Settlement contracts
The on-chain enforcement boundary for private actions.
Protocol behavior is proposed. This release is an interface preview; no funds or wallet signatures are accepted.
Contract responsibilities
The proposed settlement layer coordinates asset custody in the pool, note and key registries, proof verification, spent-nullifier sets, deposit lifecycle state, and relayer payment. Dedicated verifiers may handle transfer, withdrawal, and swap circuits.
Critical state
| State | Invariant |
|---|---|
| Commitment roots | Only accepted history can fund a proof |
| Note nullifiers | A real note is consumed at most once |
| Transaction nullifiers | A signed intent executes at most once |
| Key registry | Recipient encryption material is authenticated |
| Pending deposits | Admission and cancellation follow the state machine |
| Asset registry | Only reviewed token behavior is accepted |
Upgrade and administration
The reference uses a UUPS implementation behind an ERC-1967 proxy, with separate upgrade authorization and configurable guard and verifiers. Upgradeability creates privileged trust assumptions.
Jammer has not selected or deployed a governance model. A production release must disclose administrators, verifier replacement powers, pause controls, delays, and user exit behavior. A future multisig or timelock must not be described as already active.
Defensive validation
Validate public inputs against the expected field, enforce reentrancy protections, reconcile actual token balances, and bind each verifier to its intended action. Contract source, compiler settings, ABI, deployment transaction, and verified addresses belong in the release manifest.