Guardian protection

The Guardian Council is the independent enforcement layer of Bitcoin Collateral Vaults. It checks settlements against the lending position and can return an invalid payout to its prescribed vault before the recipient collects it.

The production design places this responsibility with named institutional participants operating independent validators. Guardians have a specific power: enforce the agreed settlement rules through transactions whose return destinations are already fixed.

Authorization and review are separate

The customer authorizes the permitted Bitcoin transactions. Protocol participants co-sign through distributed threshold signing. Oracles then authorize the matching price or debt event, and guardians independently review the settlement it produces.

Each event authorization is bound to the position and its agreed terms. It activates a covered transaction without changing the amounts or destinations the customer signed.

Release and debt statements use a mixed roster of signers, guardians and liquidity providers, together with the attester’s own finalized observation. The participant supplying a statement cannot serve as its sole independent watchdog. This separation keeps settlement review independent of the assertion it checks.

Protection is built into the payout

A settlement pays into a protected Bitcoin output with these paths:

flowchart TD
    C["Authorized event cheque"] --> S["Protected settlement allocation"]
    S --> A["Beneficiary plus guardian acknowledgement"]
    S --> D["Beneficiary after the committed delay"]
    S --> R["Recipient-authorized return completed by guardian quorum"]
    A --> P["Beneficiary payout"]
    D --> P
    R --> V["Contested BTC returned to a vault"]

For a valid settlement, the beneficiary can collect early with guardian acknowledgement, or after the committed delay. For an invalid settlement, the required guardian quorum completes the recipient’s pre-signed return to the source vault. Guardians cannot redirect that return to themselves, and no fresh recipient signature is needed.

A confirmed return consumes the payout output. Waiting out the delayed lane cannot undo it.

An independent check on oracle authorization

Guardians check the settlement using independent price and position evidence. This protection applies even when an oracle quorum has authorized an incorrect outcome: the oracle does not have the final word on collection.

The operating assumption is an honest, available guardian quorum with the evidence and pre-signed return needed to confirm intervention within the contest window. The delayed payout lane is a deployment setting, currently one Bitcoin block; after it matures, the beneficiary can spend without council approval. Protocol parameters records the deployment’s timing and finality requirements.

Protection alongside customer control

Guardian enforcement complements your own authority over the vault. It covers settlement payouts, while the customer escape provides a Bitcoin-enforced exit for an eligible unspent vault after its timelock.

Read Trust assumptions for the production model, Recovery for the customer exit, and the rollout for the path toward proof-based verification.