Security Philosophy
Gasyard’s security model is designed around defense in depth—multiple independent layers that each provide protection, so no single failure can compromise the system.Core principle: No single compromised component can affect the entire system or other participants.
Security Layers
| Layer | Components |
|---|---|
| Layer 1: On-Chain | Non-upgradeable Gateway · Role-based Access · Token Whitelist · Replay Protection |
| Layer 2: Execution | Isolated Pools · Spend Limits · Rate Limiting · Watcher Verification |
| Layer 3: Economic | Settlement Credits · Fraud Resistance · Auto Refunds · No User Fund Exposure |
| Layer 4: Operational | Monitoring · Emergency Pause · Incident Response |
On-Chain Security
Gateway Contract
| Feature | Purpose |
|---|---|
| Non-Upgradeable | Trust established at deployment |
| Role-Based Access | Only authorized addresses |
| Token Whitelist | Pre-approved tokens only |
| Replay Protection | Order IDs execute once |
| Expiry Enforcement | Time-bounded execution |
Non-Upgradeable
Core contract cannot be modified after deployment—trust is established at deployment time
Role-Based Access
Functions are restricted to authorized addresses only
Token Whitelisting
Only pre-approved tokens can be bridged
Replay Protection
Order IDs can only be executed once
Rate Limiting
Critical operations are rate-limited to prevent abuse:| Operation | Limit |
|---|---|
| Rebalancing | Rate-limited calls |
| Large transactions | Per-tx and daily caps |
| New token additions | Admin-only |
Execution Security
Solver Isolation
| Solver | ETH Pool | ARB Pool | BASE Pool |
|---|---|---|---|
| Solver A | 100K | 75K | 50K |
| Solver B | 200K | 150K | 100K |
- Only Solver A funds at risk
- Solver B completely unaffected
- System continues operating normally
- Solver A compromised? → Only Solver A’s funds at risk
- Solver B, C, D? → Completely unaffected
- System? → Continues operating normally
Spend Controls
SolverPools enforce spending limits. Each transaction must pass all checks:| Check | If Exceeded |
|---|---|
| Per-TX Limit | Rejected |
| Hourly Limit | Rejected |
| Daily Limit | Rejected |
- Per-transaction limits — Cap single execution size
- Hourly limits — Prevent rapid draining
- Daily limits — Overall exposure cap
Watcher Verification
Before settlement credits are issued, watchers verify:| Check | Purpose |
|---|---|
| Output amount ≥ minimum | Ensure user got what was promised |
| Correct recipient | Funds went to the right address |
| Not expired | Execution within validity window |
| Not already executed | Prevent double-claiming |
| No fraud indicators | Detect manipulation attempts |
Economic Security
Settlement Credit Model
Key benefit: Solvers never have custody of user funds.Automatic Refunds
1
Intent Expires
No valid execution before expiry timestamp
2
RefundPool Triggers
System detects unfulfilled intent
3
User Refunded
Funds returned automatically—no user action required
Operational Security
Monitoring
Multi-layer monitoring detects anomalies:- Transaction monitoring — Unusual patterns trigger alerts
- Liquidity monitoring — Pool imbalances flagged
- Cross-chain verification — State consistency checks
- Fraud detection — Malicious behavior identification
Emergency Controls
In case of detected threats:| Control | Action |
|---|---|
| Pause | Halt new intents temporarily |
| Solver removal | Remove compromised solver from network |
| Token blacklist | Block specific tokens |
| Rate reduction | Lower limits during investigation |
Threat Model
What We Protect Against
| Threat | Mitigation |
|---|---|
| Solver compromise | Isolated pools, spend limits |
| Double execution | Unique order IDs, finality tracking |
| Malicious execution | Watcher verification before settlement |
| Stuck funds | Automatic refunds via RefundPool |
| Contract exploitation | Non-upgradeable, audited contracts |
| Replay attacks | On-chain replay protection |
Assumptions
The security model assumes:- At least one honest watcher node
- Gateway contract integrity (non-upgradeable)
- User verifies transaction parameters before signing
Audits
All core contracts have been audited. Audit reports available upon request.For security inquiries or to report vulnerabilities, contact hi@gasyard.fi.