Trust assumptions
Bitcoin Collateral Vaults put BTC to work while keeping it on Bitcoin, under rules the customer authorizes. The production design combines three protections: constrained spending, independent guardian enforcement and a customer-controlled exit.
Your signature sets the boundaries
Every vault spend requires your live signature or a transaction you authorized in advance. Those pre-signed transactions fix the Bitcoin amounts and destinations. The protocol’s signing authority is distributed across independent participants; even together, they cannot create a different spend without your authorization.
This is 0-of-N custody: no coalition of operators has arbitrary control over your vault. Your key remains in your Bitcoin signer.
Independent guardians enforce settlement policy
Oracles authorize covered events. The Guardian Council independently checks whether the resulting settlement is justified. An oracle authorization does not bypass that review.
Settlement payouts pass through a protected Bitcoin output. For an invalid settlement, guardians complete a return transaction signed in advance by the payout recipient. A confirmed return sends the contested BTC back to its prescribed vault, preventing collection through the delayed payout path. The recipient’s further cooperation is not required.
The protection assumes that the required guardian quorum acts honestly, uses independent evidence and confirms the return within the committed contest window. The return must be available to that quorum. In V2 this is a configured threshold of guardians, rather than one individual challenger. The delayed payout lane is a deployment setting; this deployment locks it for one Bitcoin block.
The production model is designed around named institutional participants with independent operations and defined responsibilities. Their authority is constrained by the signed transactions and Bitcoin’s rules. Guardian protection explains the process.
Your exit is enforced by Bitcoin
An eligible unspent vault has a customer-only escape after its committed Bitcoin timelock. It requires no protocol signature or functioning destination chain. The same protection applies to a V2 remainder under that output’s own clock.
You retain your key and the public vault records needed to construct and fund the recovery transaction. BTC already in a protected settlement output follows that output’s settlement paths. See Recovery.
The operating foundation
The system relies on Bitcoin consensus, finalized destination-chain observations, correct lending contracts and protected signing keys. Protocol signing, oracle authorization and guardian review have separate duties; release and debt statements draw on a mixed participant roster, with independent verification.
Borrowing remains subject to collateral value, debt, available liquidity and the authorized coverage. Guardian reversal protects the Bitcoin payout; Ethereum loan accounting is reconciled separately.
These pages describe the production design. The demo demonstrates its core mechanisms with a smaller grid and capped exposure. Further independent audits and production qualification are planned before the production rollout.