Seven registries and a timelock.
Every contract has one job. Hover or click a registry to see what it owns, who can call it, and the events it emits.
AnonCredsStatusRegistry
Per-credential issuance and revocation status keyed by (credDefId, credIdHash). The verifier's eth_call after verifyProof. Mode A (AnonCreds VDR) lives here.
UUPS + ERC-7201
Every registry is a UUPS-upgradeable proxy with namespaced ERC-7201 storage, so upgrades never collide with existing layout.
AccessControl · Pausable · Timelock
RBAC gates every privileged call, a pause switch halts issuance under incident, and the timelock delays governance and upgrade actions.
Mode A vs Mode B
Mode A is the standard AnonCreds VDR path — AnonCredsStatusRegistry holds per-credential status, the wallet does nothing Kanon-specific. Mode B routes Groth16 ZK proofs through Groth16VerifierRegistry for unlinkable presentations.
Runs on any EVM
Solidity 0.8.24, Cancun-target. Reference deployment on Hyperledger Besu 26.5 with the EIP-2537 BLS12-381 precompiles, but Kanon runs on any EVM L1 or L2 that supports the same opcodes — Ethereum mainnet, Arbitrum, Optimism, Polygon zkEVM, Base, custom permissioned EVM rollups.