I owned the contract layer: settlement engine and its economics, blank repo to mainnet

At Portal to Bitcoin I owned the EVM contract layer, and I architected all of it, not just the settlement path but the whole economic system wrapped around it. Blank repo to mainnet: 15 contracts across Ethereum and Portal chain, TGE in September 2025, full launch in November 2025, no recorded exploit since.

Context#

Portal to Bitcoin is a $110M+ funded noncustodial settlement protocol between Bitcoin and EVM chains: trustless BTC to EVM with no bridge operator, no wrapped assets, users holding their own keys through the entire flow. That's the hard version of the crosschain problem.

But moving value is only half of a protocol like this. The other half is economics, who stakes, what gets slashed, how honest behavior is made the profitable move for everyone touching the system, how liquidity, fees, and multitoken balances are accounted for and how assets and chains get registered in the first place. That second half is the same class of machinery that sits under any serious onchain venue: a DEX, a perps exchange, an RWA settlement rail, an onchain agent that moves funds. It happens to be settlement here, but the problem is onchain systems design with real money and adversarial counterparties on both sides.

When I came in there was early AMM code and little else. I owned everything from there.

What I designed and built#

I owned the EVM side. The architecture, the security posture, and the hard calls were mine, and I re-architected the system from scratch rather than refactor the legacy code, into a dual chain ecosystem: 4 contracts on Ethereum, 11 on Portal chain. It divides into two halves I owned equally.

The settlement engine. A hash timelocked (HTLC) atomic settlement core, with asymmetric timeout calibration because Bitcoin counts blocks and the EVM counts seconds and a naive symmetric window is exploitable. ERC-6909 multitoken accounting underneath it, so balances settle per session instead of per trade. Asset and chain registries so new markets and new chains onboard as data, not redeploys. And the onchain matching engine that replaced the inherited AMM, that reversal carries enough weight to be its own case study.

The economic system. Validator staking and slashing. The rewards and penalties incentive layer, the mechanism that makes acting honestly the dominant strategy not just for validators but for the users themselves, so a counterparty who stalls or deviates loses more than they could gain. Liquidity management and the fee mechanics that fund and balance the whole thing. This is the part most people picture as "someone else's job." On this protocol it was mine, and it's the part that's most transferable: it's mechanism design against economic actors, which is the same problem whether the venue clears BTC swaps, perps, or tokenized assets.

Every deployment and operational transaction runs through Gnosis Safe batch scripts. No single key ever touched mainnet state.

The calls that mattered#

Make dishonesty unprofitable for users, not just validators. The easy version of an incentive system polices the operators and trusts the users. Against Bitcoin's ten minute confirmation window, that leaves a free option on the table: a user who can walk away after the price moves is the exploit. I designed the penalty side to bind the users too, so completing the trade honestly is always the cheaper path. Getting the whole set of actors incentive compatible, not just the ones with a stake bond, is what a settlement protocol lives or dies on.

Asymmetric timeouts, because two chains keep different time. The HTLC timeout on the Bitcoin leg and the EVM leg can't be equal; if they are, whoever moves second can grief the party who moved first. Calibrating that asymmetry correctly is the difference between an atomic swap and a way to lose funds.

AMM out, onchain orderbook in. The inherited AMM didn't fit BTC liquidity dynamics or the settlement model, so I led the reversal to an onchain orderbook and built the matching engine that made it affordable. The full argument and the gas work are a case study of their own; the point here is that it was an architecture call I made and then had to make cheap.

External adversarial review as the gate. I made external adversarial review the release gate rather than a formality, and led the full audit lifecycle, scoping through remediation and verification. The reports are public: the critical finding closed the day the audit opened, and every remediation shipped before mainnet launch. Underneath it sat 95%+ coverage with fuzz and invariant testing on every production contract.

Outcomes#

• TGE shipped September 2025 with zero critical issues; full protocol launched on Ethereum mainnet and Portal chain in November 2025.
• 15 contracts live across two chains, the settlement engine and its entire economic system, on a codebase I owned.
• No recorded exploit since launch, earned by the incentive design, the timeout calibration, the test suites, and the audit trail behind them.

What I'd carry into the next system isn't "settlement." It's the ability to own an onchain protocol's contract layer, the mechanism, the accounting, the security posture, and keep it standing under real money from blank repo to mainnet.

Proof#

Every contract address from this deployment is listed on the proof page, across both mainnets, with the sixteen whose Solidity is verified and readable on their explorers marked as such, and the third party audit reports linked underneath them.