Mercury Layer is a Bitcoin layer 2 for private, instant off-chain payments. This prototype uses blind-signing statechains and BIP448 to save a pre-signed update and settlement path for each accepted statecoin state. The latest path allows an on-chain withdrawal without Mercury or Enclavia after the 144-block challenge delay.
How BIP448 rebinding works. OP_TEMPLATEHASH commits to the spending transaction's version, locktime, input sequences, outputs, and input position, but not its previous outpoint. OP_CHECKSIGFROMSTACK verifies a Schnorr signature over that template hash, and OP_INTERNALKEY supplies the Taproot output's aggregate internal key. The same authorized update can therefore be rebound to a compatible earlier state output, moving the coin to the latest state before an older settlement becomes valid.
Enclavia.io TEE. Mercury keeps its signing share and monotonic state in an Enclavia.io AWS Nitro enclave with encrypted storage and Enclavia anti-rollback protection. Verify enclave checks the direct SDK Noise channel, Nitro attestation, and pinned PCRs. Verify coin checks the Lockbox server share through that channel; Mercury cannot read or forge the exchange.
Trust assumption. A previous owner and Mercury could steal from a future owner if they collude. The TEE is intended to verify that the Mercury server deleted its previous signing share.
Someone must watch the chain. If a previous owner attempts to withdraw via their old state, you or a delegated watcher have 144 blocks to broadcast the newer saved state before they can settle. This prototype has no automatic watcher, and the seed phrase alone does not restore the saved exit transactions.
Proof of concept. This is a Mutinynet research prototype by @lx.dev, not a production wallet. Review is welcome on the GitHub branch, and issue reports are welcome.
Credits. The rebindable-signature BIP448 work was done by localhost and w0xlt.