Lead Product Designer · Design system · Dec 2025 — Jun 2026

Design system for a
crypto payroll wallet

An internal wallet that pays salaries in crypto. Every transfer is irreversible — and that one fact shaped every token, component and rule below.

Employees are paid in crypto and move it to USD cards. A design system here is not about consistency. It is about making sure the interface never lies about money.

That turned into three requirements everything else had to meet.

01
Money always looks like money
Amounts run on their own type ramp and their own colour tokens, so a number can never be mistaken for a label or a caption.
02
Safe and irreversible never look alike
A confirmation that cannot be undone must be impossible to confuse with an action that can.
03
Every screen is reproducible from the library alone
No local components, no detached styles — if it is on a screen, it came from the system.

Buttons carry the weight
of the action

Three variants, every state. Lime is earned — reserved for the one forward action per screen, never spent on something that can be undone.

Button · 36 variants
Default
Pressed
Disabled
Loading
Primary
Button
Button
Button
Secondary
Button
Button
Button
Tertiary
Button
Button
Button
Sizes · 32 / 44 / 56

One control height per context. The 44px hit area is the floor on touch.

The irreversible rule

Sending money cannot be undone — so it never wears Primary. An action you cannot take back must never be the most inviting thing on the screen. Danger is reserved for destruction, never dressed up as an invitation.

AaBb
012345
!*#©
Manrope
Interface · headings · labels
Roboto
Amounts · tabular figures
#E3FC53 Accent
80%
60%
40%
20%
#D8DDC7 Bone
80%
60%
40%
20%
#9BA383 Sage
80%
60%
40%
20%

Colour exists in this system
only as a variable
.
Not one paint style, not one
raw hex on a component.

A colour you cannot rebind to a theme will break the moment the theme changes — so the system does not allow one to exist.

--surface --border --danger/text 39 semantic tokens #B91C1C
Primitive
#B91C1C
red/600
Semantic
danger/text
Light Dark
Component
TagPill · Danger
ButtonButton
IconButton
PlaceholderInput
ChipChip
USDCryptoSegmentedControl
Switch
APAvatar
CurrencySettingsRow
IconChip
NeutralTagPill
Amount
$ 1,200.00
Balance: $1,250.00
AmountInput

Its own type ramp

Roboto tabular figures — 1,200.00 never jitters against 250.00. Never demoted to a label.

N
Salary received Northwind Ltd
+ 1,200.00
O
Incoming failed Orbit Pay
+ 400.00
TxRow

Sign, not outcome

Direction drives the colour. A failed incoming is still Positive — success is a status, direction is a fact.

ToUSD card ·· 4471
Network fee$1.20
Total $250.00
DetailRow

The final line

Total lifts onto the amount ramp while every line above stays quiet — on the screen you cannot undo.

governance.rules
# a system that outlives its author

A system that outlives its author

The hardest part of a design system is not building it. It is making sure it still holds when the person who built it is not in the room. Four things do that work here.

rule.01 = ds_first

Components are created in the system file and consumed as library instances — never drawn locally in the working file. A component that can be built by hand will be built by hand, so the system removes the option.

rule.02 = docs_in_library

All 14 sets carry a documentation frame next to the component: what each variant is for, which tokens it binds, what it must never do. A rule that lives only in someone's head is not a rule.

rule.07 = mascot_scope

The mascot appears in onboarding, empty states and salary-received screens only — never on an error, a confirmation, or any screen that moves money. Money leaving an account is not a moment for a character.

rule.04 = conformance

Where a rule can be enforced by the component itself, it is: Tone is one axis so a pair can't be broken, a Segment can't be placed without a SegmentedControl, a theme is a mode and never a component property. The best rule is the one you cannot break.

Built from the library

The system,
assembled

Every screen is a library instance — no local components, no detached styles.

Crypto balance screen built from the library Crypto balance
Empty state screen built from the library Empty state
pap pay logo
pap pay mark pap pay app icon
The library, live
Open the design system in Figma

Every token, component and documentation frame in this case — 139 tokens, 16 components, 454 icons — in the working file.

View in Figma