Moving assets between layers

1. 01

   Lock

   Assets are transferred into a vault account the bridge program owns on Solana. Nothing is credited until the lock is confirmed.

2. 02

   Confirm

   The deposit waits for Solana finality, so a reorganisation cannot undo it. This wait is a safety property, not latency to be optimised away.

3. 03

   Credit

   A matching balance becomes spendable on Solieum, backed one-to-one by the locked assets. Each deposit carries a sequence-derived id, so the same deposit can never be credited twice.

Deposit time is dominated by the confirmation wait, which is Solana finality — well under a minute. A deposit is a forced-inclusion entry: the bridge program locks the amount and, in the same instruction, enqueues a deposit record on the forced-inclusion queue, signed by a relay account only the program can sign for — so the deadline, the fault for skipping it, and the public bytes that forced transactions have apply to deposits too, and a deposit the sequencer never includes can be refunded from the vault by anyone once its deadline passes. Exercised in the test harness against the real inbox program, then on devnet. On the gamma chain, whose portal is deployed, initialized and guardian-installed, deposits are credited end to end: an enqueued entry is credited to the named recipient one block later, and that block settles on Solana — its first was credited in block 2. Beta did the same for its two deposits, 13,000,000 lamports, before it stopped, and the alpha chain's portal took the first such deposit before either. Token deposits still only emit an event.

1. 01

   Initiate

   The withdrawal is recorded in Solieum state and the balance is debited there, so it cannot be spent twice. It is admitted only if the bridge can honour it: what Solana still owes to earlier withdrawals, plus this one, must fit inside what the vault can pay. A withdrawal can therefore be refused for a reason unrelated to your balance — the bridge is short — and the refusal costs a retry, not funds. Nothing is debited when it is refused. The gamma chain has run that rule since 2026-09-12, and the first refusal has been watched: a 500,000-lamport exit asked for against 100,000 of headroom, refused, with nothing debited and no leaf committed.

2. 02

   Challenge window

   The state root containing the withdrawal sits in the 48-hour dispute period, during which anyone can prove it wrong and have it removed — for a step forged rather than merely mistaken, that holds once every step is bound to its signed transaction (ADR-0021), staged but not yet active. Nothing is released while it runs.

3. 03

   Prove

   Once the root is final, the withdrawal is proven on Solana against it: a state-tree inclusion proof, with the commitment recomputed by the program from the id, amount, recipient and asset — so honest proof bytes cannot carry an inflated claim.

4. 04

   Release

   After a short delay the vault pays the exact amount, once. Proving and paying are separate instructions on purpose, so a proof cannot be raced straight into a payout.

The challenge window is 48 hours (ADR-0016), and a 24-hour air gap follows it before payout — about three days in total, which is the number to read rather than either half. Seven days was the Ethereum optimistic-rollup convention and was never derived from Solana; the dispute game's own arithmetic needs hours. It is fixed when a chain is initialized and there is no setter: the beta devnet chain was initialized with it on 2026-09-05, and the alpha chain it replaced still enforces the seven days it was created with. The window has to be long enough that a challenge cannot be censored for its full duration — the parameter and the reasoning behind it are published together. A withdrawal has now been run end to end on the beta chain: initiated on the L2, the sender debited there, and the withdrawal leaf committed into a block whose root settled on Solana under bond. It is payable once that root is final, after the window and the air gap. The first such payout happened on 2026-09-07: a withdrawal on the beta chain, proven against its final root and paid by the vault on Solana's public devnet, the team's own fast-exit provider reclaiming its float. An ordinary withdrawal followed on 2026-09-10, walking the whole path a user walks: initiated on the L2, its balance debited there, proven against the final root, held for the portal's delay, then paid. Both were the team's own addresses, so the bar is unchanged: an exit by an unaffiliated user in a drill.