Update from Tirai

Headline: the cross-chain corridor works end to end, with no trusted operator anywhere in it.

On 27 September a payment made on Ethereum released a locked escrow on Solana, with no bridge, no multisig and no attester set in between. Solana accepted the release because it checked Ethereum's own validator signatures directly, not because any party told it the payment had happened.

What this means for a user: Alice can hold value privately on one chain and pay Bob on another. She does not choose a bridge, trust a relayer, or wait on a committee. If the payment happened on the source chain, the release on the destination chain follows from that chain's consensus alone. If it did not happen, nothing releases.

What shipped this week

The corridor is now live on testnets end to end: pools on two EVM testnets, settlement on Solana devnet, and the app running against them.

There is a new bridge screen in the app. Alice enters an amount and a recipient, and nothing else. No route selection, no bridge choice, no wrapped asset to reason about. Browser tests for the flow pass end to end.

One step in the private reclaim path had been too expensive to fit inside a single Solana transaction, which blocked that path entirely. It now completes in one transaction.

Reliability and process

Around 50 issues closed this week. We added automated security scanning to the build pipeline, and a provenance check that refuses to deploy a binary unless it matches the source it claims to come from. The nightly health check now exercises the current system rather than an older one.

Security

We ran a focused review of the protocol this week and fixed four critical issues, all deployed to testnet. Two further critical issues were found and are still open. One has a fix written and lands in the next version. The other is a privacy weakness where proofs currently reveal more than intended, and a prototype of the fix, along with a written argument for external review, was completed on 27 September.

We will publish the details of all six once the fixes are deployed. Describing open issues in public before that is how funds get lost.

What is next

Close the open bugs, redo the security checks, and take the corridor from testnet to a first mainnet path.