FAQ
Direct answers to the most common questions about the Cross-Chain Swap Engine.
How it works
What is the Cross-Chain Swap Engine?
The Cross-Chain Swap Engine is a settlement protocol that exchanges value between Canton Network and Ethereum. A user submits a request for quote, a counterparty provides a quote, and the two parties settle atomically through paired hashed-timelock contracts. Either both sides settle or both sides refund.
See Quickstart for the full lifecycle.
What does "atomic settlement" actually mean?
It means that there is no on-chain state in which one side of the swap has moved and the other has not. The two locks on the two chains are bound to the same hashlock — a single secret preimage releases both. If the preimage is never revealed before the time-locks expire, both sides refund independently. There is no middle outcome.
Each side has its own time-lock, anchored at quote acceptance: the Canton-side time-lock defaults to 6 hours and the Ethereum-side to 2 hours (the on-chain HTLC enforces a 1-hour minimum). The Canton-side deadline is always set strictly later than the Ethereum-side one — the HTLC safety property that prevents a free-option attack. A swap typically completes in minutes once both sides have locked; the time-locks are the outer bound, not the expected settlement time.
See Security model for the mechanics.
Who are the counterparties in a swap?
Two: the user initiating the swap and a counterparty providing the asset on the other chain. At launch, Interstice acts as a counterparty itself, providing liquidity from its own wallets; additional counterparties are onboarding shortly. Interstice also operates the off-chain coordination layer that routes the request for quote and records status. Whether Interstice or another counterparty fills a given trade, the counterparty's funds are locked in the same on-chain HTLCs as the user's — no participant custodies another participant's funds.
See Counterparties.
Is a transaction observable on-chain?
It depends which chain. Canton uses a stakeholder visibility model — a swap is visible only to its two participants and the platform's operational parties (the coordination and treasury parties), not to the rest of the network. Other Canton participants cannot see the swap's existence, parties, or amounts. Ethereum, for example, is fully public — the lock, claim, and refund transactions are all visible to anyone watching the chain. A third party watching both chains can correlate the two halves via the shared hashlock.
After settlement, both the user and the counterparty receive a downloadable trade confirmation that includes the on-chain transaction references for verification: the Ethereum transaction hashes, the Canton contract IDs, and the HTLC parameters. It is generated by the platform for the parties to the trade only.
See Privacy and on-chain footprint.
Fees
What fees does the Cross-Chain Swap Engine charge?
Platform fee: The current platform fee is 10 basis points (0.10% of the swap amount). The rate is subject to change — it is set on-chain in the platform's fee registry and is visible to anyone querying the contract. You see the rate that applies to your swap in the quote before you confirm.
The total cost of a swap may still vary based on factors such as network fees and the pricing provided by the swapping counterparty. These costs are reflected in the quote presented before the user commits to a swap.
Counterparty spread: The counterparty providing liquidity sets a spread on each quote — the difference between the rate they offer and a reference market rate. The spread is the counterparty's compensation for committing balance sheet and taking inventory risk. It is included in the all-in rate shown in the quote before the user confirms, so the rate the user accepts is the rate the swap settles at.
See Fees for more information.
Security and custody
Does Interstice ever hold custody of my assets?
No. When a swap is created, both sides' assets are locked in smart contracts that enforce the swap rules automatically — including when Interstice is the counterparty providing liquidity on the other side. The contracts release funds only to the rightful recipient or refund them to the locker; no participant can move another participant's locked assets.
The assets can only leave the lock in one of two ways:
The intended recipient completes the swap by providing the required preimage, which releases the funds to the recipient specified when the lock was created.
The original sender gets a refund after a predefined timeout expires if the swap is not completed.
At no point can Interstice redirect, withdraw, or take custody of the funds. The smart contracts themselves enforce these rules, and only the sender or intended recipient can trigger the allowed outcomes.
Does the counterparty ever hold custody of my assets?
No. The counterparty locks the asset they will deliver to you. You lock the asset you will deliver to them. Each side's lock is held by the on-chain contract on that side's chain, not by the other side. The counterparty cannot move the asset you locked — they can only claim it by presenting the preimage that matches the hashlock you both agreed to.
What happens if a swap fails?
It depends where in the protocol the failure occurs.
Before either side locks funds: Nothing has been committed on-chain, so the user can simply try again.
After one side locks funds, but the other side never does: The side that locked funds can recover the full amount once the lock expires. No fee is charged.
After both sides lock funds, but neither side completes the swap before the lock expires: both sides refund independently.
The protocol does not have a failure mode that leaves one side moved and the other not.
See Failure modes for the full treatment.
Is there a record of each swap I can keep for compliance?
Yes. After every settled swap, both parties receive a downloadable trade confirmation document that includes the on-chain transaction references (Ethereum transaction hashes and Canton contract IDs), the HTLC parameters, a settlement timeline, and a compliance attestation confirming non-custody. It is generated automatically and maintained in an append-only audit log.
What sensitive data is encrypted and how?
Connections to the Cross-Chain Swap Engine application use TLS (Transport Layer Security). Sensitive credentials stored in the platform's databases — notably the Canton JWT used to authenticate to the Canton JSON API — are stored encrypted using AES-256-GCM. Database-wide at-rest encryption is provided by the underlying database platform.
Account protection
How do I authorise each swap?
Each on-chain settlement step — the lock on the origin chain and the claim on the destination chain — is signed in the user's connected wallet (for example, MetaMask for Ethereum and Console Wallet for Canton). The wallet displays the transaction details and prompts the user to approve and sign. The signing key never leaves the wallet. Interstice never sees or holds the user's private keys.
How are dashboard sign-ins protected?
Sign-in to the application dashboard is independent from the wallet signature required to authorise an on-chain swap. Dashboard sign-in uses the underlying authentication provider's two-factor options, which include authenticator-app TOTP and recovery-code-based recovery. On-chain signing always requires the wallet itself, regardless of dashboard session state.
Verification
What screening is done before I can use the Cross-Chain Swap Engine?
Entities undergo:
Identity verification (KYC or KYB): Individuals complete Know Your Customer (KYC) checks, while businesses complete Know Your Business (KYB) checks.
Sanctions and watchlist screening: Entities are screened against applicable sanctions and watchlists.
Wallet screening: All blockchain addresses used for swaps are screened for compliance risks.
Terms acceptance: Entities must accept the current Cross-Chain Swap Engine terms.
These checks are performed using third-party compliance providers, including Trulioo and TRM Labs.
All four must complete successfully before the entity can participate in a swap. Each is re-run on a periodic basis; if any subsequently lapses, new swaps are paused but in-flight swaps continue to settle through the on-chain contracts.
Counterparties providing liquidity into the engine undergo the same screening before they can quote on RFQs.
See Verification.
Platform configuration — the platform fee rate, the minimum and maximum trade sizes, the supported-asset set, and the time-locks — can change. The values given in this FAQ are current as of launch; the application always shows the values in force before you confirm a swap.
Last updated