> For the complete documentation index, see [llms.txt](https://docs.blockz.fi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blockz.fi/security-model/swap-security-model.md). # Swap Security Model Blockz does not custody user funds. Assets are controlled by chain-specific settlement mechanisms and the conditions defined in the signed swap intent. Blockz enforces a deterministic settlement model designed to ensure that swaps either complete fully or safely revert. Resolver permissions are constrained by protocol rules and network-specific settlement mechanisms, preventing unauthorized access to user funds. Resolvers provide liquidity and perform the on-chain execution required to fulfill swap intents, but their ability to move or withdraw assets is limited by the protocol’s settlement conditions and the user’s signed intent. The following sections describe the core components of the swap security model. *** #### Escrow Custody Model For each swap, funds are isolated within a swap-specific settlement mechanism rather than being pooled. On networks that support contract-based escrow models, such as Ethereum and Tron, a dedicated escrow instance is created for each swap. User funds are not deposited into a shared liquidity pool. Resolvers may move user-approved assets into this swap-specific escrow as part of execution. These funds remain locked under the swap’s settlement conditions and cannot be withdrawn until the fulfillment transaction satisfies the intent conditions. This isolation ensures that each swap is independently secured and prevents cross-swap exposure. *** #### Resolver Permissions Resolver permissions are intentionally limited and constrained by the signed intent and the protocol’s settlement rules. Resolvers may: * Move user-approved assets into the swap-specific settlement mechanism * Execute the swap according to the signed intent parameters * Withdraw escrowed funds only after the swap fulfillment transaction satisfies the required conditions Resolvers cannot: * Withdraw funds before fulfillment conditions are met * Access funds belonging to other swaps * Arbitrarily transfer user assets outside the defined execution flow All resolver actions are restricted by the intent parameters and the protocol’s settlement logic. *** #### Settlement Authority Settlement is governed by deterministic protocol rules and chain-specific settlement mechanisms rather than arbitrary resolver control. A resolver cannot finalize settlement independently. Funds can only be released once the fulfillment transaction satisfies the conditions defined by the swap intent. In practice, the process follows these steps: 1. The resolver delivers the quoted assets to the user on the destination chain 2. The resolver reports the fulfillment transaction to the protocol 3. The protocol verifies that the reported transaction satisfies the swap conditions After the fulfillment conditions are verified, the resolver can unlock the corresponding escrow on the source chain. This ensures that the resolver can only access escrowed funds after the user has received the agreed assets. *** #### Timeout and Refund Path Each swap has a defined time-to-live (TTL). If execution is not completed before the TTL expires, the swap enters the refund path. In this case, funds are returned to the address specified during intent creation via the `refund_address` field. This mechanism prevents funds from remaining locked indefinitely if a resolver fails to complete execution. *** #### Chain-Specific Settlement Mechanisms Different networks implement swap settlement using chain-native primitives. **Ethereum / EVM Chains** A dedicated escrow contract is created for each swap. Resolver-approved assets are deposited into the escrow and remain locked until the swap fulfillment conditions are satisfied. **Tron** Uses the same escrow-based settlement model as EVM chains. **Solana** Each token pair uses a dedicated vault. During execution, a program-derived escrow account (PDA) is created that stores swap details and manages settlement according to the protocol rules. **Bitcoin** Settlement uses a Taproot-based HTLC (Hash Time-Locked Contract). Resolver funds are locked in the HTLC and can only be withdrawn after the fulfillment conditions are satisfied. *** #### Bitcoin Settlement Flow The Bitcoin settlement process works as follows: 1. The resolver locks the user's funds in an HTLC escrow on Bitcoin 2. The resolver sends the quoted assets to the user’s destination address 3. The resolver reports the fulfillment transaction to the protocol 4. The protocol verifies that the reported transaction satisfies the swap conditions Once the fulfillment conditions are verified, the resolver can reveal the secret required to unlock the HTLC and withdraw the escrowed funds. *** #### Ethereum Settlement Flow The Ethereum settlement process works as follows: 1. The resolver locks the user’s funds in a hash-locked escrow smart contract on Ethereum 2. The resolver sends the quoted assets to the user’s destination address on the target chain 3. The resolver reports the fulfillment transaction to the protocol 4. The protocol verifies that the reported transaction satisfies the swap conditions Once the fulfillment conditions are verified, the resolver can reveal the secret preimage required to unlock the escrow contract and withdraw the locked funds. The Ethereum escrow contract enforces the swap conditions on-chain and includes a refund path that allows the user to recover funds automatically if the fulfillment deadline expires. *** #### TRON Settlement Flow The TRON settlement process works as follows: 1. The resolver locks the user’s funds in a hash-locked escrow smart contract on TRON (TVM) 2. The resolver sends the quoted assets to the user’s destination address on the target chain 3. The resolver reports the fulfillment transaction to the protocol 4. The protocol verifies that the reported transaction satisfies the swap conditions Once the fulfillment conditions are verified, the resolver can reveal the secret preimage required to unlock the escrow contract and withdraw the locked funds. The TRON escrow contract enforces the hash-lock and timeout conditions, ensuring that swaps either complete successfully or revert safely through the refund mechanism. *** #### Solana Settlement Flow The Solana settlement process works as follows: 1. The resolver locks the user’s funds in a program-controlled escrow account on Solana 2. The resolver sends the quoted assets to the user’s destination address on the target chain 3. The resolver reports the fulfillment transaction to the protocol 4. The protocol verifies that the reported transaction satisfies the swap conditions Once the fulfillment conditions are verified, the resolver can reveal the secret preimage required by the Solana program to unlock the escrow account and withdraw the locked funds. The Solana escrow program enforces the swap conditions deterministically and includes a timeout-based refund path that returns funds to the user if execution does not complete. *** #### Security Guarantees The Blockz settlement model provides several important guarantees: • **Swap isolation** – funds are segregated at the individual swap level\ • **Restricted resolver permissions** – resolvers cannot access assets outside the swap execution flow\ • **Deterministic settlement** – escrow release is conditional on verified fulfillment\ • **Refund safety** – swaps automatically revert through the refund path if execution fails These mechanisms ensure that swaps either complete successfully or revert safely without exposing users to partial execution risk.