Security
Architecture
Westwyrd is engineered under the assumption of persistent adversarial conditions. Security is not a feature added to a functional system — it is the structural substrate from which functionality is derived.
The cryptographic layer constitutes the foundational security stratum upon which all protocol operations are predicated. At its core, the system employs Groth16 zero-knowledge succinct non-interactive arguments of knowledge over the BN254 elliptic curve. Groth16 was selected for its constant-time on-chain verification complexity — a single pairing check regardless of circuit size — and its minimal proof size of 256 bytes. These properties make it uniquely suited for on-chain verification where gas costs are directly proportional to computational complexity.
The algebraic hash function Poseidon serves as the commitment and hashing primitive throughout the protocol. Poseidon's design is optimized for arithmetic circuits over prime fields, achieving approximately 80x fewer constraints than SHA-256 — roughly 300 constraints per invocation versus ~25,000 for SHA-256. This reduction is critical for maintaining proving times within practical bounds: the total circuit constraint count directly determines proving time, and reducing hash costs allows more complex application logic within the same proving budget.
Circuit-to-contract binding is enforced through a deterministic compilation pipeline in which the on-chain verifier contract is generated directly from circuit compilation output. The verification key — a set of elliptic curve points encoding the circuit's constraint structure — is embedded immutably in the verifier contract's bytecode. Any modification to circuit logic, however minor, produces a fundamentally different verification key, causing the deployed verifier to reject all proofs from the modified circuit. This binding is mathematically guaranteed by the Groth16 proof system and does not depend on operational procedures.
Modular architecture supports circuit migration to STARK-based constructions without modifying settlement logic.
The infrastructure layer implements defense-in-depth through strict domain isolation, multisignature governance, and systematic role renunciation. The protocol's smart contract architecture enforces a separation-of-concerns model in which each contract is responsible for a single domain of functionality — reserve management, bridge operations, or execution verification — and has no capability to affect state in other domains. This isolation ensures that a vulnerability in one domain cannot propagate to others, bounding the blast radius of any individual security incident.
Multisignature governance is enforced for all critical operations through a 3-of-5 multisig contract deployed on L1. The five keyholders are geographically distributed across three jurisdictions and use independent hardware signing devices. No single key can authorize protocol upgrades, parameter modifications, or emergency actions. Signing sessions require out-of-band coordination and independent verification of the transaction payload by each signer.
Administrative control minimization is achieved through explicit role renunciation. After initial deployment and parameter configuration, privileged roles are systematically revoked through on-chain transactions that transfer these roles to the zero address. This renunciation is irreversible — once a role is transferred to the zero address, it cannot be recovered, and the associated capabilities are permanently removed from the protocol.
Security at the application layer operates independently of the cryptographic layer. Even if an adversary could forge ZK proofs, the application layer's access controls, rate limits, and audit logging would still constrain the impact of such a breach.
The application layer enforces deterministic execution through a strict execution model in which all outputs are derivable from inputs. There is no hidden state mutation — every state change is the result of a verifiable transaction that has been validated against the circuit constraints, authenticated through digital signature verification, and recorded in the append-only audit log. This property is not asserted through documentation or code review; it is verified through formal proofs maintained in the Rocq proof assistant.
API surfaces are protected through multi-layered security controls. At the network level, all connections use TLS 1.3 with certificate pinning. At the application level, all requests require HMAC-SHA256 authentication with time-bounded nonces to prevent replay attacks. At the protocol level, all submitted transactions require EdDSA signatures from registered keys. This layered approach ensures that an attacker who compromises one layer still faces the full security of the remaining layers.
The absence of ambient authority is a critical design principle. No component in the system has implicit permissions — every capability must be explicitly granted through the on-chain access control system. This eliminates the confused deputy vulnerability class, in which a trusted component is tricked into exercising its implicit permissions on behalf of an unauthorized actor. In the Westwyrd architecture, there are no implicit permissions to exploit, because every operation requires explicit cryptographic authorization.
Real-time anomaly detection operates through the VVALT (Vector-Value Arbitration Logic Tree) system, which analyzes transaction patterns, proof submission rates, and state transition characteristics against learned baselines.
The system employs multi-perspective analysis in which each transaction is evaluated from five independent vantage frames. An anomaly is flagged when two or more frames independently produce out-of-range signals.
Full forensic traceability is maintained through a Neo4j knowledge graph that records entity relationships, transaction provenance, and system events. Every state transition, proof verification, and administrative action is recorded as a graph node with timestamped edges connecting it to its causal predecessors.
The graph is maintained independently of the execution layer and is protected by append-only write semantics, enabling rapid root-cause analysis of any system event.