Deposit PAX or a registered bank denom for a 32-byte LayerX account and the funds move into the layerxcustody module account, not into the agent domain. Coins leave through one function, which pays a queued claim only after its delay passes and only against a sequencer-signed receipt in a finalized checkpoint. A registered invariant checks custodied, released and pending totals against the module account's real balance.

What it does

Funds destined for the LayerX agent domain are held by the layerxcustody module account on the Paxeer chain, not by the agent domain itself. A deposit moves coins from the payer's account into that module account and records a deposit identifier derived from the chain id, payer, asset, beneficiary, amount and per-payer nonce. Coins leave custody through exactly one function, which pays a queued claim only after the claim's delay has passed and only when the claim was verified against a finalized LayerX checkpoint. Every asset carries three running totals: custodied, released and pending. A registered invariant checks them against the module account's real balance.

Key capabilities

• Holds native PAX and registered bank denoms for 32-byte LayerX account identifiers.
• Verifies withdrawals against a sequencer-signed receipt in a finalized checkpoint batch.
• Reserves a nullifier per claim, so a proven withdrawal cannot be replayed.
• Forced exit pays a proven balance when checkpoints stop arriving within the liveness bound.
• Per-asset minimum deposit, custody cap, and enabled and paused switches.
• Solvency invariant compares balance, liabilities and queued claims on every check.

Differentiators

Three verifiable properties in the module: a single coin exit path (pay is the only function that moves coins out of custody), triple-entry per-asset totals guarded by a registered solvency invariant, and a withdrawal path with no attestor key. A payout needs either a sequencer-signed receipt in a finalized batch or a native state proof plus the account authority's recipient signature.

Outcomes

• One coin exit path, so every payout carries a proof.
• Withdraw under the last finalized state root when checkpoints stop arriving.
• Set per-asset minimum deposit, custody cap, and enabled and paused switches.

Technical notes

• Precompile layerxCustody at 0x0000000000000000000000000000000000001013. Delegatecall and staticcall of state-changing methods are refused.
• Identifiers are domain-separated: LXP/Paxeer/custody-deposit/v1, LXP/Paxeer/withdrawal-claim/v1, LXP/Paxeer/emergency-exit/v1.
• Amounts are bank base units, one to one with the LayerX u128 amount; a deposit must fit 128 bits. deposit() refuses a msg.value that is not a whole number of base units.
• Params: authority, network_id, withdrawal_delay_seconds (default 3600), forced_exit_delay_seconds (default 0), liveness_bound_seconds (default 86400, floor 3600), deposit_root_authority, sequencer_authorizations[]. Both delays are capped at 90 days. At most 64 sequencer authorizations, each a canonical Ed25519 key over a non-overlapping batch range.
• Evidence fields are capped at 64 KiB each, header and recipient signatures are exactly 64 bytes, and one deposit-root registration carries at most 4096 leaves.
• Gas is 3000 + 16 * calldata bytes + 4000 * signatures + 100 * proof nodes + 5000 * writes.
• Not yet implemented: the module has no gRPC query service, no CLI and no proto package under api/, so state is read through the precompile's view methods. Reserve reconciliation exists only in Solidity (contracts/custody/ReserveReconciler.sol), is fixed at eleven liability buckets, and that Solidity path denominates USDL alone at a hard-coded token address.
• Custody exists twice in the tree: Solidity predeploys under contracts/ and the native modules behind 0x1013 and 0x1014. No source states which one is authoritative on a live chain.

import {LAYERX_CUSTODY_CONTRACT} from "precompiles/layerxcustody/LayerXCustody.sol";

// Custody native PAX for a LayerX account.
bytes32 depositId = LAYERX_CUSTODY_CONTRACT.deposit{value: 5 ether}(beneficiary);

// Prove a LayerX withdrawal and queue the claim.
(bytes32 claimId, uint64 availableAt) =
    LAYERX_CUSTODY_CONTRACT.requestWithdrawal(receipt, proof, header, headerSignature);

// After availableAt, pay the recipient the receipt names.
LAYERX_CUSTODY_CONTRACT.finaliseWithdrawal(receipt, proof, header, headerSignature);

More in Paxeer chain