foundry's fee rises with the fund's value, which ETP Foundry calculates. ETP Foundry also runs creation and redemption, and today operates every seat on DevNet. These are mitigated (the parties sign, not us), not removed.
• Each seat declares, at appointment and on change, anything that could bias its submissions. See the conflicts policy (v0.3).

9.3 Code of conduct for seats

1. Send only data from your own systems. Never an estimate, never someone else's number.
2. Tolerances are declared in advance and never widened to make a check pass.
3. Submissions come from an automated checker or a documented procedure, by named people.
4. Keep the data behind each submission for five years and produce it on request.
5. Report any attempt to influence a submission.
6. A refusal is never held against a seat. A knowingly false submission is grounds for removal.

9.4 Records

• On the ledger: every proposal and signed fund action, NAV, correction, pause and wind-down notice. They cannot be edited or deleted.
• Off the ledger: an append-only event log of every submission (with its SHA-256 digest), refusal, re-proposal, escalation and missed deadline.
• Retention: at least five years.

9.5 Complaints

In writing to committee@etpfoundry.com. Acknowledged within 2 business days; answered within 20 business days, with reasons. Kept for five years. None received so far.

9.6 Changes to this methodology

• A material change (the formula, the price-source order, valuation times, the signing rules, the error thresholds, the roles a template requires) needs a public consultation of at least 30 days, a published summary of responses, then at least 30 days' notice.
• Clarifications and typo fixes take effect on publication.
• No change is ever retroactive.
• This version (v1.1) restates the product as it is and was published before any outside party held a seat or any fund relied on a value, so no consultation was needed. No consultation has been run yet.

9.7 Annual review

At least once a year: the price sources, refusals and missed NAVs, the thresholds, seat conduct, complaints and this document. Published. The first is due by 30 September 2027.

9.8 Audit

There is no external audit of the code or of how this methodology is followed. One is planned before any outside party relies on a value.

10. Automation: each seat's checker

Each seat runs a checker: a small program that reads its own systems, builds its numbers, and signs or refuses by itself. If it cannot read a source, it sends nothing. A webhook and e-mail tell the seat's team when something is waiting. It can run three ways:

No outside party has run a checker yet.

11. Standards we write against

The rules follow established fund practice, without claiming compliance with any of it:

• IOSCO Principles for the Regulation of Exchange Traded Funds (2013);
• IOSCO Principles for the Valuation of Collective Investment Schemes (2013);
• the daily-NAV, forward-pricing model of UCITS funds and of US funds under the Investment Company Act of 1940 (Rule 22c-1 forward pricing, Rule 2a-5 fair value, Rule 2a-7 money-market funds).

Thresholds called "common practice" are conventions, not law. Our earlier self-assessment against the IOSCO Principles for Financial Benchmarks was written for the retired price-fixing design and is kept in Methodology v1.0 §11 as a record.

12. Regulatory position

• ETP Foundry is not authorised or registered with any regulator, in any role: not as a fund administrator, transfer agent, custodian, exchange or benchmark administrator.
• Where a jurisdiction requires a licensed firm in a role, that firm keeps the role and holds the seat.
• If someone else uses a value we calculate as a reference, benchmark rules may apply to that use (UK and EU Benchmarks Regulation, MI 25-102 in Canada, and in the US Rule 2a-5 and the Commodity Exchange Act's anti-manipulation rules). These are open questions for counsel.
• Nothing is offered to investors. Nothing here is investment advice.

13. What is built, and what is not

Built and tested in code: the fund committee, its roles and rules (§5); the NAV, fee and basket-change checks; the error classes; the emergency pause and suspension; the wind-down notice; automatic proposal, refusal, re-proposal, escalation and deadline (§6); the price-source order and stale rules (§3.3–3.4); the dealing gate that stops creations and redemptions during a pause, suspension or past a wind-down.

Running on DevNet: two test funds (cBTC + cETH; cBTC + cETH + Canton Coin) created and redeemed atomically with real DevNet tokens, which have no money value. Their indicative NAV is read from Chainlink feeds.

Not yet:

• no outside party holds a seat, so no fund committee is set up with outside parties and no NAV has been signed by one;
• L2 signing is switched off on the running desk; L3 is not built;
• the ledger's basket choices do not themselves read a pause: the dealing gate is enforced by the desk, so a market maker that bypassed the desk would still need the fund's co-signature on every creation and redemption;
• the fund records need Daml package crossdesk 3.3.0 on the participant; where it is not installed the desk says so, and no fund action or pause can be recorded;
• no independent oversight, no external audit.

14. Open decisions

15. Appendix: retired from v1.0

These belonged to the retired price-fixing product. They are not in force. The full text stays on file in Methodology v1.0.

• The fixing: a committee-set official price for a token, its strike times (16:00 London for crypto; 16:00 New York for equities) and 60-minute observation window. The 16:00 London time survives only as the crypto funds' valuation point.
• Venue price formation: venue VWAPs, the volume-weighted median, the outlier rule, the 50% weight cap and venue eligibility conditions.
• The 24/7 family: OFF-HOURS SIGNED fixings at 00:00, 08:00 and 16:00 UTC, the data-quality band, and the TOKEN-CONSENSUS fallback.
• The tier scale 0–5 for prices, including reference × par (tier 3). For funds, values are labelled signed, indicative or missed (§7).
• The 1 bp, two-business-day restatement rule, replaced by the NAV error policy (§6.6).
• Benchmark-administrator duties and the IOSCO benchmark self-assessment.
• Tokenized-equity reference and index rules (§3B of v1.0): written, never built, not restated.

16. Version history

ETP Foundry is a trading name of Lucilla, Inc., Toronto. Canton DevNet only. Not authorised or registered with any regulator. Code not independently audited. Nothing in this document is investment advice or an offer of any financial product.