Unwrap / Burn / Release
Process flow for transferring wrapped tokens OUT of JIL L1 back to external chains. jBTC to BTC, jETH to ETH, jUSDC to USDC. Eight steps from initiation to external chain release with compliance gating and 14-of-20 validator consensus (70% BFT).
From user initiation through compliance gates
The user initiates an unwrap in the Web Wallet, signs with their passkey, and the transaction passes through fail-closed compliance screening before the burn transaction is submitted.
User Initiates Unwrap
User clicks "Withdraw" in Web Wallet. Selects wrapped asset (jBTC / jETH / jUSDC), amount, and destination address.
- Frontend sends
POST /wallet/unwrap/options - Specifies asset, amount, destination_chain, destination_address
Passkey Challenge Generated
System builds PaymentTx payload: from=user_account, to=bridge_authority, asset=jBTC, amount, nonce. Challenge is SHA-256 digest.
- Challenge:
sha256("JILTX|jil-mainnet-1|acct_user|bridge_authority|jBTC|amount|nonce") - Returns WebAuthn authentication options to user's device
User Signs with Passkey
Device prompts biometric or PIN. WebAuthn assertion returned: authenticatorData, clientDataJSON, signature.
- Frontend submits
POST /wallet/unwrap/submitwith signed assertion
Compliance Gates (Fail-Closed)
ATCE anti-dump check via POST /atce/check-sell. General compliance screening via POST /check/tx. If compliance-api is unavailable, unwrap is BLOCKED (fail-closed, never bypassed). Both checks must pass before the burn transaction is submitted to the ledger.
ATCE = Anti-Token-Concentration-and-Extraction
- Per-user daily and weekly sell/withdrawal limits
- Prevents market manipulation and coordinated dump attacks
- Fail-closed: if compliance-api is unreachable, the unwrap is blocked (never bypassed)
- General compliance screening (/check/tx) runs sanctions and watchlist checks
- Both checks must pass before the burn transaction is submitted to the ledger
Burn on L1, validator consensus, external chain release
After compliance clears, the burn transaction executes on JIL L1, validators reach consensus, and the bridge authority releases the original assets on the external chain.
Burn Transaction on JIL L1
Submit signed PaymentTx: user to bridge_authority. Ledger applies transaction, reduces user's jBTC balance. Bridge authority receives the wrapper tokens (effectively "burned" from user perspective). Returns tx_id.
- Note: JIL L1 ledger (jil5600-core) only supports PaymentTx
- "Burn" = transfer to bridge_authority
Record Withdrawal + Security Gates
POST /v1/withdrawal to bridge-relayer. Proof-of-reserves verified: total_minted must not exceed total_deposited - total_withdrawn. Runtime invariant checks validate that net minted supply never exceeds total deposits before processing withdrawals, providing continuous formal verification of bridge solvency. Daily outflow cap checked. If bridge is paused or reserves mismatch, withdrawal is rejected. Kafka event: UNWRAP_SUBMITTED published.
Validator Consensus (14-of-20 BFT)
Each validator independently verifies reserves, then signs the withdrawal_hash. Signatures submitted via POST /v1/withdrawal/:id/sign. 14+ valid signatures collected (70% threshold) - status transitions to "approved". Reserves are re-checked before each signature is accepted.
External Chain Release
Bridge authority executes multi-sig release on Ethereum. User receives BTC/ETH/USDC at their destination_address. Status: "executed", dest_tx_hash recorded. User can track progress: GET /wallet/unwrap/:id/status
- 14-of-20 validators across 13 jurisdictions (70% BFT threshold)
- Both deposits (minting) and withdrawals (releasing) require 14-of-20 multi-validator consensus
- Proof-of-reserves enforcement: Verified before every withdrawal signature - total_minted cannot exceed total_deposited minus total_withdrawn
- Circuit breakers: Bridge auto-pauses on reserves mismatch or daily outflow cap breach
- Each validator independently verifies the burn transaction on JIL L1 before signing
- Signatures use Ed25519 keys registered during the 7-gate validator startup sequence
- Withdrawal hash is deterministic:
sha256(sender|recipient|token|amount|block_height|jil_tx)
Status Progression
Key Endpoints
| Service | Endpoint | Method | Purpose |
|---|---|---|---|
| wallet-api | /wallet/unwrap/options | POST | Prepare passkey challenge for burn |
| wallet-api | /wallet/unwrap/submit | POST | Submit signed burn + record withdrawal |
| wallet-api | /wallet/unwrap/:id/status | GET | Track withdrawal progress |
| compliance-api | /atce/check-sell | POST | ATCE anti-dump compliance check |
| compliance-api | /check/tx | POST | General compliance / sanctions screening |
| bridge-relayer | /v1/withdrawal | POST | Record pending withdrawal |
| bridge-relayer | /v1/withdrawal/:id/sign | POST | Submit validator signature |
Database Tables
Unwrap on JIL L1. Release on Ethereum. Secure.
Fail-closed compliance, passkey-signed burns, 14-of-20 validator consensus, and multi-sig external release. Every withdrawal is verified before funds move.