Trust & limitations

What Can Fail, and What the Architecture Does About It

Removing custody and discretion removes their failure modes. It does not remove bank risk, completion risk, operational trust, or irreversible mistakes. These limits belong beside the product thesis, not underneath it.

The taker pays before the crypto transition settles

Fiat payment and crypto release cannot be physically atomic across an external bank rail and Ethereum. After sending fiat, the taker still has to obtain a valid notary quorum, generate the evidence proof, and reach epoch inclusion before the claim expires.

The required wallet preflight checks every condition it can observe before displaying payment instructions: direct MPC reachability, authenticated account state, adapter extraction, two reachable notaries, remaining settled-epoch lifetime, balance, and rail prerequisites. It cannot prevent a bank outage, notary outage, device failure, or censorship event that begins after payment.

The amount and memo must be exact

Each offer binds one admitted fiat currency and an unsigned integer amount in that currency's minor units. The observed amount must equal the offer amount — no tolerance, “at least” rule, decimal guess, partial settlement, or refund path. Recipient, currency, memo, claimant, rail, adapter, unique transaction identifier, and final status must match too.

Underpayment and overpayment are equally unprovable. A proof system cannot return fiat sent in error, and no administrator exists to manufacture an exception.

A claim bond prices griefing; it does not eliminate it

A taker cannot reserve an offer for free. Claiming posts a mandatory fungible bond and starts a lifetime measured in settled epochs. If the claim expires, a reclamation proof reopens the offer and pays the bond to the maker.

That turns capital locking into a paid attack. A sufficiently wealthy or externally motivated attacker can still buy denial of service. Bond floors and claim lifetimes require measured economic calibration; unexplained round numbers are not acceptable policy.

Two of three notaries remain a trust assumption

One malicious notary cannot authorize settlement, because the proof requires two attestations over the same normalized bank fact. Two colluding or jointly compromised notaries can.

Independence must exist beyond public keys: operators, hosting accounts, credentials, deployment control, and durable signing state need separate failure domains. The target hash-based signature is stateful; reusing a Winternitz signing index is catastrophic, not an ordinary recoverable incident.

The proof certifies the bank interface, not reality beyond it

An adapter proves what an authenticated bank response reported. If the bank labels a reversible entry as final, exposes the wrong recipient field, rewrites the memo, or changes transaction IDs, the proof can faithfully certify a bad external fact.

Every accepted adapter therefore needs a documented semantic contract for its booked status and stable identifiers, repeated reconciliation against production behavior, and evidence that the selected domestic or international transfer flow has the intended finality for that currency and jurisdiction.

A bank can become unsupported without warning

The target permits direct MPC-TLS only. A proxy mode changes the threat model and cannot activate as an automatic performance fallback. A bank-side TLS change, WAF, fingerprint rule, login challenge, response-schema change, or session deadline can make the unique evidence path stop working.

Adapters are immutable. Compatibility returns through a newly reviewed adapter or deployment, not through a mutable parser registry or a best-effort schema guess.

Banking access and local law are launch blockers

On-device, user-consented access minimizes disclosure; it does not decide whether automating a consumer-facing bank session is permitted. Every bank adapter needs written review in each target jurisdiction covering terms of service, credential handling, payment-services regulation, privacy roles, sanctions and AML obligations, and computer-misuse risk.

PayMoney offers are settlement instructions, not invoices. Businesses remain responsible for local invoicing, accounting, tax, reporting, and regulatory duties independently of the protocol.

Privacy begins after deposit and ends at withdrawal

Ethereum deposits and withdrawals are public. Inside the vault, the target hides participants, amounts, destination, offer, claim, bank transaction, and concrete adapter. The public proof shape still reveals that an external-evidence-class action occurred in an epoch, and a small anonymity set can make that event conspicuous.

The fiat transfer remains visible to both banks and may contain legally required identity data. This is post-deposit transaction privacy and private proof of payment, not anonymous banking.

Users own the data needed to spend

Keys and resource witnesses stay user-controlled. Losing either may permanently destroy liveness for the affected resource without giving anyone else control. Guardian recovery can address the authority key only if configured beforehand; it does not recreate missing witness data.

Aggregation can delay even when it cannot forge

The solver and aggregator cannot invent valid bank evidence or account authority. They can censor or delay an action. The underlying vault answers with bonded rotation, checkpoint demand, and forced inclusion, but L1 congestion and unavailable proof capacity can still delay everyone.

Immutability makes defects permanent until users move

There is no administrator, pause switch, upgrade key, emergency parser, or in-place migration. That removes privileged compromise from the deployed state machine and makes a bug a redeployment event. It is a security advantage only when deployment identifiers, wallet discovery, asset continuity, and communication are rigorous.

Nothing here has passed the production gates yet

This is a published target architecture. Production requires, at minimum, machine-checked completeness and offer-state models; adversarial payment-matching and replay tests; audited hash-based notary specifications and state durability; operationally independent notaries; real bank TLS, schema, and rail measurements; written legal approval; measured Stwo economics and L1 gas; and an explicit privacy leakage inventory.

A failed gate excludes the adapter or deployment. It does not activate a substitute evidence path.