Withdraw
Sends your full balance out of your wallet contract. A short safety review confirms the latest amount, then funds are released.
Show technical processExit state machine, nonce claims and protocol log
Exchange goes dark
Stop counter-signatures and epoch roots. This is the bankruptcy / hack scenario.
initiateExit(state, sigUser, sigExchange)
Post an exit bond on a dual-signed state. Opens a 45s challenge window (24-72h in production).
challenge(newerState, bothSigs)
Anyone watching can replace a stale exit with a strictly higher nonce. The challenged bond is slashed and pays the challenger, so watching is profitable.
finalizeExit()
After the window elapses with no successful challenge, funds are released and the exit bond refunded.
Dead-man switch
If no epoch root is published for 30s (7 days in production), exit immediately on the last dual-signed state — no counter-challenge is possible.
Why not instant unilateral exit? A signed receipt is a monotonically stale claim. If the user picks which signature to redeem, they withhold the losing state and exit on the older, richer one. Try step 2 with a stale nonce, then run step 3 — the higher nonce always wins.