PD contract architecture. PDFactory deploys each PDProject with its PaymentSplitter; PDProject reads blessed libraries from PDLibraryRegistry at render time. PDStickers reads the factory's platform wallet live and pays royalties to StickerSplitter vaults. PDKeychains mints living charms drawn by the PDKeychainRenderer and its three part stores.

--- title: "Smart Contracts — Overview" description: "The PD protocol layer: one factory, one immutable ERC-721 per Project, per-Project royalty splitters, the on-chain library registry, the ERC-1155 sticker shop, and the keychain capsule machine. Architecture and guarantees." category: "contracts" keywords: ["contracts", "architecture", "PDFactory", "PDProject", "PDStickers", "PDKeychains", "immutable"] last_updated: "2026-10-17" --- # Smart Contracts — Overview The PD protocol is a small family of contracts with one temperament: immutable logic, money that never rests, and art that renders from the chain alone. One factory is deployed once; every Project deploys its own ERC-721 and royalty splitter beside it; a shared append-only registry holds the art's libraries; the sticker economy runs on its own ERC-1155 with matching splitter vaults; and the keychain capsule machine mints one-of-one charms drawn entirely by an on-chain renderer. Everything below is taken from the contract source. ## The architecture - **[PDFactory](/docs/contracts/pd-factory)** — deploys every Project (through its own deployment arm, a size-limit split with zero governance surface). Holds the artist whitelist, the platform wallets, the storage-fee corridor, and the registry of everything it has deployed (`isProject`). - **[PDProject](/docs/contracts/pd-project)** — the per-Project ERC-721. Stores the generative script on-chain, commits each Output's hash at mint and reveals it a block later (so no minter can pick their outcome), renders `tokenURI` entirely from chain data, pays out 95/5 inside every mint transaction, opens every drop with the fail-open 60-second entry window, and signals EIP-2981. - **[PaymentSplitter](/docs/contracts/payment-splitter)** — receives the Project's 5% secondary royalty and splits it 60/40 (3% of sale to artist, 2% to platform), with permissionless withdrawals in ETH and ERC-20. - **[PDLibraryRegistry](/docs/contracts/library-registry)** — append-only, on-chain storage for the blessed JavaScript libraries — at launch the shelf holds p5.js 1.11.13 plus the gzip inflater, and more libraries can be added to it later — that Projects may bind, and the source of every Output's Language attribute. - **[PDStickers](/docs/contracts/pd-stickers)** — the sticker economy's ERC-1155: fully on-chain SVG stickers sold as sealed sheets, peeled to reveal, with royalties flowing to **StickerSplitter** vaults that mirror the Project split. It reads the factory's live platform wallet, so both economies rotate at one point. - **[PDKeychains](/docs/contracts/pd-keychains)** — the capsule machine's ERC-721: one-of-one living charms drawn entirely by the on-chain **PDKeychainRenderer** and its three part stores, with luck-tilted rarity rolls frozen at the crank, the polish attestation, and the keeper bond. ## The guarantees - **Projects are immutable.** No admin, no pause, no upgrade path, no withdraw function, no balance. A Project's terms at deployment are its terms forever. - **The art is on Ethereum.** Scripts live in SSTORE2 data contracts; `tokenURI` returns a self-contained data URI whose HTML document renders the artwork from the token's on-chain hash. No server, no IPFS, no platform dependency. - **Money never rests in contracts.** Primary proceeds push to artist and platform inside the mint transaction; secondary royalties rest only in the Project's own splitter until anyone triggers a withdrawal, which can only pay the artist's immutable address or the factory's current platform wallet. - **Governance is minimal and visible.** The factory's admin whitelists artists and rotates platform wallets through two-step transfers — and the two wallets that receive pushed ether must prove they can receive it before going live; the storage fee moves only within an immutable corridor. Nothing an admin holds can touch a deployed Project. - **Nothing can permanently halt a mint.** The one time-boxed mechanism in the protocol — the contested-drop entry window — fails open at an immutable deadline: if the platform's settlement server never shows up, minting opens by itself. There is no oracle and no external price dependency anywhere. ## Verification status The suite is complete and under test — **more than 400 Foundry tests** in the repository, including differential fuzzing of the assembly paths against memory-safe references — with continuous integration running the full suite plus an EIP-170 deploy-size gate on every push, so an undeployable contract fails the build rather than surfacing at launch. An earlier revision of the stack is deployed to the Sepolia test network and was exercised end to end there, including a full live run of the money paths (mints, royalties, sticker purchases and peels, marketplace sales) verified to the wei, and the launch build was then rehearsed on a simulated copy of mainnet before going live. The suite has been live on Ethereum mainnet since October 16, 2026, and every contract's source code is verified on Etherscan. Every address, with a link to its verified source, is on [Audit Buddy](/docs/contracts/audit-buddy). The [$PRICE token](/docs/price-token/contract) — a separate, standalone contract — is live on mainnet too. ## Further reading - [PDFactory](/docs/contracts/pd-factory) · [PDProject](/docs/contracts/pd-project) · [PaymentSplitter](/docs/contracts/payment-splitter) · [PDStickers](/docs/contracts/pd-stickers) · [PDKeychains](/docs/contracts/pd-keychains) · [PDLibraryRegistry](/docs/contracts/library-registry) - [The Mint Flow](/docs/for-artists/the-mint-flow) — the same machinery, artist's-eye view