Trust
Center

The Westwyrd security model is constructed on a verification-first principle: no state transition is accepted unless it is accompanied by a cryptographic proof of correct execution. This is not a policy decision — it is an architectural invariant enforced at the circuit level. The proof system employs Groth16 zero-knowledge proofs over the BN254 elliptic curve, selected for their constant-time verification complexity, minimal on-chain gas footprint, and well-characterized security parameters under the algebraic group model.

All cryptographic primitives are selected for their formal security guarantees and resistance to known attack vectors. No custom or unaudited cryptographic constructions are used in production systems. The hash function used throughout the protocol is Poseidon, an algebraically-optimized hash function designed specifically for efficient computation within ZK circuit arithmetic. Its security has been analyzed under the Marvellous design framework, providing 128-bit security against algebraic attacks including Gröbner basis computation, interpolation attacks, and differential/linear cryptanalysis.

Circuit-to-contract binding eliminates proof mismatch risk by ensuring that deployed verifier contracts are deterministically derived from compiled circuits. The verification key embedded in each on-chain verifier is the exact output of the circuit compilation process — any modification to the circuit logic produces a different verification key, which would cause the on-chain verifier to reject all proofs generated by the modified circuit. This binding is verified during the deployment process using a formal proof that the verification key corresponds to the intended circuit, preventing supply-chain attacks on the proving infrastructure.

Westwyrd does not take custody of user assets at any point in the settlement lifecycle. The protocol provides verification infrastructure that allows users to prove ownership and authorize state transitions without surrendering control of their private keys. Asset ownership remains with the user at all times, determined exclusively by cryptographic key possession and verified through digital signature authentication at each state transition boundary.

This non-custodial design eliminates an entire class of systemic risk that has historically plagued institutional settlement systems. In the traditional clearinghouse model, the central counterparty assumes temporary custody of assets during the settlement window — exposing participants to counterparty risk if the clearinghouse becomes insolvent. The Westwyrd protocol eliminates this risk by design, not by policy. There is no settlement window, no central counterparty, and no moment at which assets are operationally controlled by any party other than their owner.

For institutional participants who require segregated key management, the protocol supports integration with Hardware Security Modules (HSMs) through standard PKCS#11 interfaces. Multi-party computation (MPC) key management solutions are supported through the protocol's native EdDSA signature scheme, which is compatible with threshold signature protocols that distribute key shares across multiple custodians without ever reconstructing the full private key.

The Westwyrd data handling model follows the principle of minimal disclosure: the protocol processes only the data strictly necessary for verification, and this data is consumed through zero-knowledge proofs that reveal nothing beyond the validity of the computation. No behavioral telemetry, usage metrics, or personal information is required for protocol operation. All inputs are deterministic, user-provided, and explicitly declared in published schemas.

Zero-knowledge proofs allow verification of claims without revealing the underlying data. A custody attestation proof demonstrates that a user possesses a valid asset claim without revealing the specific asset, its quantity, or the user's identity. The verifier learns only that the claim satisfies the verification circuit's constraints — a property known as "zero-knowledge" in the formal cryptographic sense. This property has been formally proven for the Groth16 proof system under the q-Power Knowledge of Exponent assumption.

The protocol's data minimization extends to its off-chain infrastructure. The sequencer processes transactions without accessing the content of encrypted payload fields. Observer nodes maintain only the state commitments (Poseidon hashes) rather than the full plaintext state. This layered encryption model ensures that even infrastructure operators cannot access user data — a critical property for compliance with privacy regulations including GDPR and the Swiss Federal Data Protection Act (nDSG).