Protocol Docs

Covenant Documentation

Covenant separates permission from custody.

Core Rule

Execution is valid only when current authorization exists.

Authorization is not a one-time setup step. It is a condition checked at settlement time. If the authorization has expired, been revoked, or exceeds its defined boundary, execution fails, regardless of what was agreed earlier.

Roles

User

Signs bounded authorizations. Assets stay in the user's wallet or in the settlement contract escrow. Assets are never in Covenant's custody. The user controls when to revoke.

Seller

In the CSD/USDC market, the seller controls the lock step. The seller calls the settlement contract directly from their wallet when ready to send CSD. This prevents the settlement window from expiring before the seller is prepared.

Executor

Observes the AON network for executable graphs and submits settlement transactions on-chain. The executor is permissionless: it does not have to be either party to the trade. Any third party can run executor software, find completed graphs, and call the settlement contract. The executor pays gas but holds no custody and requires no standing authority. Multiple executors can run simultaneously.

Settlement Contract

Verifies authorization signatures, validity windows, and payment proofs before releasing funds. Enforces all settlement conditions on-chain. Scaling USDC amount limits per trade depending on number of confirmations, enforced in the contract rather than the interface.

What runs underneath

Covenant maintains no application state. All state (sell offers, buyer authorizations, payment proofs, receipts) lives on AON, a peer-to-peer network of content-addressed objects. Settlement is permissionless: any third party observing the network can run executor software, find executable graphs, and settle them without asking anyone. There is no Covenant database. If the Covenant interface disappeared tomorrow, every object would still exist on the network and any executor could settle outstanding trades directly against the contracts.

Settlement is enforced by a Compute Substrate light client deployed on Ethereum. The contract verifies SPV proofs of CSD payments using the same mechanism Bitcoin uses for lightweight payment verification.

CSD / USDC Flow

1. Seller creates a CSD sell offer on the AON network.
2. Buyer selects the offer and enters their CSD receive address.
3. Buyer approves USDC and signs a bounded authorization binding their address, exact amounts, and the specific offer.
4. Seller sees the authorization and locks USDC from their wallet when ready.
5. Seller sends CSD to the buyer's address on Compute Substrate.
6. Seller submits the CSD transaction ID.
7. The SPV proof is fetched and published as an object on AON.
8. An executor finds the completed graph on AON and calls the settlement contract.
9. The contract verifies the CSD payment proof independently and releases USDC to the seller.

Revocation

Before settlement lock, the buyer can revoke authorization. Revocation is an object published to the AON network. Executors check for it before acting. After revocation, the executor will not call the settlement contract.

During the lock window, USDC cannot be returned to the buyer directly. The settlement contract enforces this: while locked, funds can only move via settleCsdUsdc (to the seller, on valid proof) or via refundExpiredLock (back to the buyer, after the window expires).

If a buyer revokes on AON after USDC is locked, the seller can call the settlement contract directly with the CSD proof, bypassing the executor. The contract verifies the proof alone, independent of AON revocation state. The Covenant interface detects this and shows the seller a direct settlement button.

Security Boundaries

• No asset deposit into Covenant.
• No internal user balances.
• No standing execution authority.
• Authorization owner controls revocation.
• Settlement requires proof matching the signed authorization.
• Genesis hash, script hash, amount, and consumed-tx state are checked on-chain.
• Tampered transactions are rejected via merkle proof verification.
• Enforced USDC limits per trade, enforced in the settlement contract.

Launch Status

Covenant is experimental software. The 100 USDC per trade limit reflects 1-confirmation settlement on an early-stage proof-of-work chain. Settlement is trustless and the contract does not rely on Covenant or any operator, but trade sizes are bounded to match current network security assumptions. The limits will increase as Compute Substrate hashrate grows.

← Market · About · AON Network · Compute Substrate