Your deposit on the Paxeer chain becomes an agent balance through one activity that carries a Comet light-client bundle. The kernel verifies the bundle itself, re-derives the deposit identifier, and refuses a nullifier it already consumed. A withdrawal debits your main account into a system account, then settles only against a finalised checkpoint, a guarantor certificate, a membership proof and a closed challenge window. If checkpoints stop arriving, you exit on your last proven balance.

What it does

The custody bridge is the LayerX side of the boundary with the Paxeer chain, which holds the funds. A deposit becomes an agent balance through one activity, LXP_BRIDGE_CREDIT (0x00080001), whose payload carries a 363-byte credit head plus a Comet light-client bundle; the kernel verifies the bundle itself, re-derives the deposit identifier, and moves the amount from system:paxeer-reserve to the beneficiary's main account. A withdrawal debits the agent's main account into system:paxeer-withdrawals and is settled only against a finalised checkpoint, a guarantor certificate over that checkpoint's state root, a membership proof of the withdrawal leaf, and a closed challenge window. An emergency exit lets an agent claim its last proven balance without the agent domain's cooperation.

Key capabilities

• Credits a deposit once: a consumed deposit nullifier is refused with -414.
• Verifies the Paxeer deposit record in-kernel with a Comet light client, not an attestor key.
• Debits withdrawals to a system account first, then settles against a finalised checkpoint.
• Refuses payout while the challenge window is open, and cancels it if a challenge succeeds.
• Emergency exit on liveness breach, governance emergency, or accepted checkpoint fraud.
• Reconciles the reserve mirror against Paxeer custody on a fatal, zero-tolerance invariant.

Differentiators

Three properties hold in the module as written: the deposit record is proven, not attested, because there is no custody attestor key and no signature over the credit head; the credit checks total asset units before and after and rolls back with LXP_FATAL_SUPPLY_MISMATCH if they move, so a credit mirrors custody instead of minting; and settlement binds the asset recorded at request time, refusing a caller-supplied mismatch with -418 and no transfer.

Outcomes

• Credit a deposit once, against a proof rather than an operator's word
• Hold the payout until the challenge window closes, and cancel on a successful challenge
• Exit to your last proven balance on a liveness breach

Technical notes

• Bridge module id 8. The only registered activity is LXP_BRIDGE_CREDIT. A withdraw request is Asset ordinal 9; withdraw finalize and emergency exit are library paths, not activity ordinals.
• Credit payload: LXDC3 head of 363 bytes plus the LXLB1 bundle, at least 368 bytes total. The 223-byte LXBC3 profile pins the Paxeer network as chain 125, the custody store layerxcustody, the chain id (32 bytes maximum) and the trusting period.
• Light client limits: at most 1000 validators, more than two thirds of voting power on the signed header, more than a third of previously trusted power for a skipped validator-set change, clock drift at most 10 seconds, IAVL steps at most 64, store steps at most 32, deposit record at most 4096 bytes, trust record 89 bytes.
• Refusals: DEPOSIT_PROOF_NOT_FINAL (-413), DEPOSIT_ALREADY_CREDITED (-414), WITHDRAWAL_ALREADY_SETTLED (-415), CHALLENGE_WINDOW_OPEN (-416), WITHDRAWAL_CANCELLED (-417), WITHDRAWAL_ASSET_MISMATCH (-418).
• Withdrawal state: 128 records per store, each encoded as a 43-byte key and a 182-byte value. The nullifier commits to network id, withdrawal id, account, asset, amount and checkpoint id.
• Reserve accounting uses account kinds 11 (system:paxeer-reserve) and 12 (system:paxeer-withdrawals). Reconciliation requires outstanding claims to equal the withdrawals balance exactly and custody to cover the required backing, or it returns LXP_FATAL_SUPPLY_MISMATCH.
• The challenge-window duration is not a LayerX constant. The kernel reads opening and closing times from Paxeer-supplied window state (LXP_PAXEER_INPUT_CHALLENGE_WINDOW_STATE = 5) and enforces them.
• This is the LayerX to Paxeer custody path. It is a separate surface from the LayerXBridge precompile at 0x0000000000000000000000000000000000001016, which bridges Paxeer to external chains.

More in LayerX agent domain