Bridge and trust model

Who holds what

• The gas token deposited for all layers sits at the Dotwork bridge address on Robinhood Chain, an account controlled by the operator. Its balance is public.
• On each layer, a bridge reserve account holds the unissued native supply. Deposits are paid out of it; withdrawals are paid into it. Native supply on a layer is therefore genesis reserve minus reserve balance, published in every batch next to the token held for that layer.
• The node, the gateway and the batch signer are run by the operator. A layer today is an operator-run chain, not a rollup: you rely on the operator to keep the node running and to honour withdrawals.

What you can verify yourself

• Every deposit is a public transfer on Robinhood Chain with the target chain id in its calldata, and a public credit transaction on the layer.
• Every withdrawal is a public transfer to the layer's bridge address and, for USDG, a public receiveWithAuthorization on Robinhood Chain.
• Every batch is signed with EIP-712 by the operator key and states the native supply and the token held, so anyone can check that what circulates on a layer is backed.

Deposit

data = 0xa9059cbb ++ abi.encode(bridge, amount) ++ bytes32(chainId)
POST /api/bridge/deposit { "txHash": "0x..." }

The sender of the transfer is credited with amount × 10^(18 − decimals) on the layer whose chain id is in the memo.

Withdraw

1. On the layer, send the gas token (native value) to the layer's bridge address.
2. The service sees the transfer in the next block. For USDG it signs an EIP-3009 ReceiveWithAuthorization from the bridge address to you: value in 6 decimals, valid for 30 days, nonce keccak256(chainId, layerTxHash).
3. You submit receiveWithAuthorization on the USDG contract (0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168) from your own wallet. Only the recipient can submit it, and each nonce works once.

For a layer whose gas token is not USDG, the withdrawal is paid by an operator transfer of that token instead.

Next step for custody

A settlement contract, DotworkHub, is written and tested: it holds deposits per layer, takes plan payments, records batches and pays withdrawals against operator-signed vouchers, with a two-day timelock on operator changes. When it is deployed, the bridge address above becomes that contract and this page will say so.