Mercury Layer is a Bitcoin layer 2 for private, instant off-chain payments. This prototype uses blind-signing statechains and BIP448 to save a pre-signed update and settlement path for each accepted statecoin state. The latest path allows an on-chain withdrawal without Mercury or Enclavia after the 144-block challenge delay.
Proposed soft fork. BIP448 is a soft-fork proposal and is not currently active on Bitcoin mainnet. This prototype instead runs on Mutinynet, where the proposal's required opcodes are available.
How BIP448 rebinding works. Each state saves a pre-signed update U(n) and settlement S(n). OP_TEMPLATEHASH commits to the transaction template but omits the input's previous outpoint. OP_CHECKSIGFROMSTACK verifies its Schnorr signature against the aggregate Taproot internal key supplied by OP_INTERNALKEY. Replacing only the update's input outpoint therefore preserves both the template hash and signature. A newer update can spend a compatible older state output because its higher locktime satisfies the older update path while the committed outputs and value remain unchanged, moving the coin to the latest state before an older settlement's 144-block delay completes.
Enclavia.io TEE. Mercury keeps its signing share and monotonic state in an Enclavia.io AWS Nitro enclave with encrypted storage and Enclavia anti-rollback protection. Verify enclave checks the direct SDK Noise channel, Nitro attestation, and pinned PCRs. Verify coin checks the Lockbox server share through that channel; Mercury cannot read or forge the exchange.
Trust assumption. A previous owner and Mercury could steal from a future owner if they collude. The TEE is intended to verify that the Mercury server deleted its previous signing share.
Someone must watch the chain. If a previous owner attempts to withdraw via their old state, you or a delegated watcher have 144 blocks to broadcast the newer saved state before they can settle. This prototype has no automatic watcher, and the seed phrase alone does not restore the saved exit transactions.
Proof of concept. This is a Mutinynet research prototype by @lx.dev, not a production wallet. Review is welcome on the GitHub branch.
Credits. The rebindable-signature BIP448 work was done by localhost and w0xlt.