Transparency

Every receipt the bridge issues is appended to a Merkle tree. A checkpoint is a signed snapshot of that tree: its size, its root hash, and the previous root. Because each checkpoint commits to the one before it, the bridge cannot quietly rewrite or delete history — any fork would produce two signed checkpoints that contradict each other, and either one is proof of misbehavior.

The drain-guard sentinel continuously compares hot-wallet outflows, order volume, and receipt issuance against hard limits. If withdrawals outpace what signed receipts can account for — the signature of an operator gone rogue or a compromised server — it halts order intake automatically and records why. The pause state and every trip event are published here, not hidden in an internal dashboard.

A bridge that says "trust us" is asking you to hope. A signed receipt is different: it is a cryptographic commitment to the exact terms of your swap — amounts, rate, fee, and transaction hashes — chained to every other receipt for the order. If the bridge later disputes what it owed you, the receipt is portable proof that anyone can verify without trusting this website, using the offline verifier.