Credential Manager

​

Vault registry

struct ChainConfig {
    uint64 blockTimeMs;
    uint8  defaultConfirmations;
    uint8  depositIngestConfirmations;
    uint8  withdrawalIngestConfirmations;
    uint8  settlementIngestConfirmations;
}

struct Vault {
    uint8   routingId;
    uint64  vmId;
    bytes32 vaultAddress;
    ChainConfig config;
}

function getVaults(uint16 start, uint16 end) external view returns (Vault[] memory);

​

Attestation

struct MeasurementProfile {
    bool    active;
    bytes32 mrtd;   // code identity, mandatory
    bytes32 rtmr0;  // runtime registers, optional
    bytes32 rtmr1;  // (a zero value skips that check)
    bytes32 rtmr2;
    bytes32 rtmr3;
}

• Measurement profiles are the approved code measurements. mrtd must always match; each rtmr is checked only when non-zero, so one profile can admit several attestation patterns (e.g. different TEE providers). Profiles are added or toggled by the council under a 7-day timelock.
• Operator keys. Each operator binds an identity key (an EOA) to a hardware-attested key with registerAttestedKey; both are required, and the leader must have a registered attested key.
• Quote verification is delegated to an external DCAP verifier (automataVerifier): an SP1 ZK proof establishes that a TDX quote came from genuine Intel hardware running the measured code, and the contract then matches the quote’s mrtd and rtmr values against an active profile. The verifier address is itself replaceable only under a 7-day timelock.

​

Restart

1. initiateRestart opens a one-hour gathering window and clears any prior candidate. Anyone may call it.
2. submitRestartProof submits a recovered node’s ZK-attested TDX quote, with the claimed leader, checkpoint hash, and epoch bound into the quote’s report data. The contract verifies the proof and measurements, requires the quote’s epoch to be strictly newer than the current on-chain epoch, and keeps the highest-epoch candidate. Two candidates at the same epoch with different checkpoint hashes mark the restart ambiguous — a detected split brain.
3. resolveRestart, callable once the window closes, installs the best candidate as the new leader, stores its checkpoint hash, and advances epoch — unless the restart is ambiguous, in which case it reverts and no leader is certified.

​

Governance