Native and Watched
Reviewed contract routing and monitored HTTP payment offers have different trust boundaries.
Monad testnet; not audited. Both tiers use the same bond accounting and can opt into checkTrigger.
Native
A project inherits BondrailEarner, whose account reference is immutable, and routes every fee through
_collect or _settleOut. Custom contracts need individual setNativeApproval before raising.
An approved creation-code template deployed through factory.deployNative needs no individual review.
createBond, depositAllowed, activate and the release checks verify approval and account binding.
See the Native guide.
Review is a trust assumption: inheriting the base does not itself rule out alternate fee paths or
upgrade powers. Routing is enforced for the reviewed path; the business can still stop operating or
move users elsewhere. minFeeBps constrains Native fees while Active, not future demand.
Watched
A paid HTTP API publishes its account and endpoints in /.well-known/bondrail.json. An
account-mediated facilitator calls account.settle for immediate booking. Observer and CRE checks
compare observed offers with the policy committed by policyHash:
- Violation: a conflicting recipient/network/asset/scheme, a price below the floor, or a manifest that changes the account or drops covered endpoints.
- Unknown: the offer cannot be read or parsed.
- Compliant: observed offers satisfy the committed route.
BondrailCovenant.onReport checks the pinned forwarder and observer signature. Reports use 30-second
epochs; this is not a guarantee of a check every 30 seconds. Two qualifying adjacent violations can
record default; sustained Unknown reports have separate warning/default thresholds. See
defaults and recovery. Monitoring cannot discover every undeclared endpoint
or prove that every customer sees the same offer.
Watched bonds require stake. depositAllowed rejects inViolation; activation and second release
require isHealthy, a fresh Compliant observation. Missing reports can block those releases without
establishing issuer default. Guarded buyers can independently pin a bond's route.