Three contracts
The earlier SettlementCoordinator + KeystoneEscrow pair is retired. The lifecycle is now fixed in contract code - no state graphs are stored on-chain, and no transition transactions exist.
Design principles
- No custody by KeyStone. Funds sit in the contract under rules bound at registration. There is no KeyStone-controlled withdrawal path - even the operator can only
abort, which unlocks pull refunds to the recorded depositors. - Everything binds at registration. Recipients per leg, deposit keys, party hashes, fees, and the timeout are fixed in one
registerSettlementcall. No later transaction can change where funds go. - Autonomous execution. The last deposit executes the settlement inline when the compliance gate passes - all legs pay out atomically in one transaction, or none do. If attestations land later, any depositor (or the operator) can call
execute(). - Depositor-driven recovery.
claimTimeout(at/after the deadline) andclaimRefund(per leg, after abort or timeout) can be called by any depositor as well as the operator, and cannot be paused. Funds are never locked indefinitely, even if KeyStone disappears - every party with funds at stake can recover them itself. - Privacy-preserving deposits. Deposit authorization uses wallet-bound commitment keys (
keccak256(abi.encode(wallet, secret))) - depositor intent stays off-chain until the deposit transaction itself. - Single-chain by default, cross-chain by registration mode. A settlement registered with
abortDeadline = 0settles both legs on one chain and executes autonomously. A non-zeroabortDeadlineopts into the cross-chain Prepared phase, where the KeystoneRouter coordinates release or abort across chains with disjoint release/timeout windows. The hosted platform currently registers every settlement single-chain.
What lives on-chain vs off-chain
Trust model
KeystoneSettlement
Registration, commitment deposits, autonomous execution, recovery.
ComplianceRegistry
M-of-N on-chain compliance attestations gating execution.
KeystoneRouter
Cross-chain release/abort coordination over LayerZero V2.
Testnet Addresses
Deployed contract addresses.