Introduction
substrate.icu is a suite of Substrate FRAME pallets for the Polkadot ecosystem. Three protocols are live on Paseo testnet.
| Protocol | Description | Status |
|---|---|---|
| PNS2 | Blockchain-native name service. Human-readable names resolving to wallet addresses and DNS records. | Paseo Testnet |
| ZK-PKI | Hardware-anchored public key infrastructure. Tier 1: TPM 2.0 (gold standard, full PoP). Tier 2: Android StrongBox (full PoP). Tier 3: Apple Secure Enclave (machine identity only, no PoP cert). | Paseo Testnet |
| Dotwave | The everything app. Multi-platform, written in Rust. Your gateway into the substrate.icu ecosystem — ZK-PKI ceremony, Secret Squirrel, and more coming. | Paseo Testnet |
| Secret Squirrel | Dead drop messaging built into Dotwave. Deniable communication between verified identities. | Paseo Testnet |
Architecture overview
PNS2 and ZK-PKI are independent FRAME pallets that integrate cleanly. Neither requires the other.
-
PNS2 Paseo Testnet
-
ZK-PKI Paseo Testnet
-
Dotwave Paseo Testnet
Paseo testnet
All protocols are live on Paseo, Polkadot's public testnet. Paseo is the path to mainnet.
| Detail | Value |
|---|---|
| NETWORK | Paseo |
| ROOT DOMAIN | *.paseo.substrate.icu |
| RPC | wss://rpc.substrate.icu |
| TEST SUITE | 226 passing. Full regression tested, hardened, and benchmarked. Fagan inspection complete. (Paseo testnet) |
| TARGET | Polkadot mainnet parachain |
Polkadot Name Service 2
PNS2 is a blockchain-native DNS replacement built as a Substrate FRAME pallet. Names resolve to wallet addresses and standard DNS records. substrate.icu is the root domain.
Bring your own gateway. Point your PNS2 name at an IPFS gateway, a GitHub Pages site, or any web content you control. Because resolution goes through the Snorkel — real DNS, not a proxy — your name gets a legitimate DNS record, which means a legitimate TLS certificate. No workarounds. Reach out to get your gateway TLS cert set up.
Zero-Knowledge Public Key Infrastructure
ZK-PKI is a hardware-anchored identity system built as a Substrate FRAME pallet. Identity certificates are minted as NFTs, anchored to the hardware security chip in the user's device. One certificate is issued per hardware root per issuer. Proof of personhood is only enforced when the issuer performs KYC — without it, a user with multiple devices can hold multiple certificates. The KYC step is off-chain, issuer-driven, and not required by the protocol.
Dotwave
Dotwave is the everything app for the substrate.icu ecosystem. Written in Rust, multi-platform, and your gateway into the testnet. It handles the ZK-PKI ceremony via Android StrongBox, hosts Secret Squirrel, and is the launchpad for a growing suite of apps, games, and features. If substrate.icu is the highway, Dotwave is the on-ramp.
- Android StrongBox Soon
- Integration guide Soon
-
Secret Squirrel Paseo Testnet
Reserved names
The following names are reserved at the pallet level and cannot be registered by users on any substrate.icu network.
| Name | Reason |
|---|---|
| www | System infrastructure |
| docs | System infrastructure |
| api | System infrastructure |
| rpc | System infrastructure |
| status | System infrastructure |
| admin | System infrastructure |
| faucet | System infrastructure |
| node | System infrastructure |
| gateway | System infrastructure |
| resolver | System infrastructure |
| dotwave | dotwave product |
| snorkel | Snorkel DNS bridge |
| zkpki | ZK-PKI protocol |
| zk-pki | ZK-PKI protocol |
| pns | PNS2 protocol |
| pns2 | PNS2 protocol |
| registry | PNS2 protocol |
| explorer | Future product |
| substrate | Brand protection |
| polkadot | Brand protection |
| kusama | Brand protection |
| paseo | Brand protection |
Patent & IP
The ZK-PKI system is patent pending.
| Detail | Value |
|---|---|
| APPLICATION | US Provisional 64/043,754 |
| FILED | April 19, 2026 |
| STATUS | Patent Pending |