Update from Tirai

Tirai, week of 5 to 11 Oct 2026

• Audit response closed out in one week. An internal security audit on 5 Oct produced a batch of findings across the on-chain program, the courier and the server routes. All of them are fixed and deployed. We also removed two administrative powers from the program entirely rather than guarding them, retired legacy routes that spent server keys, and added fail-closed checks that run at commit and deploy time so the same classes of mistake cannot return quietly.

• Solana consensus verified on Ethereum for the first time. Our new light client took a live Solana devnet block, proved it final under Alpenglow, and verified it along with its bank hash on Sepolia. This is the harder direction of the corridor and it now has a working first half.

• Both directions of the corridor now exist. Solana to Sepolia has been running since last week. The reverse, Sepolia to Solana, is built: Alice locks on Ethereum, a solver reserves and fulfils on Solana, refunds come back as the sender's private note, and the solver can reclaim by proving on chain that the payment slot is empty. It is in review.

• The Ethereum light client survived a mainnet-bound fork. Sepolia's Gloas upgrade stalled our keeper on 8 Oct. The fix makes the light client fork-aware by slot and verifies each committee handover under the fork version it was actually signed with. The keeper now also rotates one period ahead, so a committee handover never refuses a transfer.

• Faster where testers feel it. Solver repayments ran one at a time, about ten minutes per transfer, and now run in parallel. The deposit page took minutes to load in a fresh tab, and now reads history in parallel and keeps it across reloads.

• Mainnet safety is now a single switch. The deposit pause lives behind one build flag that defaults to paused, so the state of the pool cannot drift from what the app says about it.
  
  For testers

  Everything below is testnet. Use a throwaway wallet — never a wallet holding real funds.

  1. Go to testnet.tirai.io.

  2. Connect a wallet: Phantom for Solana, MetaMask for Ethereum Sepolia or Arbitrum Sepolia. On Solana only Phantom works; if you pick another, the app will tell you.

  3. Use the faucet on the Deposit page to get test tokens. You also need a little devnet SOL (or Sepolia ETH) for fees. Get devnet SOL from here https://faucet.solana.com/

  4. Run the flow in order: Deposit → Send → Withdraw. Check Activity after each step.

  5. For the cross-chain test, use Send from the Solana pool with Ethereum Sepolia as the destination. You'll be paid on Sepolia within a minute or two; the Activity page tracks the status.

  6. Your proof is generated in your browser, which takes a few seconds and may spin the fan. Keep the tab open and the screen awake until the page says it's done.

  7. Reporting a problem? Send me the network, the page, what you expected, and the transaction signature or hash if you have one. Screenshots of the error text help. Please don't post wallet seed phrases or private keys anywhere, including to me.