Proof over Promise

1Abstract

Bitcoin Swap is an EVM chain (chain ID 482120). It runs Hyperledger Besu with QBFT consensus, five-second blocks and immediate finality. Its native coin, BTCw, is quoted at the BTC/USD rate and pays for gas at a fraction of a cent per transaction.

The chain hosts three kinds of assets:

• Bridged assets locked 1:1 on Arbitrum: WBTCw (backed by WBTC) and USDC.e (backed by USDC).
• USDw, the chain's US-dollar unit of account.
• 321 oracle-priced tracker tokens following crypto assets, US equities and ETFs.

Users trade them on several venues:

• two oracle market makers (BTCw and ETHw against USDw);
• two families of continuous-liquidity pools, 643 pools in all;
• a standard Uniswap V2 venue.

An ownerless router reaches any of these assets in one transaction.

This paper sets out the idea the system is built on: every claim about value should be provable on-chain, by anyone, at any time. We call it proof over promise. The paper then turns that idea into design rules, an architecture, a token model and an ecosystem plan.

2Philosophy: six principles

Bitcoin showed that a monetary system can earn trust without asking for it. Any holder can check the whole supply and every rule. Bitcoin Swap takes that attitude and applies it to a fast, programmable EVM chain: users check rather than believe.

3Design rules

The principles turn into ten rules that guide the contracts, operations and roadmap. The last column shows the roadmap phase in which each rule is fully delivered (section 10).

4The network

5Architecture

The system has six layers. Each layer can be checked on its own.

Sealed bridge routes

Each route has the following properties:

• The message-verification module is fixed as an immutable value at deployment.
• The remote router is enrolled exactly once.
• Hooks are fixed, fees are off, and the vault accepts no LP deposits or rebalancing.
• The owner can pause the route and manage its allowlist, and can do nothing else.

The routes enforce:

Both sides of each equation can be read from public RPC endpoints of the two chains.

Markets

• Continuous Liquidity Pools. The fee depends on slippage: output y = x·X·Y/(x+X)², with a 5 bps floor. Every pool pairs with a common base asset (BTCw or USDw), so any two assets swap in at most two hops.
• OracleAMM. Quotes at the oracle price ± 30 bps, with a 10 BTCw per-order cap and a 300-second staleness halt.
• Uniswap V2 (official bytecode). Hosts the WBTCw / USDC.e reference pair that external indexers read. A disclosed keeper holds it at the Chainlink BTC/USD price: threshold 0.5%, at most 50 USDC.e per trade.
• SwapRouter. Ownerless. Chains up to four hops across venues in one transaction.

6Assets and the RWA framework

Every asset sits in exactly one tier. From the Proof phase, the tier is shown in the token's metadata, the API and the explorer.

Operating rules for Tier C

1. Quorum or pause. A price is written only when at least 3 sources agree within band. Crypto trackers need ±2% agreement on at least 4 exchanges. Without quorum, no price is written.
2. Jump bound. A move above 10% between writes is rejected. Genuine large moves, such as splits or post-weekend gaps, are submitted manually; reason codes for these submissions arrive in the Proof phase.
3. Corporate-action calendar. Splits, ticker changes and delistings are scheduled in advance, and pools pause across the event (Proof phase).
4. Not collateral. Tier C tokens are trading assets. They are not accepted as loan collateral.
5. Inventory caps. Daily and per-token rebalancer caps bound the effect of any single price error.

Tier B building blocks

The protocol side of custodied RWA is three pieces:

• A token standard without owner mint, which changes supply only through attested custodian messages.
• An on-chain attestation registry.
• A reserve page that shows custodian attestations beside on-chain supply.

The first Tier B asset launches together with its named custodian and issuer.

7Tokenomics

7.1 BTCw, the native coin

• Ceiling: 21,000,000 BTCw, created at genesis. Block reward is zero and no contract can create native BTCw, so the ceiling is permanent and checkable from block 0.
• Price reference: BTCw is quoted at the BTC/USD rate (ratio R = 1 on BtcwPriceFeed).
• Uses: gas for every transaction, and the base asset of 322 pools.
• Circulation: lock 1 WBTC on Arbitrum and 1 BTCw is released from the native vault. Bridge back, and the BTCw returns to the vault while the WBTC unlocks. The route is allowlisted during the launch phase and opens to every wallet in the Open phase.

7.2 Allocation of the 21,000,000 ceiling (proposed)

Under this allocation, the founding operator is funded from protocol revenue (7.5), not from a coin allocation. That keeps one statement simple enough to check: every BTCw outside the two buckets is matched by WBTC on Arbitrum.

7.3 Supply identity

Every term can be read on-chain. A Proof-of-Reserve page will display the identity live. Public bridge-out for WBTC opens once the page is live.

7.4 USDw, the unit of account

USDw quotes the 321 USDw-paired pools and makes up their inventory. Its design follows three rules:

• Segregation. USDw held by market contracts and disclosed keepers is inventory. USDw held by anyone else is float. The two are reported separately from the Proof phase.
• StableReserve (roadmap). A reserve contract that redeems float USDw 1:1 for USDC.e and enforces float ≤ reserve on-chain.
• No cross-asset loop. No contract mints or sells BTCw to support USDw.

7.5 Revenue and rewards

Earn. Earn offers three products: flexible savings, fixed terms of 7 to 90 days, and BTCw staking with a 1:1 receipt token (stBTCw). Rewards are paid automatically to depositors' wallets.

The next version, Earn v3, follows rule R2:

• Each epoch's reward pool is a share of the previous epoch's revenue.
• Rewards are paid in USDC.e, or in WBTCw for BTC deposits.
• The displayed rate is a trailing figure computed from that pool.

8Ecosystem

The ecosystem is organised into fourteen modules, each following the principles above. Section 10 shows when each module comes online.

Participants

Developer surface

• RPC: https://rpc.btcw.tech, wss://rpc.btcw.tech/ws
• Explorer and verification: https://explorer.btcw.tech
• API: btcw.tech/api/v2/{stats, pools, history, swaps, swap/quote, usd-pools, earn}
• SDK: btcw.tech/swap/sdk/btcw-swap.js
• Contract list: btcw.tech/developers/contracts.json

9Operations

Change management

• Every on-chain change is rehearsed first. Rehearsals run on a fork of the live chain or on the test chain, with the same signing page and parameters.
• Irreversible steps (deployments, pool creation, liquidity moves) are signed one by one, from a page that shows the exact calldata.
• Services are built and tested locally, then deployed one at a time.

Automatic safeguards

Key management

Roles use separate keys:

• the validator key;
• the owner key for sealed contracts;
• bridge verification keys;
• small-balance hot keys for the relayer and keepers.

Keys that guard bridged funds have backups held apart from their hosts.

10Roadmap

Each phase ends when its checks pass on-chain.

Closing

Bitcoin Swap makes a small number of claims. Each one can be checked with a public RPC call and a few lines of code. That is the whole philosophy: proof over promise.

AContract registry

Addresses on chain 482120. The complete, machine-readable list is btcw.tech/developers/contracts.json. Source code and verification status of each contract can be inspected on explorer.btcw.tech. The Uniswap V2 contracts use the official v2-core 1.0.1 and v2-periphery bytecode.

BReferences

1. Nakamoto, S. "Bitcoin: A Peer-to-Peer Electronic Cash System", 2008.
2. Hyperledger Besu documentation: QBFT consensus, permissioning, private networks (besu.hyperledger.org).
3. Hyperlane documentation: warp routes, collateral routers, interchain security modules (docs.hyperlane.xyz).
4. Adams, H., Zinsmeister, N., Robinson, D. "Uniswap v2 Core", 2020.
5. THORChain documentation: Continuous Liquidity Pools and slip-based fees.
6. Chainlink Data Feeds: AggregatorV3Interface.
7. EIP-1559, EIP-3085 (wallet_addEthereumChain), EIP-6963 (multi-wallet discovery), EIP-1167 (minimal proxy).
8. Uniswap Token Lists standard (tokenlists.org).