Trust model
Contract enforcement, disclosed operators, and the limits of credit evidence.
Enforced by contracts
BondrailAccount.collect / settleOut restrict Native routing to the bound project; settle verifies
a token authorization and records its payer. _book splits Active revenue up to the cap, while the
issuer pulls its credited share with withdraw. BondrailBond separates escrow, releases, revenue,
recoveries and stake. Exact-transfer checks reject transfer-tax behavior on supported pull paths;
they do not guarantee a token's value or prevent freezes/rebases.
Disclosed parties
| Party | Powers and boundaries |
|---|---|
| Native reviewer | setNativeApproval / setNativeTemplate approve or revoke code. Factory checks can block issuance, deposits and releases; revocation does not stop an Active payment split. |
| Milestone signer | Signs releaseSecondSigned evidence; Onchain milestones use the account counter instead. |
| Observer and CRE/forwarder | onReport requires the pinned forwarder plus observer signature. The current simulation forwarder is not independent proof of a decentralized oracle decision. |
| Facilitator | Relays account.settle, paying gas from its wallet. Cannot change a signed recipient/amount; availability and gas budget still affect service. |
| Vault curator | allocate, withdrawFromRaise, collect within fixed asset, phase and allocation limits; no arbitrary withdrawal to the curator. |
| Vault owner | proposeCurator / acceptCurator after two days; no fund-transfer or upgrade power. |
| Credit attester | Signs underwriting assertions for attest; cannot alter account counters or bond state. |
| Registry owner | proposeAttester / acceptAttester after two days; rotation changes which stored signatures are valid. |
Residual risks
A business can stop or move customers elsewhere. Native review is not a formal proof; monitoring sees observed declared offers and cannot guarantee what every customer sees. Missing reports can prevent release without establishing default. Principal already released cannot be clawed back.
Booked revenue can be self-funded. Indexer attribution uses limited funding-link evidence; distinct
wallets need not be independent customers. onchainProfile.complete detects missing factory bonds
within its scope; attestedProfile.valid means current signer and unexpired, not true or complete evidence.
Vault carried value can exceed realized backing; exits depend on idle cash. Credit-line and yield estimates depend on revenue assumptions. Claim markets need buyers and liquidity. See credit vault risks, credit profiles and investing.