ONCHAINID V3 turns regulated-asset identity into a smart account

T-REX Network and OpenZeppelin announced ONCHAINID V3 on September 29, folding a verified-claims registry into a modular smart account. OpenZeppelin’s announcement frames the redesign as pushing the identity layer of the T-REX framework past claim storage, so the account itself can hold assets and interact with protocols directly.

Three standards underpin the architecture: ERC-734 for key management, ERC-7579 for transaction validation and execution permissions, and ERC-4337 for account abstraction.

What changed for protocols

The old ONCHAINID was mostly a registry — protocols checked whether someone held the right verified claims before letting them touch a regulated token, and that was about the extent of it. V3 makes the identity an account. It can own assets and call into protocols. Keys, claims and transaction execution each run through separate installable modules.

Signature flexibility got an overhaul. V3 supports ERC-7913, expanding accepted credential types to secp256r1, RSA and WebAuthn alongside standard ECDSA.

Recovery mechanics are modular as well — guardian and threshold options for social recovery are included. Crosschain identity verification also ships with V3, so a single identity can be checked across chains, and the identity can hold assets and interact with the ecosystem directly, while its verified status can be checked across chains. Deployment chains and a deployment deadline remain unknown.

The compliance logic traces back to T-REX’s ERC-3643 framework, where token contracts consult participant identity contracts to determine whether someone is eligible to hold a regulated asset. V3 collapses the distance between the account carrying the compliance record and the account executing the transaction.

Audit arithmetic

OpenZeppelin audited the redesign itself, covering the T-REX-Network/ONCHAINID repository at commitd2096509, with work running from July 27 through August 7, 2026. The OpenZeppelin Security audit found 39 total issues, 36 resolved — 92.3% (36 divided by 39). Three remain unresolved.

The severity breakdown: one critical, two high, nine medium, 20 low. The critical and both high-severity findings were fixed. Seven of nine medium issues were resolved (77.8%); 19 of 20 low issues were resolved (95%).

The critical finding — “Validator and Account Resolve the Same Batch Calldata to Different Targets” — was addressed at commiteadb9f7 on PR39. The high-severity finding, “Queued Approval Omits the Factory Guard That Auto-Approval Enforces,” was resolved at commit16101bc on PR41. Both fixes merged at commit4fda205. The audit documents what was reviewed and what was fixed; it doesn’t certify that the three unresolved issues carry no risk.

For regulated-asset participants, V3 means verification, account permissions and asset interactions can live in one place. For protocol builders, the module architecture creates installable hooks for keys, claims, execution, recovery and signature validation.

The roadmap includes confidentiality work through Zama’s fully homomorphic encryption, with no timing attached. The V3 announcement was published September 29, 2026.