The Merkle Mountain Range
Every deposit adds a leaf to that chain’s on-chain Merkle Mountain Range (MMR), an append-only tree whose root commits to every event ever recorded there. Each leaf binds the trade’s order hash and a leaf domain: what kind of event it records. A proof about one event can’t be bent to serve another.One circuit, several events
A single circuit, the events circuit, proves that a leaf of a given domain is in a given root. The contracts always set the domain themselves; it’s never something the caller picks.
A deposit proof (domains 0 and 1) also proves knowledge of that payout’s
half of the trade secret, which fixes its
nullifier. The other domains carry no secret.
The proof
At payout time, a proof is built showing the counterparty’s deposit leaf is in the other chain’s MMR root, the same root both parties co-signed. The contract verifies the proof on-chain, together with the nullifier that makes each payout happen exactly once. The cancel, forfeit and settled proofs are checked against a root published by the anchor service instead, because no co-signature exists on those paths.Speed
A deposit proof takes seconds to build, and a CI benchmark fails the build if it regresses. Proofs are built per trade, per chain; you never wait on them.Verification on both chains
- Ethereum verifies with a generated UltraHonk verifier contract.
- Soroban verifies with a reusable verifier that takes the verification key as data.