In the Web3 space, compliance issues have always been a significant challenge faced by the project party. Especially when it comes to security tokens, if one inadvertently falls into an unqualified Address, it may violate U.S. securities laws, leading to serious legal consequences. To address this issue, Plume has proposed an innovative solution that brings compliance checks to the protocol layer.

The core concept of Plume is "Compliance first, then mint; if not approved, zero Gas consumption." This approach effectively avoids potential legal risks in the future by directly preventing wallet operations that do not meet the conditions during the pre-compilation stage of the transfer.

The plan adopts a three-stage "identity-permission-behavior" framework:

First, during the identity verification phase, use off-chain KYC providers (such as Onfido, SumSub, Fractal, etc.) to complete the verification of user identities and generate verifiable credentials (VC).

Secondly, during the permission granting phase, the KYC institution uses a private key to sign the VC hash with EIP-712, and then batch writes the hash values into the Merkle tree, subsequently uploading the tree root to the blockchain.

Finally, in the execution phase, when a user attempts to perform a transfer or minting operation, the smart contract will automatically call the pre-compiled compliance_hook, inputting the Merkle proof. On-chain, only the validity of the root and the signature needs to be verified, without the need to store any personal sensitive data.

The design of Plume also has a high degree of flexibility. By abstracting the IKYCProvider interface, the project party can easily switch between different KYC service providers just like changing a USB device. This pluggable design greatly enhances the adaptability and scalability of the system.

Overall, Plume's innovative approach not only effectively addresses the compliance challenges of RWA projects but also provides a valuable example for the entire industry. It demonstrates how to protect user privacy while meeting regulatory requirements, promoting the Web3 ecosystem towards a more standardized and healthy direction.