How Pavilion
Bridge works.
Attesters check Pearl’s block proofs. Ethereum checks their signatures and your deposit. Only then does wPEARL mint.
Every block carries
its own proof.
Pearl runs on proof of useful work. Each block header carries a zero knowledge certificate of that work.
- Each block has a header.
- The header carries the block’s zkPoW certificate.
TEE attesters
check every proof.
- Each attester verifies every header’s certificate, starting from a pinned block.
- They count confirmations by work, so a block mined at low difficulty counts for less.
- Then each one signs a checkpoint inside secure hardware.
Ethereum checks,
then mints.
- Ethereum accepts a checkpoint once a quorum of registered attesters has signed it.
- The untrusted relayer submits your transaction with a Merkle proof.
- Pavilion Bridge checks the amount and recipient itself.
- wPEARL mints.
The vault
has rules.
The reserve sits in an OP_CAT covenant on Pearl that only allows a fixed set of moves.
- The payout list is fixed first.The vault is an OP_CAT covenant on Pearl. After a delay, a signer quorum can withdraw up to the cap, and only into a batch output locked to the exact payout list. After the review window anyone can split that output, and only into that list: one burn batch of up to 10 burns.
- A wrong batch goes back.A watchtower reads its own Pearl and Ethereum nodes. During the review window any one watchtower can sweep a wrong batch output. The return output is bound to the vault, and after the sweep signers merge it back.
- New keys have to wait.A rekey starts a wait. During the review window any one watchtower can veto it, which sends it back to the old vault. After the window signers finalize, and the bridge follows only a registered new vault. Recovery is possible only after a very long timelock, by the council, a k of m multisig checked in script.
Signers move the reserve.
Any one watchtower can stop them.
Taking PEARL from the vault would need the signer quorum and every watchtower to fail together. That holds as long as watchtowers read Pearl and Ethereum from their own nodes.
Limits on
every transfer.
Four limits apply. If your transfer reaches one, it waits.
Confirmation depth
The wait grows with all value minted from nearby Pearl blocks. Splitting a deposit does not avoid it.
Daily mint cap
Minting is rate limited. One large deposit can mint across several days.
Withdrawal cap and delay
Pearl’s caps withdrawals and delays each payout batch.
Guardian pause
can pause the bridge after a deep reorg or other risk. Governance unpauses it.
Move PEARL
to Ethereum.
The app is a preview with example accounts. Nothing is signed or sent.