Moving assets between chains without a custodian

The Oriel bridge moves assets between Oriel and other chains with light-client proofs, so no person or company holds the funds on the way. It has carried more than $1.3B since launch, and before its limit rises from $50M to $200M, we want a second firm to read the code.

How a transfer works

Say you move 1,000 USDC from another chain to Oriel. Four things happen, and none of them needs anyone's permission.

• Lock: the vault contract on the other chain takes the 1,000 USDC and holds it.
• Prove: a relayer sends Oriel a proof that the lock sits in a finalised block.
• Verify: Oriel checks that proof against the validator set of the other chain.
• Release: once the proof checks out, the same amount arrives in your wallet on Oriel.

The way back is the same in reverse. The other chain checks a proof from Oriel, then the vault releases the USDC.

Why there is no multisig

Many bridges keep their funds in a wallet controlled by a few signers. If enough of those keys are stolen, the funds go too, and that is how most large bridge losses have happened. On Oriel, a relayer only carries the proof and cannot change it: a false proof fails the check, whoever sends it.

Anyone can run a relayer. If every relayer stopped tomorrow, transfers would wait until someone started one again, but no funds would be at risk.

What the second audit will check

The first audit covered the version that went live in 2025. Three upgrades have shipped since, and raising the limit four times without a fresh review would put far more money behind code that only one firm has read.

The audit will cover the light-client verifier, the token vault, the upgrade path and the pause switch, which can stop new transfers while a problem is checked. Two firms have quoted for eight weeks of work. I will post the proposal on the forum in November with both quotes, and whoever does the work will publish the full report, including the issues we fix before it comes out.