Transparency
The bridge's live proof layer: sentinel status, signed checkpoints, the public key, and the warrant canary. Every signature shown as verified is checked in your browser, never taken on faith.
each root extends the previous — a rewritten history cannot
What is a checkpoint?
Every receipt the bridge issues is appended to a Merkle tree. A checkpoint is a signed snapshot of that tree: its size, its root hash, and the previous root. Because each checkpoint commits to the one before it, the bridge cannot quietly rewrite or delete history. Any fork produces two signed checkpoints that contradict each other, and either one is proof of misbehavior.
What does the sentinel watch?
The drain-guard sentinel continuously compares hot-wallet outflows, order volume, and receipt issuance against hard limits. If withdrawals outpace what signed receipts can account for, it halts order intake automatically and records why. The pause state and every trip event are published here, not hidden in an internal dashboard.
Why do receipts matter?
A bridge that says "trust us" is asking you to hope. A signed receipt is different: it is a cryptographic commitment to the exact terms of your swap, chained to every other receipt for the order. If the bridge later disputes what it owed you, the receipt is portable proof anyone can verify without trusting this website.
Verify any order's receipts on the Verify page — or download the offline verifier and trust nothing but the math.