BIP448 unilateral exit. This wallet uses BIP448 to save a pre-signed update and settlement path for every accepted statecoin state. The latest saved path lets you withdraw on-chain without Mercury or Enclavia after the challenge delay.
Enclavia.io TEE. Mercury keeps its signing share and monotonic state in an Enclavia.io AWS Nitro enclave. Its encrypted persistent storage uses Enclavia anti-rollback protection with a synchronizer. Verify enclave performs a browser-direct Enclavia SDK Noise handshake and verifies the Nitro attestation certificate chain, handshake binding, and pinned PCRs. Verify coin sends a fresh challenge through that encrypted channel and checks the Lockbox's server share. Mercury cannot read or forge the verification exchange.
Trust assumption. Under the watched protocol, a previous owner and the TEE must not collude; without that collusion, neither can spend the current offchain key alone.
You must watch the chain. A previous owner can broadcast an older update and, once it confirms and its challenge delay expires, settle it to their recovery address. The protocol lets the current owner rebind and broadcast the newer saved state during that window. This prototype has no automatic watcher or runtime stale-state recovery; that defense is only exercised by the test harness. The seed phrase alone does not restore the saved exit transactions.
Proof of concept. This is a Mutinynet research prototype, not a production wallet. Review is welcome on the GitHub branch, and issue reports are welcome.
Credits. The rebindable-signature BIP448 work was done by localhost and w0xlt.