Risks

Removing intermediaries removes their failure modes and adds others. These are the ones this design creates, written the way we would want to read them before using it.

Pay outside the band and there is nothing to prove

The amount check is two-sided: the payment must land at or above what the trade specifies, and no more than a fixed tolerance above it. Underpay and no proof exists. Overpay past the tolerance and no proof exists either — the money has left your bank and the escrow will expire back to the seller, which is the worst outcome on this page and the reason the exact figure is shown before you send.

Inside the band the trade settles, and the escrow still releases the quantity the offer fixed, so anything you paid above the agreed amount is gone. There is no refund path because there is no operator to run one.

A griefer can lock a maker's capital

A taker can claim an offer, never pay, and let the window expire. It costs them nothing and it costs the maker the use of that capital until the window closes. There are no claim bonds, so the defence is priced rather than enforced: a maker's spread has to cover the expected cost of being griefed.

Shorter windows reduce the damage and start rejecting honest-but-slow payers; longer windows do the reverse. There is no setting that avoids the trade-off, and no published analysis proving the equilibrium is stable — the reason to believe it is that comparable systems run on it in production, which is evidence rather than proof.

The notary is a trusted party

Settlement rests on three assumptions: the TLS session's pseudorandom function, the soundness of the STARK, and the unforgeability of the notary's signature. Break any one and settlement breaks.

Today that means a single notary, self-hosted. The known residual risk is collusion between the notary and a prover, which a single notary cannot mitigate; the path away from it is a threshold of independent notaries, and that is not built. The notary's signature is also the one elliptic-curve dependency on the settlement path, which the security page covers in full.

Deposits are public; privacy starts after them

The deposit transaction is visible on Ethereum, like any other. What the design provides is unlinkability between that deposit and any later spend — not anonymity at the moment value enters. Anyone claiming a shielded pool hides your deposit is describing a different system. Address hygiene before depositing is your own concern and outside the protocol.

A bank's TLS upgrade ends support for it

The attestation requires the bank to serve TLS 1.2. When a bank moves to TLS 1.3, that bank stops working until the notary scheme is replaced. This is the most likely thing to force a redeployment, and it is not under our control.

Nothing can be reversed

The settlement contract holds no administrative authority at all — which is the property that makes a mistake permanent. There is no reversal, no support queue that can move your funds, and no exception for a sympathetic case, because there is no mechanism that could produce one. Every other risk on this page inherits it: whatever goes wrong here, it stays wrong.

You hold your own witnesses

Authority is knowledge of a key, and spending also requires the witness data that proves what you own. Lose either — a single-key account with no guardians configured, or the local state behind a note — and access is gone. This is a liveness failure rather than a safety one: nobody else gains what you lost. Guardian-based recovery exists precisely for the key half and has to be configured before it is needed, not after.

Proving is bound by bandwidth, not by computation

The attestation runs a multi-party computation with the notary that uploads a large volume of cryptographic material before the bank session even begins. On a fast connection that is seconds; on a slow one it is considerably worse, and bank sessions time out on their own schedule. A poor connection is therefore a real failure mode, not a slow success.

An observer learns that a settlement happened

Padding hides which offer, which amount and which party. It does not hide that a PayMoney settlement occurred in a given epoch, and while volumes are low the anonymity set within an epoch may be one. Epoch-level activity is visible; everything inside it is not.

The audit surface grows with every kind

Each new kind of value the vault understands adds its own logic to audit, and the component that checks them all is a single concentrated point of failure: a flaw there is catastrophic rather than contained. Machine-checked foundations gate every deployment for exactly this reason, which is a process answer to a structural problem, not a proof that the problem is gone.

Aggregator rotation rests on research-grade work

The hash-based verifiable random function that rotates the aggregator is recent published research, not a mainnet-proven construction. It was chosen because the curve-based alternative would have put an elliptic curve back on the critical path — a considered trade, and still a bet on newer work.

None of this is running yet

The design is published; the software is not finished. Nothing on this site has processed a real settlement, no figure here is a measurement, and the cryptographic work at the centre of it — verifying a bank attestation inside a proof over a small field — has no existing implementation to borrow from. Treat every claim as a specification.