SECURITY / TRUST BOUNDARY
MODEL trusted relayerSCOPE testnetMAINNET not ready
The honest boundary.
Trestle is not certified and not mainnet-ready. This page states what protects users today, what does not, and what must change first.
| Property | Today (testnet) | Required for mainnet |
|---|---|---|
| Message validity | TrustedRelayerIsm — one configured relayer accepts the message | Validator set or multisig ISM with a threshold |
| Relay scope | Router-scoped: origin, destination, sender and recipient must all match a Trestle route | Keep, plus monitoring on rejected traffic |
| Key custody | One deployer key is also the trusted relayer | Isolated relayer key; owner key offline |
| Value limits | None — testnet assets only | Per-transfer, per-route and daily caps with a pause path |
| Remote assets | Synthetic botUSDT, no real value | Canonical liquidity, funded by the ecosystem not the builder |
| Verdict | Testnet-verified prototype | Independent audit before any real funds |
01
WHAT ALREADY HOLDS
Protections in place.
Relayer ignores mailbox messages that are not a Trestle router-to-router routeenforced
Locked collateral is checked against summed synthetic supply on every test runenforced
Heartbeat, stuck-message and gas-floor watchdog with alertsrunning
Deployer keys, state files and env files are gitignored and never publishedenforced
MAINNET PATH
Order of operations.
| Step | Change | Why |
|---|---|---|
| 01 | Replace TrustedRelayerIsm with a validator or multisig ISM | Removes single-key message validity |
| 02 | Separate relayer key from the owner key | Limits blast radius of a hot key |
| 03 | Add transfer caps, rate limits and a pause control | Bounds damage from any residual failure |
| 04 | Add RPC redundancy and alerting for every leg | Arc currently has a single public RPC |
| 05 | Commission an independent audit | The only thing that turns verified into certified |